@@ -117,7 +117,7 @@ |
||
117 | 117 | } |
118 | 118 | |
119 | 119 | if (!is_array($config)) { |
120 | - throw new \Exception('Invalid configuration for consent store option: '.var_export($config, true)); |
|
120 | + throw new \Exception('Invalid configuration for consent store option: ' . var_export($config, true)); |
|
121 | 121 | } |
122 | 122 | |
123 | 123 | if (!array_key_exists(0, $config)) { |
@@ -20,18 +20,18 @@ |
||
20 | 20 | throw new Exception("Attempt to access the token management page unauthenticated."); |
21 | 21 | } |
22 | 22 | switch ($_POST['submit']) { |
23 | - case "NEVERMIND": |
|
24 | - \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
25 | - break; |
|
26 | - case "DELETE": |
|
27 | - if ($state['FIDO2AuthSuccessful'] == $_POST['credId']) { |
|
28 | - throw new Exception("Attempt to delete the currently used credential despite UI preventing this."); |
|
29 | - } |
|
30 | - $store = $state['webauthn:store']; |
|
31 | - $store->deleteTokenData($_POST['credId']); |
|
32 | - \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
33 | - break; |
|
34 | - default: |
|
35 | - throw new Exception("Unknown submit button state."); |
|
23 | + case "NEVERMIND": |
|
24 | + \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
25 | + break; |
|
26 | + case "DELETE": |
|
27 | + if ($state['FIDO2AuthSuccessful'] == $_POST['credId']) { |
|
28 | + throw new Exception("Attempt to delete the currently used credential despite UI preventing this."); |
|
29 | + } |
|
30 | + $store = $state['webauthn:store']; |
|
31 | + $store->deleteTokenData($_POST['credId']); |
|
32 | + \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
|
33 | + break; |
|
34 | + default: |
|
35 | + throw new Exception("Unknown submit button state."); |
|
36 | 36 | } |
37 | 37 |
@@ -106,13 +106,13 @@ |
||
106 | 106 | }, |
107 | 107 | pubKeyCredParams: [{alg: -7, type: 'public-key'}], |
108 | 108 | timeout: 60000, |
109 | - attestation: '".($state['requestTokenModel'] ? "indirect" : "none")."', |
|
109 | + attestation: '".($state['requestTokenModel'] ? "indirect" : "none") . "', |
|
110 | 110 | } |
111 | 111 | };"; |
112 | 112 | } |
113 | 113 | |
114 | 114 | $t->data['authForm'] = ""; |
115 | -if (count($state['FIDO2Tokens']) > 0 && ($state['FIDO2WantsRegister'] !== true || $state['FIDO2AuthSuccessful'] === false )) { |
|
115 | +if (count($state['FIDO2Tokens']) > 0 && ($state['FIDO2WantsRegister'] !== true || $state['FIDO2AuthSuccessful'] === false)) { |
|
116 | 116 | $t->data['authURL'] = \SimpleSAML\Module::getModuleURL('webauthn/authprocess.php?StateId=' . urlencode($id)); |
117 | 117 | $t->data['authForm'] = "navigator.credentials.get(publicKeyCredentialRequestOptions) |
118 | 118 | .then((cred) => { |
@@ -71,10 +71,10 @@ |
||
71 | 71 | if ($debugEnabled) { |
72 | 72 | echo $authObject->debugBuffer; |
73 | 73 | echo $authObject->validateBuffer; |
74 | - echo "Debug mode, not continuing to ". ($state['FIDO2WantsRegister'] ? "credential registration page." : "destination."); |
|
74 | + echo "Debug mode, not continuing to " . ($state['FIDO2WantsRegister'] ? "credential registration page." : "destination."); |
