@@ -117,7 +117,7 @@ |
||
| 117 | 117 | } |
| 118 | 118 | |
| 119 | 119 | if (!is_array($config)) { |
| 120 | - throw new \Exception('Invalid configuration for consent store option: '.var_export($config, true)); |
|
| 120 | + throw new \Exception('Invalid configuration for consent store option: ' . var_export($config, true)); |
|
| 121 | 121 | } |
| 122 | 122 | |
| 123 | 123 | if (!array_key_exists(0, $config)) { |
@@ -20,18 +20,18 @@ |
||
| 20 | 20 | throw new Exception("Attempt to access the token management page unauthenticated."); |
| 21 | 21 | } |
| 22 | 22 | switch ($_POST['submit']) { |
| 23 | - case "NEVERMIND": |
|
| 24 | - \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
| 25 | - break; |
|
| 26 | - case "DELETE": |
|
| 27 | - if ($state['FIDO2AuthSuccessful'] == $_POST['credId']) { |
|
| 28 | - throw new Exception("Attempt to delete the currently used credential despite UI preventing this."); |
|
| 29 | - } |
|
| 30 | - $store = $state['webauthn:store']; |
|
| 31 | - $store->deleteTokenData($_POST['credId']); |
|
| 32 | - \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
| 33 | - break; |
|
| 34 | - default: |
|
| 35 | - throw new Exception("Unknown submit button state."); |
|
| 23 | + case "NEVERMIND": |
|
| 24 | + \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
| 25 | + break; |
|
| 26 | + case "DELETE": |
|
| 27 | + if ($state['FIDO2AuthSuccessful'] == $_POST['credId']) { |
|
| 28 | + throw new Exception("Attempt to delete the currently used credential despite UI preventing this."); |
|
| 29 | + } |
|
| 30 | + $store = $state['webauthn:store']; |
|
| 31 | + $store->deleteTokenData($_POST['credId']); |
|
| 32 | + \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
| 33 | + break; |
|
| 34 | + default: |
|
| 35 | + throw new Exception("Unknown submit button state."); |
|
| 36 | 36 | } |
| 37 | 37 | |
@@ -106,13 +106,13 @@ |
||
| 106 | 106 | }, |
| 107 | 107 | pubKeyCredParams: [{alg: -7, type: 'public-key'}], |
| 108 | 108 | timeout: 60000, |
| 109 | - attestation: '".($state['requestTokenModel'] ? "indirect" : "none")."', |
|
| 109 | + attestation: '".($state['requestTokenModel'] ? "indirect" : "none") . "', |
|
| 110 | 110 | } |
| 111 | 111 | };"; |
| 112 | 112 | } |
| 113 | 113 | |
| 114 | 114 | $t->data['authForm'] = ""; |
| 115 | -if (count($state['FIDO2Tokens']) > 0 && ($state['FIDO2WantsRegister'] !== true || $state['FIDO2AuthSuccessful'] === false )) { |
|
| 115 | +if (count($state['FIDO2Tokens']) > 0 && ($state['FIDO2WantsRegister'] !== true || $state['FIDO2AuthSuccessful'] === false)) { |
|
| 116 | 116 | $t->data['authURL'] = \SimpleSAML\Module::getModuleURL('webauthn/authprocess.php?StateId=' . urlencode($id)); |
| 117 | 117 | $t->data['authForm'] = "navigator.credentials.get(publicKeyCredentialRequestOptions) |
| 118 | 118 | .then((cred) => { |
@@ -71,10 +71,10 @@ |
||
| 71 | 71 | if ($debugEnabled) { |
| 72 | 72 | echo $authObject->debugBuffer; |
| 73 | 73 | echo $authObject->validateBuffer; |
| 74 | - echo "Debug mode, not continuing to ". ($state['FIDO2WantsRegister'] ? "credential registration page." : "destination."); |
|
