Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Allow callers to explicitly specify RP ID #198

Merged
merged 10 commits into from
Sep 28, 2016
Merged

Allow callers to explicitly specify RP ID #198

Changes from 3 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
6a2458e
Merge remote-tracking branch 'refs/remotes/origin/master' into vgb-ex…
vijaybh Sep 13, 2016
6651690
Merge branch 'master' into vgb-explicit-rpid
vijaybh Sep 13, 2016
443482e
Allow caller to explicitly specify its claimed RP ID
vijaybh Sep 14, 2016
a9c6b38
Remove rpId from ClientData
vijaybh Sep 16, 2016
7cbf57a
Merge remote-tracking branch 'refs/remotes/origin/master' into vgb-ex…
vijaybh Sep 16, 2016
7943865
Incorporate feedback from @equalsJeffH
vijaybh Sep 16, 2016
782a6d5
Merge from master
vijaybh Sep 20, 2016
a79f880
Merge branch 'master' into vgb-explicit-rpid
vijaybh Sep 20, 2016
f44ba9e
More feedback from @equalsJeffH
vijaybh Sep 23, 2016
f03e4e5
Incorporate feedback from @equalsJeffH
vijaybh Sep 28, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 26 additions & 15 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,8 +130,8 @@ or a combination of both.

This specification relies on several other underlying specifications.

: HTML5
:: The concept of <dfn for='web'>origin</dfn> and the <dfn>Navigator</dfn> interface are defined in [[!HTML5]].
: HTML 5.1
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would s/HTML 5.1/HTML/ here since the citation in the next line is clearly to HTML51.

:: The concept of <dfn for='web'>origin</dfn> and the <dfn>Navigator</dfn> interface are defined in [[!HTML51-20160621]].

: Web IDL
:: Many of the interface definitions and all of the IDL in this specification depend on [[!WebIDL-1]]. This updated version of
Expand Down Expand Up @@ -204,10 +204,6 @@ NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and
:: A user agent implementing, in conjunction with the underlying platform, the <a>Web Authentication API</a> and algorithms
given in this specification, and handling communication between <a>Authenticators</a> and <a>[RPS]</a>.

: <dfn>eTLD+1</dfn>
:: Also known as a <em>Registered Domain</em> [[PSL]], an eTLD+1 is an <em>effective Top-Level Domain Name</em> (eTLD), plus the
next domain name label, proceeding from right to left. An eTLD is also known as a <em>public suffix</em> [[RFC7719]].

: <dfn>Registration</dfn>
:: The <a>ceremony</a> where a user, a <a>[RP]</a>, and the user's computing device(s) (containing at least one
<a>authenticator</a>) work in concert to create a <a>scoped credential</a> and associate it with the user's <a>[RP]</a>
Expand All @@ -222,7 +218,8 @@ NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and

: <dfn>Relying Party Identifier</dfn>
: <dfn>RP ID</dfn>
:: A Relying Party Identifier is derived from a <a>[RP]</a>'s web origin's hostname by computing the hostname's <a>eTLD+1</a>.
:: A Relying Party Identifier defines the scope of a given credential, i.e. the set of web origins that the client will permit
Copy link
Contributor

@equalsJeffH equalsJeffH Sep 16, 2016 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/web origins/origins/

to access that credential. It is derived from a <a>[RP]</a>'s web origin's hostname or directly specified by the [RP].
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

s/access/wield/

suggest revise last sentence to be:

It a [RP]'s origin's |host| component, or is explicitly specified by the [RP] to be either its origin's |host| component or the |host| component with subdomains removed such that it continues to pass the checks in relaxing the same-origin restriction algorithm. See step 3 of both {{#makeCredential}} and {{#getAssertion}}.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I rewrote the definition - let me know if this is better.