|
75 | 75 | } else { |
76 | 76 | if ($state['FIDO2WantsRegister']) { |
77 | - header("Location: ".\SimpleSAML\Module::getModuleURL('webauthn/webauthn.php?StateId=' . urlencode($id))); |
|
77 | + header("Location: " . \SimpleSAML\Module::getModuleURL('webauthn/webauthn.php?StateId=' . urlencode($id))); |
|
78 | 78 | } else { |
79 | 79 | \SimpleSAML\Auth\ProcessingChain::resumeProcessing($state); |
80 | 80 | } |
@@ -68,15 +68,15 @@ |
||
68 | 68 | */ |
69 | 69 | $sigcheck = openssl_verify($sigData, $signature, $keyResource, OPENSSL_ALGO_SHA256); |
70 | 70 | switch ($sigcheck) { |
71 | - case 1: |
|
72 | - $this->pass("Signature validation succeeded!"); |
|
73 | - break; |
|
74 | - case 0: |
|
75 | - $this->fail("Signature validation failed (sigdata = $sigData) (signature = $signature) !"); |
|
76 | - break; |
|
77 | - default: |
|
78 | - $this->fail("There was an error executing the signature check."); |
|
79 | - break; |
|
71 | + case 1: |
|
72 | + $this->pass("Signature validation succeeded!"); |
|
73 | + break; |
|
74 | + case 0: |
|
75 | + $this->fail("Signature validation failed (sigdata = $sigData) (signature = $signature) !"); |
|
76 | + break; |
|
77 | + default: |
|
78 | + $this->fail("There was an error executing the signature check."); |
|
79 | + break; |
|
80 | 80 | } |
81 | 81 | } |
82 | 82 | } |
@@ -170,16 +170,16 @@ |
||
170 | 170 | */ |
171 | 171 | $certProps = openssl_x509_parse($this->der2pem($stmtDecoded['x5c'][0])); |
172 | 172 | $this->debugBuffer .= "Attestation Certificate:" . print_r($certProps, true) . "<br/>"; |
173 | - if ($certProps['version'] != 2 || /** §8.2.1 Bullet 1 */ |
|
174 | - $certProps['subject']['OU'] != "Authenticator Attestation" || /** §8.2.1 Bullet 2 [Subject-OU] */ |
|
175 | - !isset($certProps['subject']['CN']) || /** §8.2.1 Bullet 2 [Subject-CN] */ |
|
173 | + if ($certProps['version'] != 2 || /** §8.2.1 Bullet 1 */ |
|
174 | + $certProps['subject']['OU'] != "Authenticator Attestation" || /** §8.2.1 Bullet 2 [Subject-OU] */ |
|
175 | + !isset($certProps['subject']['CN']) || /** §8.2.1 Bullet 2 [Subject-CN] */ |
|
176 | 176 | !isset($certProps['extensions']['basicConstraints']) || |
177 | 177 | strstr("CA:FALSE", $certProps['extensions']['basicConstraints']) === false /** §8.2.1 Bullet 4 */ |
178 | 178 | ) { |
179 | 179 | $this->fail("Attestation certificate properties are no good."); |
180 | 180 | } |
181 | 181 | if (isset(AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)])) { |
182 | - if ($certProps['subject']['O'] != AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)]['O'] || /** §8.2.1 Bullet 2 [Subject-O] */ |
|
182 | + if ($certProps['subject']['O'] != AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)]['O'] || /** §8.2.1 Bullet 2 [Subject-O] */ |
|
183 | 183 | $certProps['subject']['C'] != AAGUID::AAGUID_DICTIONARY[strtolower($this->AAGUID)]['C']) { /** §8.2.1 Bullet 2 [Subject-C] */ |
184 | 184 | $this->fail("AAGUID does not match vendor data."); |
185 | 185 | } |
@@ -86,9 +86,9 @@ |
||
86 | 86 | 'O' => 'Feitian Technologies', |
87 | 87 | 'model' => 'Feitian ePass FIDO2-NFC Authenticator', |
