Stepup-webauthn requests a PIN code to be set when enrolling FIDO2

[phavekes]

This issue is imported from pivotal - Originaly created at Apr 11, 2024 by Peter Havekes

Before the php8/sf6 update, no pin was required when enrolling

[phavekes]

(Peter Havekes - Apr 11, 2024)

[phavekes]

Het vragen om de PIN zet je uit door AuthenticatorSelectionCriteria::USER_VERIFICATION_REQUIREMENT_DISCOURAGED te zetten. Maar als ik dat via config/packages/webauthn.yaml probeer aan te passen lijkt dat geen effect te hebben
(Peter Havekes - Apr 12, 2024)

[phavekes]

My experience on the new app:

Given: Ive set a PIN on my FIDO2 token

When I register a new FIDO2 token on the sa.surfcontext.nl
Then I'm prompted to fill in my pin
And I can succesfully register my token

When I do the same on the upgraded webauthn gssp
Then after stating my PIN, i see a JS error stating:

"The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission." (Michiel Kodde - Apr 15, 2024)

[phavekes]

My experience in the 'old' app:
Given: I've not set a pin on the FIDO2 token
When I register a new FIDO2 token on the sa.surfcontext.nl
Then I'm not prompted to fill in my pin
And I can succesfully register my token

When I do the same on the upgraded webauthn gssp
I'm required to set a pin, before I can continue (Peter Havekes - Apr 15, 2024)

[phavekes]

Interesting read on how Yubikey PINs behave in FIDO and FIDO2: https://support.yubico.com/hc/en-us/articles/4402836718866-Understanding-YubiKey-PINs

• There is only one FIDO PIN per Yubikey token
• The U2F ("FIDO 1") standard does not have a userVerification (e.g. a PIN), only FIDO 2 does, so disabling FIDO2 on a Yubikey token abd reverting it to U2F disables the password prompt and still allows you to authenticate using the token when the would client accepts this (i.e. does not require userVerification)
• Because we do not use the tokens as a second factor, we do not want userVerification as that is the role of the first factor. (Pieter van der Meulen - May 13, 2024)