Securing a Web App with Passwordless Web Authentication

2 ©2019Yubico Learn how to implement passwordless authentication for a stand alone web app using: ● Starter Spring Boot web app with traditional username/password ● WebAuthn ○ Backend: Yubico WebAuthn Server Libraries ○ Frontend: JavaScript and W3C WebAuthn API ● Client to Authenticator Protocol Version 2.0 Compatible Browser ○ Resident Credentials enable passwordless authentication ● FIDO2 Security Key What to expect from this workshop

3 ©2019Yubico Some knowledge of: ● Java ● Spring Framework ● JavaScript ● WebAuthn API ○ Browser with resident credential capability ● Security Key ○ Download YubiKey Manager to reset FIDO credentials as needed ● Optional ○ Docker ○ Azure subscription for cloud native development You need

©2018Yubico Pros: ● Can’t be pickpocketed ● Can’t break ● Easy to replace Cons: ● Easy to steal remotely ● Hard to remember ● Theft is hard to detect Authentication Factors Pros: ● Can’t be stolen remotely ● Theft is easy to detect Cons: ● Can be pickpocketed ● Can be forgotten, lost or destroyed Pros: ● Natural to use ● Difficult to lose Cons: ● Difficult to replace ● May change over time ● Environmental dependencies

©2018Yubico Authentication Factors Pros: ● Can’t be pickpocketed ● Can’t break ● Easy to replace Cons: ● Easy to steal remotely ● Hard to remember ● Theft is hard to detect Pros: ● Can’t be stolen remotely ● Theft is easy to detect Cons: ● Can be pickpocketed ● Can be forgotten, lost or destroyed Pros: ● Natural to use ● Difficult to lose Cons: ● Difficult to replace ● May change over time ● Environmental dependencies

©2018Yubico©2016Yubico What is FIDO2 / WebAuthn? Open standards utilizing public-key cryptography with phishing protections to enable strong second-factor, first-factor, multi-factor authentication WebAuthn ServerAuthenticator Browser Client/Platform Platform Application CTAP WebAuthn FIDO2 Client to Authenticator Protocol W3C Web Authentication API

10 ©2019Yubico Security Keys as Root of Trust Anchoring FIDO2 / WebAuthn credentials in a root of trust is the cornerstone for building a secure identity model ● A hardware-backed root of trust strengthens the account lifecycle ○ Authentication, Step-Up Authentication, Account Recovery, Bootstrapping New Devices ● An external authenticator, as the root of trust, is the anchor that creates a chain of trust with the internal authenticator ○ Recording the authenticator used to register other authenticators creates a chain of trust that can be audited at a later date

12 ©2019Yubico This workshop is split into multiple modules. Each module builds upon the previous module as you expand the application. You must complete each module before proceeding to the next. 1. Getting Started Instructions 2. Implement a Credential Repository 3. Implement WebAuthn Registration REST Endpoints 4. Implement WebAuthn Authentication REST Endpoints 5. Clean Up Instructions Workshop Modules

50 ©2019Yubico Module 4 Overview 1. Expose Authentication REST Endpoints 1.1. Add start and finish authentication endpoints 1.2. Given successful WebAuthn authentication, manually authenticate user in Spring Security 2. Update UI to Enable Passwordless Authentication 2.1. Add JavaScript methods to call authentication REST endpoints 2.2. Add UI components to enable passwordless authentication

51 ©2019Yubico 4_Authentication/TLDR.md cd java-webauthn-passwordless-workshop/2_Registration/complete mvn clean package spring-boot:run or docker build -t example/demo:module4 . docker run -p 8443:8443 example/demo:module4 https://localhost:8443 Sign In: user / password, Register: Register security key, Sign out, Passwordless sign in

Authentication Flow Source: www.w3.org/TR/webauthn/#fig-authentication

53 ©2019Yubico challenge: contains challenge that the authenticator signs as part of the authentication assertion rpId: relying party identifier claimed by the caller allowCredentials: list of public key credentials acceptable to the caller, can be omitted for username-less authentication. type: only one type: “public-key”. id: credential Id of the public key credentials userVerification: the default is “preferred”. Can also be set to “required” or “discouraged” Public Key Credential Request Options

©2018Yubico Authentication Sequence First factor mode Client Relying Party id, rpId, challenge id, hash(rpId), s, clientData, userHandle Find user with id or userHandle Check id Check s using kpub Verify origin Verify challenge Authenticator signature(hash(rpId) || c, kpriv ) Validate rpId against origin hash(challenge, origin) clientData id, rpId, c Retrieve kpriv for rpId Sign c after User Presence/ Veriﬁcation id, hash(rpId), s, userHandle

55 ©2019Yubico Start Authentication Diagram username REST API Start Authentication Challenge Generator Assertion Request challenge username RelyingParty Start Assertion Credential Repository username Extensions PublicKeyCredentialRequestOptions Assertion Request Storage return AssertionRequest to client as JSON Get credentials by username

56 ©2019Yubico Client - Get Credential Response “authData”: ... “clientDataJSON”: ... “signature”: ... Authenticator Assertion Response RP ID Hash Flags Counter Extensions Authenticator Data ED AT: 0 UV UP: 1 “userHandle”: ...