: <dfn>Scoped Credential</dfn>
:: Generically, a credential is data one entity presents to another in order to authenticate the former's identity [[RFC4949]].
Expand Down Expand Up @@ -345,10 +342,13 @@ When this method is invoked, the user agent MUST execute the following algorithm
2. Let |promise| be a new <a data-lt="Promises">Promise</a>. Return |promise| and start a timer for |adjustedTimeout| seconds.
Then asynchronously continue executing the following steps.

3. Set |callerOrigin| to the <a link-for='web'>origin</a> of the caller. Derive the RP ID from |callerOrigin| by computing the
"public suffix + 1" or "PS+1" (which is also referred to as the "Effective Top-Level Domain plus One" or "<a>eTLD+1</a>")
part of |callerOrigin| [[PSL]]. Let |rpId| be the lowercase form of this RP ID. Set |rpIdHash| to the SHA-256 hash of the
UTF-8 encoding of |rpId|.
3. Set |callerOrigin| to the <a link-for='web'>origin</a> of the caller. If {{CredentialOptions/rpId}} is not specified, then
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fyi, the fix I'm working on for #171 & #172 alters the first sentence, but not the remainder of this step, i.e., it ought to mesh ok (I hope).

set |rpId| to the Unicode serialization of |callerOrigin| as specified in [[!HTML51-20160621]] section 6.4. If
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I do not think we want/need to invoke the unicode serialization here. The |rpId| will already be in asciiDomain format and we shouldn't alter. Anne confirmed in the comments on #178 that origin.host and origin.domain are asciiDomains, by default, if non-null.

{{CredentialOptions/rpId}} is specified, then check if its value would be an acceptable setting for the current document's
`domain` by running the algorithm in [[!HTML51-20160621]] section 6.4.1 (but do not change the current document's `domain`).
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fyi/fwiw, the linking style used in PR #202 allows direct linking to things like that algorithm such that we do not need to mention section #s. also, i suggest citing HTML51 as simply [[!HTML51]].

If it is not permissible, reject |promise| with a <a>DOMException</a> whose name is "SecurityError", and terminate this
algorithm. If it is permissible, then set |rpId| to the Unicode serialization of {{CredentialOptions/rpId}}. Set |rpIdHash|
to the SHA-256 hash of the UTF-8 encoding of |rpId|.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we want to write the above set of lines more like so:

If {{CredentialOptions/rpId}} is specified, then invoke the relaxing the same-origin restriction "setting" algorithm using {{CredentialOptions/rpId}} as the given value without setting origin's |domain|. If no errors are thrown, then set |rpId| to the value of |host| as yielded by the algorithm. Set |rpIdHash| to the SHA-256 hash of |rpId|.

given that the internal default representation of origin.host and origin.domain is asciiDomain ( U-labels have been converted to A-labels (see https://tools.ietf.org/html/rfc5890#section-2.3.2 and foregoing figure 1 on pg 10 ) ) format, we should not be stipulating UTF-8 encoding of them, AFAICT.

The jeffh-origin-et-al branch will soon have the <pre class="anchors"> anchors set up to properly ref these things in HTML51 and so once both branches are eventually merged we should be good.


4. Process each element of <a>cryptoParameters</a> using the following steps, to produce a new sequence `normalizedParameters`:
- Let |current| be the currently selected element of <a>cryptoParameters</a>.
Expand Down Expand Up @@ -421,10 +421,13 @@ When this method is invoked, the user agent MUST execute the following algorithm
2. Let |promise| be a new <a data-lt="Promises">Promise</a>. Return |promise| and start a timer for |adjustedTimeout| seconds.
Then asynchronously continue executing the following steps.