88 | 88 | 'RootPEMs' => [ |
89 | - 0 => 'MIIB2DCCAX6gAwIBAgIQGBUrQbdDrm20FZnDsX2CBTAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsFYEEhiJuqqnMgQjSiivBjV7DGCTf4XBBH/B7uvZsKxXShF0L8uDISWUvcExixRs6gB3oldSrjox6L8T94NOzqNCMEAwHQYDVR0OBBYEFEu9hyYRrRyJzwRYvnDSCIxrFiO3MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIDHSb2mbNDAUNXvpPU0oWKeNye0fQ2l9D01AR2+sLZdhAiEAo3wz684IFMVsCCRmuJqxH6FQRESNqezuo1E+KkGxWuM=', |
|
90 | - 1 => 'MIIB2DCCAX6gAwIBAgIQFZ97ws2JGPEoa5NI+p8z1jAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnfAKbjvMX1Ey1b6k+WQQdNVMt9JgGWyJ3PvM4BSK5XqTfo++0oAj/4tnwyIL0HFBR9St+ktjqSXDfjiXAurs86NCMEAwHQYDVR0OBBYEFNGhmE2Bf8O5a/YHZ71QEv6QRfFUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQC3sT1lBjGeF+xKTpzV1KYU2ckahTd4mLJyzYOhaHv4igIgD2JYkfyH5Q4Bpo8rroO0It7oYjF2kgy/eSZ3U9Glaqw=', |
|
91 | - 2 => 'MIIBfjCCASWgAwIBAgIBATAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxGVCBGSURPIDAyMDAwIBcNMTYwNTAxMDAwMDAwWhgPMjA1MDA1MDEwMDAwMDBaMBcxFTATBgNVBAMMDEZUIEZJRE8gMDIwMDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNBmrRqVOxztTJVN19vtdqcL7tKQeol2nnM2/yYgvksZnr50SKbVgIEkzHQVOu80LVEE3lVheO1HjggxAlT6o4WjYDBeMB0GA1UdDgQWBBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAfBgNVHSMEGDAWgBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAMBgNVHRMEBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNHADBEAiAwfPqgIWIUB+QBBaVGsdHy0s5RMxlkzpSX/zSyTZmUpQIgB2wJ6nZRM8oX/nA43Rh6SJovM2XwCCH//+LirBAbB0M=', |
|
89 | + 0 => 'MIIB2DCCAX6gAwIBAgIQGBUrQbdDrm20FZnDsX2CBTAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsFYEEhiJuqqnMgQjSiivBjV7DGCTf4XBBH/B7uvZsKxXShF0L8uDISWUvcExixRs6gB3oldSrjox6L8T94NOzqNCMEAwHQYDVR0OBBYEFEu9hyYRrRyJzwRYvnDSCIxrFiO3MA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIDHSb2mbNDAUNXvpPU0oWKeNye0fQ2l9D01AR2+sLZdhAiEAo3wz684IFMVsCCRmuJqxH6FQRESNqezuo1E+KkGxWuM=', |
|
90 | + 1 => 'MIIB2DCCAX6gAwIBAgIQFZ97ws2JGPEoa5NI+p8z1jAKBggqhkjOPQQDAjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMCAXDTE4MDQwMTAwMDAwMFoYDzIwNDgwMzMxMjM1OTU5WjBLMQswCQYDVQQGEwJDTjEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxHTAbBgNVBAMMFEZlaXRpYW4gRklETyBSb290IENBMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEnfAKbjvMX1Ey1b6k+WQQdNVMt9JgGWyJ3PvM4BSK5XqTfo++0oAj/4tnwyIL0HFBR9St+ktjqSXDfjiXAurs86NCMEAwHQYDVR0OBBYEFNGhmE2Bf8O5a/YHZ71QEv6QRfFUMA8GA1UdEwEB/wQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCIQC3sT1lBjGeF+xKTpzV1KYU2ckahTd4mLJyzYOhaHv4igIgD2JYkfyH5Q4Bpo8rroO0It7oYjF2kgy/eSZ3U9Glaqw=', |
|
91 | + 2 => 'MIIBfjCCASWgAwIBAgIBATAKBggqhkjOPQQDAjAXMRUwEwYDVQQDDAxGVCBGSURPIDAyMDAwIBcNMTYwNTAxMDAwMDAwWhgPMjA1MDA1MDEwMDAwMDBaMBcxFTATBgNVBAMMDEZUIEZJRE8gMDIwMDBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABNBmrRqVOxztTJVN19vtdqcL7tKQeol2nnM2/yYgvksZnr50SKbVgIEkzHQVOu80LVEE3lVheO1HjggxAlT6o4WjYDBeMB0GA1UdDgQWBBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAfBgNVHSMEGDAWgBRJFWQt1bvG3jM6XgmV/IcjNtO/CzAMBgNVHRMEBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAKBggqhkjOPQQDAgNHADBEAiAwfPqgIWIUB+QBBaVGsdHy0s5RMxlkzpSX/zSyTZmUpQIgB2wJ6nZRM8oX/nA43Rh6SJovM2XwCCH//+LirBAbB0M=', |
|
92 | 92 | ], |
93 | 93 | 'multi' => null, |
94 | 94 | ], |