Open arianvp opened 2 years ago
People want group info in their tokens (E.g. to map to groups in kubernetes) but we dont want to store group info on our servers.
https://www.w3.org/TR/webauthn-2/#sctn-large-blob-extension allows us to store arbitrary data alongside a public key. We could store a certificate signed with the owner's key and what group the person belongs to.
Flow:
navigator.credentials.rgister
navigator.credentials.get
largeBlob
Webauthn-oidc does all the signature checking; and whoever trusts webauthn-oidc trusts the group claim that webautnn-oidc puts in the token
Though there aren't any production keys on the market with largeBlob support if I am to believe the MDS; Yubico is so kind to provide me with a key that supports CTAP 2.1 / largeBlob
People want group info in their tokens (E.g. to map to groups in kubernetes) but we dont want to store group info on our servers.
https://www.w3.org/TR/webauthn-2/#sctn-large-blob-extension allows us to store arbitrary data alongside a public key. We could store a certificate signed with the owner's key and what group the person belongs to.
Flow:
navigator.credentials.rgister
request. This gets piped to Alice for approval (Maybe through WebRTC?)navigator.credentials.get
and sends the result to BoblargeBlob
Webauthn-oidc does all the signature checking; and whoever trusts webauthn-oidc trusts the group claim that webautnn-oidc puts in the token