Change WebAuthn config

1. The attestation conveyance is reset to NONE, it was previously enabled to allow for vendor certificate based attestation.
OpenConext · Apr 16, 2024 · 50ec2c2 · 50ec2c2
1 parent 530294e
commit 50ec2c2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/config/packages/webauthn.yaml b/config/packages/webauthn.yaml
@@ -16,14 +16,14 @@ webauthn:
             authenticator_selection_criteria:
                 authenticator_attachment: !php/const Webauthn\AuthenticatorSelectionCriteria::AUTHENTICATOR_ATTACHMENT_NO_PREFERENCE
                 require_resident_key: false
-                user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_PREFERRED
+                user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
             #  this is needed for SURFsecureID as we want to whitelist authenticators by vendor/certification (default is none)
             attestation_conveyance: !php/const Webauthn\PublicKeyCredentialCreationOptions::ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT
     request_profiles:
         default:
             challenge_length: 64
             timeout: 30000
-            user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_PREFERRED
+            user_verification: !php/const Webauthn\AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED
 
     metadata:
         enabled: true