| 74 | + echo "Debug mode, not continuing to " . ($state['FIDO2WantsRegister'] ? "credential registration page." : "destination."); |
|
| 75 | 75 | } else { |
| 76 | 76 | if ($state['FIDO2WantsRegister']) { |
| 77 | - header("Location: ".\SimpleSAML\Module::getModuleURL('webauthn/webauthn.php?StateId=' . urlencode($id))); |
|
| 77 | + header("Location: " . \SimpleSAML\Module::getModuleURL('webauthn/webauthn.php?StateId=' . urlencode($id))); |
|
| 78 | 78 | } else { |
| 79 | 79 | \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
| 80 | 80 | } |
@@ -68,15 +68,15 @@ |
||
| 68 | 68 | */ |
| 69 | 69 | $sigcheck = openssl_verify($sigData, $signature, $keyResource, OPENSSL_ALGO_SHA256); |
| 70 | 70 | switch ($sigcheck) { |
| 71 | - case 1: |
|
| 72 | - $this->pass("Signature validation succeeded!"); |
|
| 73 | - break; |
|
| 74 | - case 0: |
|
| 75 | - $this->fail("Signature validation failed (sigdata = $sigData) (signature = $signature) !"); |
|
| 76 | - break; |
|
| 77 | - default: |
|
| 78 | - $this->fail("There was an error executing the signature check."); |
|
| 79 | - break; |
|
| 71 | + case 1: |
|
| 72 | + $this->pass("Signature validation succeeded!"); |
|
| 73 | + break; |
|
| 74 | + case 0: |
|
| 75 | + $this->fail("Signature validation failed (sigdata = $sigData) (signature = $signature) !"); |
|
| 76 | + break; |
|
| 77 | + default: |
|
| 78 | + $this->fail("There was an error executing the signature check."); |
|
| 79 | + break; |
|
| 80 | 80 | } |
| 81 | 81 | } |
| 82 | 82 | } |
@@ -170,16 +170,16 @@ |
||
| 170 | 170 | */ |
| 171 | 171 | $certProps = openssl_x509_parse($this->der2pem($stmtDecoded['x5c'][0])); |
| 172 | 172 | $this->debugBuffer .= "Attestation Certificate:" . print_r($certProps, true) . "<br/>"; |
| 173 | - if ($certProps['version'] != 2 || /** §8.2.1 Bullet 1 */ |
|
| 174 | - $certProps['subject']['OU'] != "Authenticator Attestation" || /** §8.2.1 Bullet 2 [Subject-OU] */ |
|
| 175 | - !isset($certProps['subject']['CN']) || /** §8.2.1 Bullet 2 [Subject-CN] */ |
|
| 173 | + if ($certProps['version'] != 2 || /** §8.2.1 Bullet 1 */ |
|
| 174 | + $certProps['subject']['OU'] != "Authenticator Attestation" || /** §8.2.1 Bullet 2 [Subject-OU] */ |
|
| 175 | + !isset($certProps['subject']['CN']) || /** §8.2.1 Bullet 2 [Subject-CN] */ |
|
| 176 | 176 | !isset($certProps['extensions']['basicConstraints']) || |
| 177 | 177 | strstr("CA:FALSE", $certProps['extensions']['basicConstraints']) === false /** §8.2.1 Bullet 4 */ |
| 178 | 178 | ) { |
| 179 | 179 | $this->fail("Attestation certificate properties are no good."); |
| 180 | 180 | } |
| 181 | 181 | if (isset(AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)])) { |
| 182 | - if ($certProps['subject']['O'] != AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)]['O'] || /** §8.2.1 Bullet 2 [Subject-O] */ |
|
| 182 | + if ($certProps['subject']['O'] != AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)]['O'] || /** §8.2.1 Bullet 2 [Subject-O] */ |
|
| 183 | 183 | $certProps['subject']['C'] != AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)]['C']) { /** §8.2.1 Bullet 2 [Subject-C] */ |