3. Set |callerOrigin| to the <a link-for='web'>origin</a> of the caller. Derive the RP ID from |callerOrigin| by computing the
"public suffix + 1" or "PS+1" (which is also referred to as the "Effective Top-Level Domain plus One" or "<a>eTLD+1</a>")
part of |callerOrigin| [[PSL]]. Let |rpId| be the lowercase form of this RP ID. Set |rpIdHash| to the SHA-256 hash of the
UTF-8 encoding of |rpId|.
3. Set |callerOrigin| to the <a link-for='web'>origin</a> of the caller. If {{CredentialOptions/rpId}} is not specified, then
set |rpId| to the Unicode serialization of |callerOrigin| as specified in [[!HTML51-20160621]] section 6.4. If
{{CredentialOptions/rpId}} is specified, then check if its value would be an acceptable setting for the current document's
`domain` by running the algorithm in [[!HTML51-20160621]] section 6.4.1 (but do not change the current document's `domain`).
If it is not permissible, reject |promise| with a <a>DOMException</a> whose name is "SecurityError", and terminate this
algorithm. If it is permissible, then set |rpId| to the Unicode serialization of {{CredentialOptions/rpId}}. Set |rpIdHash|
to the SHA-256 hash of the UTF-8 encoding of |rpId|.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

similar comments to the above chunk of text as I had on the foregoing.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tweaked the text a little bit to hopefully make it better.


4. If {{AssertionOptions/extensions}} was specified, process any extensions supported by this client platform, to produce the
extension data that needs to be sent to the authenticator. Call this data |clientExtensions|.
Expand Down Expand Up @@ -553,6 +556,7 @@ authorizing an authenticator with which to complete the operation.
<pre class="idl">
dictionary CredentialOptions {
unsigned long timeoutSeconds;
USVString rpId;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why USVString here? See http://heycam.github.io/webidl/#idl-USVString

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This RP ID will be sent to the authenticator "over the wire" when authenticatorMakeCredential is invoked. That seems to fit the USVString use case in the above guidance, though I would welcome expert guidance here.

sequence < CredentialDescription > excludeList;
WebAuthnExtensions extensions;
};
Expand All @@ -564,6 +568,9 @@ authorizing an authenticator with which to complete the operation.

- The <dfn>timeoutSeconds</dfn> parameter specifies a time, in seconds, that the caller is willing to wait for the call to
complete. This is treated as a hint, and may be overridden by the platform.

- The <dfn>rpId</dfn> parameter explicitly specifies the RP ID that the credential should be associated with. If it is
omitted, the RP ID will be set to the caller's origin.
Copy link
Contributor

@equalsJeffH equalsJeffH Sep 16, 2016 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i suspect that the term "caller's origin" will not pass muster here -- will try to figure out more precise term for where we say "caller" or "caller's".

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fyi/fwiw, i did nose around in the HTML spec(s) and they also use the term "caller" (in terms of the caller of an algorithm/operation), so I think/hope we're ok with using it in a similar fashion.


- The <dfn>excludeList</dfn> parameter is intended for use by <a>[RPS]</a> that wish to limit the creation of multiple
credentials for the same account on a single authenticator. The platform is requested to return an error if the new
Expand Down Expand Up @@ -610,6 +617,7 @@ user consent to a specific transaction. The structure of these signatures is def
<pre class="idl">
dictionary AssertionOptions {
unsigned long timeoutSeconds;
USVString rpId;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why USVString here? See http://heycam.github.io/webidl/#idl-USVString

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See above comment regarding same issue in CredentialOptions.

sequence < CredentialDescription > allowList;
WebAuthnExtensions extensions;
};
Expand All @@ -620,6 +628,9 @@ user consent to a specific transaction. The structure of these signatures is def

- The optional <dfn>timeoutSeconds</dfn> parameter specifies a time, in seconds, that the caller is willing to wait for the
call to complete. This is treated as a hint, and may be overridden by the platform.

- The optional <dfn>rpId</dfn> parameter specifies the rpId claimed by the caller. If it is omitted, it will be assumed to
be equal to the caller's origin.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

see comment above wrt "caller" et al.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also fixed.


- The optional <dfn>allowList</dfn> member contains a list of credentials acceptable to the caller, in order of the caller's
preference.
Expand Down