Endpoints for ASAuthorizationController

[mezza]

If I want to also enable iOS Webauthn registration and authentication from a native app, in addition to web-based registration and authentication, are there endpoints exposed by RodAuth::Webauthn?

Thanks in advance,

Mezza

[jeremyevans]

Rodauth's webauthn support can use JSON if using the json feature. The related specs start at

rodauth/spec/webauthn_spec.rb

Line 567 in 588b865

it "should allow webauthn authentication via #{json}" do

Do you think that will work for you, or is there some iOS specific support that is needed?

[janko]

rodauth-rails doesn't create any new routes, you still use Rodauth's routes there. So, this must be a custom route your created, or perhaps you set webauthn_setup_route "webauthn/new"?

[mezza]

Thanks @janko. The webauthn/new is indeed a custom route I setup for a webauthn_controlller.rb using just the webauthn gem, but the basic issue is that I can't find a route in Rodauth-rails that yields a publicKeyCredentialCreationOptions response as in my initial comment.

If I use webauthn-setup then as shown - in the link from @jeremyevans above - it renders HTTP 401. In fact, looking at that code, it appears that webauthn-setup only returns webauthn_setup_view after authentication.

[jeremyevans]

That's expected. The webauthn feature is used for 2FA after login. Are you trying to use webauthn as the sole form of authentication, and not as 2FA? Then you want the webauthn_login feature.

[mezza]

I am indeed trying to just use webauthn as the sole form of authentication, and I have already enabled the webauthn_login feature.

This doesn't present itself as a problem when registering an account using the views generated by Rodauth/Rodauth-rails, since the password field is omitted and the user enters a login/email when registering their passkey. However, it doesn't work when I'm trying to register the passkey from iOS.

[jeremyevans]

Maybe you want to use the webauthn_verify_account feature? It allows creating a webauthn authenticator during account verification. You submit a request to verify-account, which returns a 422 response that contains the webauthn challenge, and then you submit another request to verify-account that contains the challenge information. Specs for this using JSON requests are at https://github.com/jeremyevans/rodauth/blob/master/spec/webauthn_verify_account_spec.rb#L146-L153