AuthenticationVerifier::verifyAuthenticatonAssertion()

Complexity

Conditions	11
Paths	9

Size

Total Lines	80
Code Lines	24

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	20
CRAP Score	11.968

Importance

Changes

0

<?php
    public function verifyAuthenticatonAssertion(PublicKeyCredentialInterface $credential, AuthenticationContext $context): AuthenticationResult
    {
        // SPEC 7.2 Verifying an authentication assertion

        $response = $credential->getResponse()->asAssertionResponse();
        $authData = new AuthenticatorData($response->getAuthenticatorData());
        $extensionContext = $this->processExtensions($credential, $authData, $context, ExtensionInterface::OPERATION_AUTHENTICATION);

        // 1. If the allowCredentials option was given when this authentication ceremony was initiated, verify that
        //    credential.id identifies one of the public key credentials that were listed in allowCredentials.
        if (!$this->checkAllowCredentials($credential, $context->getAllowCredentialIds())) {
            throw new VerificationException('Credential not in list of allowed credentials.');
        }

        // Note: step 2 done after 3 because credential is available then.
        // 3. Using credential’s id attribute (or the corresponding rawId, if base64url encoding is inappropriate for
        // your use case), look up the corresponding credential public key.
        $accountCredential = $this->credentialCollection->findCredential(CredentialId::fromBinary($credential->getRawId()->getBinaryString()));
        if ($accountCredential === null) {
            throw new VerificationException('Account was not found');
        }

        // 2. If credential.response.userHandle is present, verify that the user identified by this value is the owner
        //    of the public key credential identified by credential.id.
        if ($response->getUserHandle() !== null && !$response->getUserHandle()->equals($accountCredential->getUserHandle()->toBuffer())) {
            throw new VerificationException("Credential does not belong to the user identified by the client's userHandle.");
        }

        // 4. Let cData, aData and sig denote the value of credential’s response's clientDataJSON, authenticatorData,
        //    and signature respectively.
        // 5. Let JSONtext be the result of running UTF-8 decode on the value of cData.
        // 6. Let C, the client data claimed as used for the signature, be the result of running an
        //    implementation-specific JSON parser on JSONtext.
        // 7 - 10
        $clientData = $response->getParsedClientData();
        $this->checkClientData($clientData, $context);

        // 11. Verify that the rpIdHash in aData is the SHA-256 hash of the RP ID expected by the Relying Party.
        if (!$this->verifyRpIdHash($authData, $context, $extensionContext)) {
            throw new VerificationException('rpIdHash was not correct.');
        }

        // 12 and 13
        if (!$this->verifyUser($authData, $context)) {
            throw new VerificationException('User verification failed');
        }

        // 14. Verify that the values of the client extension outputs in clientExtensionResults and the authenticator
        //     extension outputs in the extensions in authData are as expected, considering the client extension input
        //     values that were given as the extensions option in the get() call. In particular, any extension
        //     identifier values in the clientExtensionResults and the extensions in authData MUST be also be present
        //     as extension identifier values in the extensions member of options, i.e., no extensions are present that
        //     were not requested. In the general case, the meaning of "are as expected" is specific to the Relying
        //     Party and which extensions are in use.
        //     Note: Since all extensions are OPTIONAL for both the client and the authenticator, the Relying Party MUST
        //     be prepared to handle cases where none or not all of the requested extensions were acted upon.

        // -> This is already checked in processExtensions above, the extensions need to be processed earlier because
        // extensions such as appid affect the effective rpId

        // 15 and 16
        if (!$this->verifySignature($response, $accountCredential->getPublicKey())) {
            throw new VerificationException('Invalid signature');
        }

        // 17 and 18
        if (!$this->verifySignatureCounter($authData, $accountCredential)) {
            throw new VerificationException('Signature counter invalid');
        }

        // If all the above steps are successful, continue with the authentication ceremony as appropriate. Otherwise, fail the authentication ceremony.

        // Additional custom checks:
        // Ensure credential belongs to user being authenticated
        $userHandle = $context->getUserHandle();
        if ($userHandle !== null && !$userHandle->equals($accountCredential->getUserHandle())) {
            throw new VerificationException('Credential does not belong to the user currently being authenticated.');
        }

        return new AuthenticationResult($accountCredential, $authData);
    }