| 184 | 184 | $this->fail("AAGUID does not match vendor data."); |
| 185 | 185 | } |
@@ -86,9 +86,9 @@ |
||
| 86 | 86 | 'O' => 'Feitian Technologies', |
| 87 | 87 | 'model' => 'Feitian ePass FIDO2-NFC Authenticator', |
| 88 | 88 | 'RootPEMs' => [ |
| 89 | - 0 => 'MIIB2DCCAX6gAwIBAgIQGBUrQbdDrm20FZnDsX2CBTAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsFYEEhiJuqqnMgQjSiivBjV7DGCTf4XBBH/B7uvZsKxXShF0L8uDISWUvcExixRs6gB3oldSrjox6L8T94NOzqNCMEAwHQYDVR0OBBYEFEu9hyYRrRyJzwRYvnDSCIxrFiO3MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIDHSb2mbNDAUNXvpPU0oWKeNye0fQ2l9D01AR2+sLZdhAiEAo3wz684IFMVsCCRmuJqxH6FQRESNqezuo1E+KkGxWuM=', |
|
| 90 | - 1 => 'MIIB2DCCAX6gAwIBAgIQFZ97ws2JGPEoa5NI+p8z1jAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnfAKbjvMX1Ey1b6k+WQQdNVMt9JgGWyJ3PvM4BSK5XqTfo++0oAj/4tnwyIL0HFBR9St+ktjqSXDfjiXAurs86NCMEAwHQYDVR0OBBYEFNGhmE2Bf8O5a/YHZ71QEv6QRfFUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQC3sT1lBjGeF+xKTpzV1KYU2ckahTd4mLJyzYOhaHv4igIgD2JYkfyH5Q4Bpo8rroO0It7oYjF2kgy/eSZ3U9Glaqw=', |
|
| 91 | - 2 => 'MIIBfjCCASWgAwIBAgIBATAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxGVCBGSURPIDAyMDAwIBcNMTYwNTAxMDAwMDAwWhgPMjA1MDA1MDEwMDAwMDBaMBcxFTATBgNVBAMMDEZUIEZJRE8gMDIwMDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNBmrRqVOxztTJVN19vtdqcL7tKQeol2nnM2/yYgvksZnr50SKbVgIEkzHQVOu80LVEE3lVheO1HjggxAlT6o4WjYDBeMB0GA1UdDgQWBBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAfBgNVHSMEGDAWgBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAMBgNVHRMEBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNHADBEAiAwfPqgIWIUB+QBBaVGsdHy0s5RMxlkzpSX/zSyTZmUpQIgB2wJ6nZRM8oX/nA43Rh6SJovM2XwCCH//+LirBAbB0M=', |
|
| 89 | + 0 => 'MIIB2DCCAX6gAwIBAgIQGBUrQbdDrm20FZnDsX2CBTAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsFYEEhiJuqqnMgQjSiivBjV7DGCTf4XBBH/B7uvZsKxXShF0L8uDISWUvcExixRs6gB3oldSrjox6L8T94NOzqNCMEAwHQYDVR0OBBYEFEu9hyYRrRyJzwRYvnDSCIxrFiO3MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIDHSb2mbNDAUNXvpPU0oWKeNye0fQ2l9D01AR2+sLZdhAiEAo3wz684IFMVsCCRmuJqxH6FQRESNqezuo1E+KkGxWuM=', |
|
| 90 | + 1 => 'MIIB2DCCAX6gAwIBAgIQFZ97ws2JGPEoa5NI+p8z1jAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnfAKbjvMX1Ey1b6k+WQQdNVMt9JgGWyJ3PvM4BSK5XqTfo++0oAj/4tnwyIL0HFBR9St+ktjqSXDfjiXAurs86NCMEAwHQYDVR0OBBYEFNGhmE2Bf8O5a/YHZ71QEv6QRfFUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQC3sT1lBjGeF+xKTpzV1KYU2ckahTd4mLJyzYOhaHv4igIgD2JYkfyH5Q4Bpo8rroO0It7oYjF2kgy/eSZ3U9Glaqw=', |
|
| 91 | + 2 => 'MIIBfjCCASWgAwIBAgIBATAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxGVCBGSURPIDAyMDAwIBcNMTYwNTAxMDAwMDAwWhgPMjA1MDA1MDEwMDAwMDBaMBcxFTATBgNVBAMMDEZUIEZJRE8gMDIwMDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNBmrRqVOxztTJVN19vtdqcL7tKQeol2nnM2/yYgvksZnr50SKbVgIEkzHQVOu80LVEE3lVheO1HjggxAlT6o4WjYDBeMB0GA1UdDgQWBBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAfBgNVHSMEGDAWgBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAMBgNVHRMEBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNHADBEAiAwfPqgIWIUB+QBBaVGsdHy0s5RMxlkzpSX/zSyTZmUpQIgB2wJ6nZRM8oX/nA43Rh6SJovM2XwCCH//+LirBAbB0M=', |
|
| 92 | 92 | ], |
| 93 | 93 | 'multi' => null, |
| 94 | 94 | ], |