Skip to content

Fido2: Support for user handles #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
p1gp1g wants to merge 1 commit into
base: credential_selection
Choose a base branch
from
Open

Fido2: Support for user handles #1

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions play-services-fido/core/src/main/kotlin/org/microg/gms/fido/core/RequestHandling.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,7 @@ class WrongPinException(message: String? = null): Exception(message)

enum class RequestOptionsType { REGISTER, SIGN }
class UserInfo(
val handle: ByteArray? = null,
val name: String,
val displayName: String? = null,
val icon: String? = null
Expand Down
5 changes: 3 additions & 2 deletions ...services-fido/core/src/main/kotlin/org/microg/gms/fido/core/transport/TransportHandler.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -528,21 +528,22 @@ abstract class TransportHandler(val transport: Transport, val callback: Transpor
val assertionResponses = ArrayList<Pair<UserInfo?, suspend () -> AuthenticatorAssertionResponse>>()

for ((response, credentialId) in responses) {
val handle = response.user?.id
var name = response.user?.name
var displayName = response.user?.displayName
var icon = response.user?.icon

var userInfo: UserInfo? = null
if (name != null) {
userInfo = UserInfo(name, displayName, icon)
userInfo = UserInfo(handle, name, displayName, icon)
}

val assertionResponse = AuthenticatorAssertionResponse(
credentialId ?: ByteArray(0).also { Log.w(TAG, "keyHandle was null for key with display name $displayName") },
clientData,
response.authData,
response.signature,
null
handle
)
assertionResponses.add(userInfo to suspend { assertionResponse })
}
Expand Down
19 changes: 13 additions & 6 deletions ...rc/main/kotlin/org/microg/gms/fido/core/transport/screenlock/ScreenLockCredentialStore.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,10 +164,11 @@ class ScreenLockCredentialStore(val context: Context) : SQLiteOpenHelper(context
companion object {
const val TAG = "FidoLockStore"

const val DATABASE_VERSION = 1
const val DATABASE_VERSION = 2
Copy link
Copy Markdown
Author

@p1gp1g p1gp1g May 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I know your patch isn't merged upstream yet, but I'm already using your patch; so if you want to avoid the migration, can you at least keep version = 2 ?


const val TABLE_DISPLAY_NAMES = "DISPLAY_NAMES_TABLE"
const val COLUMN_KEY_ALIAS = "KEY_ALIAS_COLUMN"
const val COLUMN_HANDLE = "HANDLE_COLUMN"
const val COLUMN_NAME = "NAME_COLUMN"
const val COLUMN_DISPLAY_NAME = "DISPLAY_NAME_COLUMN"
const val COLUMN_ICON = "ICON_COLUMN"
Expand All @@ -184,24 +185,28 @@ class ScreenLockCredentialStore(val context: Context) : SQLiteOpenHelper(context
if (oldVersion < 1) {
db.execSQL("CREATE TABLE $TABLE_DISPLAY_NAMES($COLUMN_KEY_ALIAS TEXT NOT NULL, $COLUMN_NAME TEXT NOT NULL, $COLUMN_DISPLAY_NAME TEXT, $COLUMN_ICON TEXT, UNIQUE($COLUMN_KEY_ALIAS) ON CONFLICT REPLACE)")
}
if (oldVersion < 2) {
db.execSQL("ALTER TABLE $TABLE_DISPLAY_NAMES ADD COLUMN $COLUMN_HANDLE TEXT")
}
}

fun addUserInfo(rpId: String, keyId: ByteArray, userInfo: UserInfo) {
addUserInfo(rpId, keyId, userInfo.name, userInfo.displayName, userInfo.icon)
addUserInfo(rpId, keyId, userInfo.handle, userInfo.name, userInfo.displayName, userInfo.icon)
}

fun addUserInfo(rpId: String, keyId: ByteArray, name: String, displayName: String? = null, icon: String? = null) = writableDatabase.use {
fun addUserInfo(rpId: String, keyId: ByteArray, userHandle: ByteArray?, name: String, displayName: String? = null, icon: String? = null) = writableDatabase.use {
// Since this function is not called very often, calling cleanDatabase here will probably not
// slow things down by much, and it will avoid the database growing larger than necessary
cleanDatabase(it)

// The key alias and display names are both coming from outside sources. Don't trust them
val keyAlias = getAlias(rpId, keyId)
val insertStatement = it.compileStatement("INSERT INTO $TABLE_DISPLAY_NAMES($COLUMN_KEY_ALIAS, $COLUMN_NAME, $COLUMN_DISPLAY_NAME, $COLUMN_ICON) VALUES(?, ?, ?, ?)")
val insertStatement = it.compileStatement("INSERT INTO $TABLE_DISPLAY_NAMES($COLUMN_KEY_ALIAS, $COLUMN_NAME, $COLUMN_DISPLAY_NAME, $COLUMN_ICON, $COLUMN_HANDLE) VALUES(?, ?, ?, ?, ?)")
insertStatement.bindString(1, keyAlias)
insertStatement.bindString(2, name)
if (displayName != null) insertStatement.bindString(3, displayName)
if (icon != null) insertStatement.bindString(4, icon)
userHandle?.toBase64()?.let { insertStatement.bindString(5, it) }
insertStatement.executeInsert()
}

Expand All @@ -211,21 +216,23 @@ class ScreenLockCredentialStore(val context: Context) : SQLiteOpenHelper(context
cleanDatabase(it)

val keyAlias = getAlias(rpId, keyId)
val userInfoQuery = it.query(TABLE_DISPLAY_NAMES, arrayOf(COLUMN_NAME, COLUMN_DISPLAY_NAME, COLUMN_ICON), "$COLUMN_KEY_ALIAS = ?", arrayOf(keyAlias), null, null, null, null)
val userInfoQuery = it.query(TABLE_DISPLAY_NAMES, arrayOf(COLUMN_NAME, COLUMN_DISPLAY_NAME, COLUMN_ICON, COLUMN_HANDLE), "$COLUMN_KEY_ALIAS = ?", arrayOf(keyAlias), null, null, null, null)

var name: String? = null
var displayName: String? = null
var icon: String? = null
var handle: ByteArray? = null
userInfoQuery.use { cursor ->
if (cursor.moveToNext()) {
name = cursor.getString(0)
displayName = cursor.getString(1)
icon = cursor.getString(2)
handle = Base64.decode(cursor.getString(3), Base64.DEFAULT)
}
}

if (name != null) {
return UserInfo(name!!, displayName, icon)
return UserInfo(handle, name!!, displayName, icon)
} else {
return null
}
Expand Down
5 changes: 3 additions & 2 deletions ...c/main/kotlin/org/microg/gms/fido/core/transport/screenlock/ScreenLockTransportHandler.kt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,11 +144,12 @@ class ScreenLockTransportHandler(private val activity: FragmentActivity, callbac
store.getPublicKey(options.rpId, keyId)
?: throw RequestHandlingException(ErrorCode.INVALID_STATE_ERR)

val handle = options.registerOptions.user.id
val name = options.registerOptions.user.name
val displayName = options.registerOptions.user.displayName
val icon = options.registerOptions.user.icon

store.addUserInfo(options.rpId, keyId, name, displayName, icon)
store.addUserInfo(options.rpId, keyId, handle, name, displayName, icon)

// We're ignoring the signature object as we don't need it for registration
val signature = getActiveSignature(options, callerPackage, keyId)
Expand Down Expand Up @@ -283,7 +284,7 @@ class ScreenLockTransportHandler(private val activity: FragmentActivity, callbac
clientData,
authenticatorData.encode(),
sig,
null
userInfo?.handle
)
}

Expand Down