0

I'm using Identity Server 4 to authenticate users with WebAuthN (https://w3c.github.io/webauthn/).

I have multiple clients that that hit an api client. My api client is responsible for deciding which auth provider to use, passing data (server to server, server to external api) and orchestrating the auth process.

One auth provider we are using that we own is identity server 4 and this is where we are implementing WebAuthN.

I'm not sure which is the recommended way to implement this in Identity Server 4. I'm down to 2 options

  1. Create an API endpoint on identity server to authenticate to users credential
  2. Create an extension grant type and call the TokenEndpoint API using the new grant type (my extension grant type would be a mix of the built in Hybrid grant type followed by the WebAuthN code).

Are both ways valid from a security standpoint (not opening up a hole) and fit with ID4 or is there another way?

1 Answer 1

1

I've recently done some work on implementing this, but for second-factor only at this point.

Long story short, it needs to run in the context of the end user's browser (given that it's a JavaScript API) so really it needs to be built into the sign in flow via the authorize endpoint.

For example (assuming no local client or IDP sessions already exist):

  1. User visits client application
  2. Client redirects to authorize endpoint
  3. Authorize endpoint redirects to interactive authentication UI which then decides what method to use
  4. Do the WebAuthn challenge, validate the result and establish a session cookie
  5. Redirect back to authorize endpoint
  6. Issue tokens and redirect back to client

You'll also need to provide a way for users to register their authenticators. The resulting credentials are tied to the site origin so this must be done within your identityserver4 implementation - the same application that will be doing the challenging.

2
  • Thanks, sounds good. One question, with step 4, where should this be handled? client app? identity?
    – garethb
    Oct 22, 2019 at 2:22
  • 1
    Step 4 would be handled in Identity as part of the interactive browser-based sign in flow. Check out the github.com/abergs/fido2-net-lib sample web app, it should give you a good idea of how it fits together.
    – mackie
    Oct 22, 2019 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.