WebAuthn

Introduction

The WebAuthnValidation module validates WebAuthn authentication assertions against credentials stored for the user. It also supplies the public-key credential request options used when an authentication begins.

Configuration

Note

Module name: WebAuthnValidation

Properties

Name	Description	Default	Mandatory
namespace	Namespace shared by the token modules and their event-bus addresses.	""
db_driver	Fully qualified JDBC driver class name.	""
jdbc.url	JDBC connection URL for the token database.	""
jdbc.username	Database user name.	""
jdbc.password	Database password.	""
origin	Expected WebAuthn origin, including scheme and any non-default port.	""
user_verification_required	Requires the authenticator data to indicate that the user was verified.	""
user_presence_required	Requires the authenticator data to indicate that the user was present.	""
credential_request_options	Options returned to the user agent when an assertion request is created.	""

Example

{
  "name": "WebAuthnValidation",
  "enabled": true,
  "config": {
    "namespace": "default",
    "db_driver": "com.microsoft.sqlserver.jdbc.SQLServerDriver",
    "jdbc": {
      "url": "jdbc:sqlserver://db.example.com:1433;database=tokens;encrypt=true",
      "username": "tokens",
      "password": "<database password>"
    },
    "origin": "https://login.example.com",
    "user_verification_required": true,
    "user_presence_required": true,
    "credential_request_options": {
      "rpId": "login.example.com",
      "timeout": 60000,
      "userVerification": "preferred"
    }
  }
}

Credential request options

The credential_request_options object is converted to WebAuthn public-key credential request options and sent to the user agent when authentication begins.

Name	Description	Default	Mandatory
rpId	Relying Party ID. It normally matches the effective domain of the login service.	Current origin's effective domain
timeout	Recommended client-side timeout in milliseconds.	User-agent default
userVerification	User-verification requirement sent to the authenticator: required, preferred, or discouraged.	"preferred"

For the browser-facing data model and processing rules, see the WebAuthn Level 2 specification.