11eee2f5 · cryptotaxi247/MeshCentral

meshcentral-config-schema.json

+6

@@ -1793,6 +1793,12 @@

1793 "default": null,

1794 "description": "Maximum number of FIDO/YubikeyOTP hardware 2FA keys that can be setup in a user account."

1795 },

1796 + "fidopininput": {

1797 + "type": "string",

1798 + "default": "preferred",

1799 + "enum": ["preferred", "required", "discouraged"],

1800 + "description": "Controls FIDO PIN prompt behavior: 'preferred' (asks only if key requires PIN), 'required' (always asks for PIN), or 'discouraged' (never asks for PIN). Default: 'preferred'."

1801 + },

1802 "allowaccountreset": {

1803 "type": "boolean",

1804 "default": true,

meshuser.js

+1

@@ -4017,6 +4017,7 @@ module.exports.CreateMeshUser = function (parent, db, ws, req, args, domain, use

4017 // Send the registration request

4018 var registrationOptions = parent.webauthn.generateRegistrationChallenge("Anonymous Service", { id: Buffer.from(user._id, 'binary').toString('base64'), name: user._id, displayName: user._id.split('/')[2] });

4019 //console.log('registrationOptions', registrationOptions);

4020 + registrationOptions.userVerification = (domain.passwordrequirements && domain.passwordrequirements.fidopininput) ? domain.passwordrequirements.fidopininput : 'preferred'; // Use the domain setting if it exists, otherwise use 'preferred'.

4021 obj.webAuthnReqistrationRequest = { action: 'webauthn-startregister', keyname: command.name, request: registrationOptions };

4022 ws.send(JSON.stringify(obj.webAuthnReqistrationRequest));

4023 break;

views/login.handlebars

+1 -1

@@ -539,7 +539,7 @@

539 if ((hardwareKeyChallenge != null) && (hardwareKeyChallenge.type == 'webAuthn')) {

540 if (typeof hardwareKeyChallenge.challenge == 'string') { hardwareKeyChallenge.challenge = Uint8Array.from(atob(hardwareKeyChallenge.challenge), function (c) { return c.charCodeAt(0) }).buffer; }

541

542 - publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout }

542 + publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout, userVerification: hardwareKeyChallenge.userVerification ? hardwareKeyChallenge.userVerification : 'preferred' }

543 for (var i = 0; i < hardwareKeyChallenge.keyIds.length; i++) {

544 publicKeyCredentialRequestOptions.allowCredentials.push(

545 { id: Uint8Array.from(atob(hardwareKeyChallenge.keyIds[i]), function (c) { return c.charCodeAt(0) }), type: 'public-key', transports: ['usb', 'ble', 'nfc', 'internal'] }

views/login2.handlebars

+1 -1

@@ -635,7 +635,7 @@

635 if ((hardwareKeyChallenge != null) && (hardwareKeyChallenge.type == 'webAuthn')) {

636 if (typeof hardwareKeyChallenge.challenge == 'string') { hardwareKeyChallenge.challenge = Uint8Array.from(atob(hardwareKeyChallenge.challenge), function (c) { return c.charCodeAt(0) }).buffer; }

637

638 - publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout }

638 + publicKeyCredentialRequestOptions = { challenge: hardwareKeyChallenge.challenge, allowCredentials: [], timeout: hardwareKeyChallenge.timeout, userVerification: hardwareKeyChallenge.userVerification ? hardwareKeyChallenge.userVerification : 'preferred' }

639 for (var i = 0; i < hardwareKeyChallenge.keyIds.length; i++) {

640 publicKeyCredentialRequestOptions.allowCredentials.push(

641 { id: Uint8Array.from(atob(hardwareKeyChallenge.keyIds[i]), function (c) { return c.charCodeAt(0) }), type: 'public-key', transports: ['usb', 'ble', 'nfc', 'internal'] }

webserver.js

+2

@@ -1105,6 +1105,8 @@ module.exports.CreateWebServer = function (parent, db, args, certificates, doneF

1105 if (webAuthnKeys.length > 0) {

1106 // Generate a Webauthn challenge, this is really easy, no need to call any modules to do this.

1107 var authnOptions = { type: 'webAuthn', keyIds: [], timeout: 60000, challenge: obj.crypto.randomBytes(64).toString('base64') };

1108 + // userVerification: 'preferred' use security pin if possible (default), 'required' always use security pin, 'discouraged' do not use security pin.

1109 + authnOptions.userVerification = (domain.passwordrequirements && domain.passwordrequirements.fidopininput) ? domain.passwordrequirements.fidopininput : 'preferred'; // Use the domain setting if it exists, otherwise use 'preferred'.{

1110 for (var i = 0; i < webAuthnKeys.length; i++) { authnOptions.keyIds.push(webAuthnKeys[i].keyId); }

1111 sec.u2f = authnOptions.challenge;

1112 req.session.e = parent.encryptSessionData(sec);

allow fido to not ask for pin (fidopininput) #7115