mirror of
https://github.com/zitadel/zitadel.git
synced 2024-12-24 00:28:18 +00:00
bd5defa96a
This fix provides a possibility to pass a domain on the session, which will be used (as rpID) to create a passkey / u2f assertion and attestation. This is useful in cases where the login UI is served under a different domain / origin than the ZITADEL API.
99 lines
2.3 KiB
Go
99 lines
2.3 KiB
Go
package domain
|
|
|
|
import (
|
|
"bytes"
|
|
"fmt"
|
|
"time"
|
|
|
|
es_models "github.com/zitadel/zitadel/internal/eventstore/v1/models"
|
|
)
|
|
|
|
type WebAuthNToken struct {
|
|
es_models.ObjectRoot
|
|
|
|
WebAuthNTokenID string
|
|
CredentialCreationData []byte
|
|
State MFAState
|
|
Challenge string
|
|
AllowedCredentialIDs [][]byte
|
|
UserVerification UserVerificationRequirement
|
|
KeyID []byte
|
|
PublicKey []byte
|
|
AttestationType string
|
|
AAGUID []byte
|
|
SignCount uint32
|
|
WebAuthNTokenName string
|
|
RPID string
|
|
}
|
|
|
|
type WebAuthNLogin struct {
|
|
es_models.ObjectRoot
|
|
|
|
CredentialAssertionData []byte
|
|
Challenge string
|
|
AllowedCredentialIDs [][]byte
|
|
UserVerification UserVerificationRequirement
|
|
RPID string
|
|
}
|
|
|
|
type UserVerificationRequirement int32
|
|
|
|
const (
|
|
UserVerificationRequirementUnspecified UserVerificationRequirement = iota
|
|
UserVerificationRequirementRequired
|
|
UserVerificationRequirementPreferred
|
|
UserVerificationRequirementDiscouraged
|
|
)
|
|
|
|
type AuthenticatorAttachment int32
|
|
|
|
const (
|
|
AuthenticatorAttachmentUnspecified AuthenticatorAttachment = iota
|
|
AuthenticatorAttachmentPlattform
|
|
AuthenticatorAttachmentCrossPlattform
|
|
)
|
|
|
|
func GetTokenToVerify(tokens []*WebAuthNToken) (int, *WebAuthNToken) {
|
|
for i, u2f := range tokens {
|
|
if u2f.State == MFAStateNotReady {
|
|
return i, u2f
|
|
}
|
|
}
|
|
return -1, nil
|
|
}
|
|
|
|
func GetTokenByKeyID(tokens []*WebAuthNToken, keyID []byte) (int, *WebAuthNToken) {
|
|
for i, token := range tokens {
|
|
if bytes.Compare(token.KeyID, keyID) == 0 {
|
|
return i, token
|
|
}
|
|
}
|
|
return -1, nil
|
|
}
|
|
|
|
type PasswordlessInitCodeState int32
|
|
|
|
const (
|
|
PasswordlessInitCodeStateUnspecified PasswordlessInitCodeState = iota
|
|
PasswordlessInitCodeStateRequested
|
|
PasswordlessInitCodeStateActive
|
|
PasswordlessInitCodeStateRemoved
|
|
)
|
|
|
|
type PasswordlessInitCode struct {
|
|
es_models.ObjectRoot
|
|
|
|
CodeID string
|
|
Code string
|
|
Expiration time.Duration
|
|
State PasswordlessInitCodeState
|
|
}
|
|
|
|
func (p *PasswordlessInitCode) Link(baseURL string) string {
|
|
return PasswordlessInitCodeLink(baseURL, p.AggregateID, p.ResourceOwner, p.CodeID, p.Code)
|
|
}
|
|
|
|
func PasswordlessInitCodeLink(baseURL, userID, resourceOwner, codeID, code string) string {
|
|
return fmt.Sprintf("%s?userID=%s&orgID=%s&codeID=%s&code=%s", baseURL, userID, resourceOwner, codeID, code)
|
|
}
|