57 ©2019Yubico Finish Authentication Diagram JSON response REST API Finish Authentication Successful Authentication Result Assertion Response Assertion Request Caller Token Binding Id RelyingParty Finish Assertion Credential RepositoryUpdate signature count Assertion Result Performs authentication validation steps Returned to client Get by id and invalidate Assertion Request Storage Credential Repository Get credentials by userHandle

58 ©2019Yubico Authentication Recap 1. Client calls startAuthentication() endpoint ○ With (or without) userName 2. Relying Party generates AssertionRequest ○ With userName, and PublicKeyCredentialRequestOptions 3. Client calls navigator.credentials.get() ○ With data from the AssertionRequest 4. Client calls finishAuthentication() endpoint ○ With authenticatorAssertionResponse JSONObject 5. Relying Party verifies signature ○ After validation, authentication is successful

59 ©2019Yubico Authentication REST Endpoints @PostMapping("/authenticate") public ResponseEntity<AssertionRequestWrapper> startAuthentication(@RequestParam("username") Optional<String> username) { Either<List<String>, AssertionRequestWrapper> result = webAuthnServer.startAuthentication(username); return ResponseEntity.status(HttpStatus.OK).body(result.right().get()); } @PostMapping("/authenticate/finish") public ResponseEntity<WebAuthnServer.SuccessfulAuthenticationResult> finishAuthentication( @RequestBody String responseJson) { Either<List<String>, WebAuthnServer.SuccessfulAuthenticationResult> result = webAuthnServer .finishAuthentication(responseJson); if (result.isRight()) { // Manually authenticate user ... WebAuthnController.java

60 ©2019Yubico Manually Authenticate if (result.isRight()) { // Manually authenticate user String username = result.right().get().getRegistrations().iterator().next().getUserIdentity().getName(); Authentication auth = SecurityContextHolder.getContext().getAuthentication(); UserDetails u = userDetailsService.loadUserByUsername(username); Authentication newAuth = new UsernamePasswordAuthenticationToken(u, auth.getCredentials(), u.getAuthorities()); SecurityContextHolder.getContext().setAuthentication(newAuth); return ResponseEntity.status(HttpStatus.OK).body(result.right().get()); } else { throw new ResponseStatusException(HttpStatus.BAD_REQUEST, result.left().get().toString()); } WebAuthnController.java

61 ©2019Yubico Call Authenticate Endpoints function authenticate() { return fetch('/authenticate', { ... }) .then(response => response.json()) .then(function (request) { return webauthn.getAssertion(request.publicKeyCredentialRequestOptions) .then(webauthn.responseToObject) .then(function (publicKeyCredential) { return submitResponse('/authenticate/finish', request.requestId, publicKeyCredential); }) ... } } login.html

62 ©2019Yubico Passwordless Sign In UI <h2 class="form-signin-heading">Passwordless sign in</h2> <p>Sign in with your previously registered security key</p> <p id="status"></p> <p><button onclick="authenticate()">Passwordless Sign in</button><br /> login.html

66 ©2019Yubico Best Practices ● Store the verbatim attestation object ○ Enables future re-evaluation of trust ● Allow registering more than one credential per account ○ Consider allowing credential nicknames ○ Unexpected behavior may occur when greater than 20 credentials registered ● Weigh pros vs cons of requiring attestation ○ Pros: ‒ Higher assurance ○ Cons: ‒ Maintenance for attestation trust store ‒ Compatibility issues for unknown/new authenticators (not in attestation trust store) ● Security and Privacy Considerations ○ W3C WebAuthn spec https://www.w3.org/TR/webauthn/#security-considerations

67 ©2019Yubico Recap ● Plan your passwordless migration strategy across the account lifecycle ● Anchor resident credentials on security keys to enable roaming passwordless authentication scenarios ● Record attestation and build a chain of trust ● Allow users to register multiple credentials ● WebAuthn libraries can jumpstart your journey to passwordless (eg. Yubico Java Webauthn Server libraries)

68 ©2019Yubico Resources ● Workshop ○ https://github.com/YubicoLabs/java-webauthn-passwordless-workshop ● FIDO2/WebAuthn Developer Guide ○ https://developers.yubico.com/FIDO2/FIDO2_WebAuthn_Developer_Guide/ ● Java WebAuthn Server ○ https://github.com/Yubico/java-webauthn-server ● Yubico Developer Videos ○ https://www.yubico.com/why-yubico/for-developers/developer-videos/ ● W3C Web Authentication API ○ https://www.w3.org/TR/webauthn ● FIDO Client to Authenticator Protocol V 2.0 ○ https://fidoalliance.org/specifications/download/

Securing a Web App with Passwordless Web Authentication

In this document

More Related Content

What's hot

Similar to Securing a Web App with Passwordless Web Authentication

More from FIDO Alliance

Recently uploaded

Securing a Web App with Passwordless Web Authentication