search

Yubico / java-webauthn-server

Server-side Web Authentication library for Java https://www.w3.org/TR/webauthn/#rp-operations
Other
439 stars 137 forks source link

Lookup credentials based only on user_handle instead of user_name #317

Open yunhao-cash opened 10 months ago

yunhao-cash commented 10 months ago

Hello team,

I've observed that sometime we use user_name to look up stored public key credentials, examples are when we resolve the allowCredentials list in authentication ceremony and excludeCredentials list in registration ceremony.

I wonder if we can just use user_handle to resolve for credential instead? as user_handle is more "immutable" than user_name, which could be changed from time to time.

Is that to accomodate sometime user_handle is missing but only user_name is presenting?

emlun commented 9 months ago

Hi! This sounds like a duplicate of issue #274, which is about supporting username-less accounts. There is some experimental support for that available, see the most recent few comments in the #274 thread. Does that answer your questions?

yunhao-cash commented 9 months ago

Hi! This sounds like a duplicate of issue #274, which is about supporting username-less accounts. There is some experimental support for that available, see the most recent few comments in the #274 thread. Does that answer your questions?

Hi, thanks for the response! I take a look at the v2 interface, it seems exactly fit our need - prefer using user_handle as the key to fetch data in the repository. I wonder what's the plan for promoting the experimental branch to mainline, is there any plan for that?

emlun commented 9 months ago

We want to do it eventually, but there's no concrete time plan at the moment. Perhaps in one or two months from now, but I can't promise that either. Sorry I can't give you a better answer.

emlun commented 9 months ago

But please let us know if there's a particular time frame that would help you, and we can take that into consideration when prioritizing work. We could probably also make the v2 interfaces available in a shorter time frame as an experimental release, like 2.6.0-alpha1, if you need it for prototyping.

yunhao-cash commented 9 months ago

But please let us know if there's a particular time frame that would help you, and we can take that into consideration when prioritizing work. We could probably also make the v2 interfaces available in a shorter time frame as an experimental release, like 2.6.0-alpha1, if you need it for prototyping.

Thanks for quick reply, I think releasing it to an alpha could help a lot and we will start integrating v2 repository.

Our feature is not launched yet, we do want to launch it sometime in Q4 (October/November 2023), integrating with v2 repository will allow us to avoid some user_name -> user_handle lookup so if time permits we do want to include it in the first release.

emlun commented 9 months ago

Thanks for letting us know! I can't promise an experimental release yet, but we'll let you know if we set a planned release date.

emlun commented 8 months ago

Hi again! We're aiming to make the experimental release with the new V2 interfaces soon, hopefully this week or next week. Would that be helpful for you?

yunhao-cash commented 8 months ago

Hi again! We're aiming to make the experimental release with the new V2 interfaces soon, hopefully this week or next week. Would that be helpful for you?

That would be awesome and will help our timeline 🙏

emlun commented 8 months ago

Sorry, the release has slipped a bit, but we hope to finish it this week.

emlun commented 8 months ago

This is now released in experimental release 2.6.0-alpha4. Thanks for your patience!