Implement native macOS methods required by device enrollment, namely methods to
Create/Get the device key, Sign challenges with it, and to collect device data
(aka serial number).
The implementation is rather similar to lib/auth/touchid, but simpler in a few
aspects:
1. Device keys don't require user interaction (as in they don't cause a touch ID
prompt); and
2. There exists, at most, a single device key at all times.
I've added a tiny refactor to reuse Apple public key parsing from touchid, plus
some changes so touchid doesn't break in the face of unexpected keys (which the
device key didn't cause, per se, but my experiments getting to it did).
gravitational/teleport.e#514
Implement the Touch ID credential picker.
During passwordless authentication, when more than one login is present in
Enclave credentials, `tsh` now asks the end user to pick their desired login.
Credential picker terminal prompts are preceded by a system Touch ID prompt,
which is then reused for authentication, provided less than 10 seconds pass in
the meantime.
I've done a couple of refactors to make the `CredentialInfo` structs similar
between the `webauthncli` and `touchid` packages, so it's easier to trace
parallels between them.
#13901
* Refactor touchid.CredentialInfo
* Refactor wancli.CredentialInfo
* Move fido2_prompt*.go to prompt*.go
* Define the touchid credential picker API
* Add Touch ID credential picker tests
* Implement touchid credential picker
Allow explicit Touch ID prompts to be triggered via Go code, which will be used
to guard the (upcoming) credential picker prompt.
To avoid double-prompting users during Touch ID authentication we have to set a
grace period in the underlying LAContext and share it between the functions.
Note that AuthContextGuard (native) uses the LAContext explicitly, whereas
Authenticate (native) uses it through the SecItemCopyMatching query dictionary.
No UX visible changes are made in the PR, despite the fact that prompting occurs
a bit earlier.
#13901
* Allow explicit Touch ID prompts
* configure golangci-lint misspell to check for anglicized spellings
* Americanize spellings
* fix aws constant value with british spelling 🇬🇧
* update api types with americanized spellings
* use american spellings .cloudbuild/scripts
Add a prompt message to tsh when we fire Touch ID, so users are aware of it.
Helpful in certain situations where the prompt isn't apparent, such as partially
open macbooks, multiple monitors, tsh being used from remote sessions, etc.
The Touch ID prompt is shown automatically by the OS in certain operations,
which are triggered via native code, so the message itself is added before the
first invocation of presence-requiring methods.
Favor newer Touch ID credentials in the allowed set for MFA, or just the newer
credential for passwordless.
Fixes a capture-by-reference bug and adds coverage for it.
Issue #13340.
* Add tests for Touch ID credential-choosing logic
* Favor newer Touch ID credentials within the allowed set
* Warn about origin vs RPID mismatch
Change the Touch ID registration interface so `tsh` explicitly confirms or
rollbacks MFA registrations.
Before resident keys, MFA keys from U2F or WebAuthn only truly existed
server-side, but with resident keys/passwordless some cleanup is necessary if
the server-side registration goes awry.
The PR also changes Touch ID authentication so that newer keys are preferred,
which allows re-registration to be used as sort of a self-healing mechanism.
#9160
* Read creation time from Keychain entries
* Explicitly confirm or rollback Touch ID registrations
Set the macOS deployment target, ensuring that statically linked libfido2 `tsh`
builds run correctly on older macOS versions.
#9160
* Consistently set macOS min version
* Bump min macOS version to 10.13
Since #12794 we now build `tsh` binaries with touch ID capabilities. This calls
for a more sophisticated mechanism to determine if touch ID functions should be
enabled, as compile-time support only is not enough.
I've added the following checks, on top of compile-time / `touchid` build tag:
Binary is signed
Binary has entitlements
Machine is touch ID capable
Machine has a Secure Enclave
Put together this give us a much better proxy on whether to enable touch ID.
I've also added the `tsh touchid diag` command, mentioned in the Passwordless
macOS RFD (see
https://github.com/gravitational/teleport/blob/master/rfd/0054-passwordless-macos.md#tsh-support-commands).
#9160
* Improved touch ID availability and diagnostics
* Add the `tsh touchid diag` command
* Set min macOS version to 10.12 (macOS Sierra)
Adding a "marker" to Keychain labels lets us detect unexpected entries (which I
did see happen) and gives us flexibility to change formats in the future.
A marker in the "label" field seems to be enough to achieve the purposes above,
so I stopped at that. Added a couple minor UX tweaks as well.
#9160
* Use a marker for Keychain labels
* Tweak: Rename "Key Handle" to "Credential ID" for consistency
* Tweak: Do not prompt MFA/OTP if doing Touch ID
* Use trace errors
Implement touch ID credential management via tsh touchid ls and tsh touchid rm.
Departs slightly from RFD command names in order to better match the tsh mfa.
See https://github.com/gravitational/teleport/blob/master/rfd/0054-passwordless-macos.md.
#9160
* Implement touch ID credential listing
* Add the `tsh touchid ls` command
* Implement touch ID credential deletion
* Add the `tsh touchid rm` command
* Delegate MFA prompts to WebAuthn
* Undo changes to tsh.go command switch
* Prompt newline. Trace errors.
* Update e/ to 6abb96b
* Var initialization. Guard against NULL. Return all credentials.
* Address review comments: simplifications and style
Add the --mfa-mode flag and wire touch ID into tsh authn/registration.
In the default MFA mode (auto), touch ID should be eager if there is a
credential present in the system. Users may change this behavior using other MFA
modes.
See https://github.com/gravitational/teleport/blob/master/rfd/0054-passwordless-macos.md.
#9160
* Add AuthenticatorAttachment/MFAMode to tsh
* Add support for touch ID in wancli.Login
* Warn users about passwordless in U2F mode
* Add support for touch ID in `tsh mfa add`
Introduce the touchid package and add the ability to register and login using
Secure Enclave keys.
The code is not yet wired to tsh, plus there are additional parts to come
(listing and deleting keys). This is tricky to properly execute, as the Secure
Enclave requires, at the very least, a signed binary and a provisioning profile
installed. Future PRs will attempt to bridge that gap and provide ways for
Teleport devs to compile and run this locally as well (but not for external
devs, sorry).
I've elected to keep native as simple as I could. Objc uses ARC for memory
management and good old C uses malloc/free, but there are relatively few naked
pointers (many of which are handled by Go with defer-frees). I've kept the
language boundary in plan C, so it's easier to reason about the Go<->C bridge.
The package is protected by the touchid build tag, but a good part of it exists
outside of it - that is in hope that it gets well exercised by CI. In the near
future the build tag will be used as a proxy for good builds (ie, if tagged then
we assume signed, notarized, etc) - this makes releasing safer in the short time,
without us having to code too many safeguards.
#9160
* Implement touch ID registration and login
* Validate raw public key length
* Use string concatenation in place of fmt.Sprintf
* Keep pubKeyFromRawAppleKey calls centered on api.go
* Compare strings using NSString (instead of string.h)
* Break early in params loop. Comments.
* Add license to headers
* Move native var. Non-pointer receiver. C tweaks.
* Use SecCopyErrorMessageString
* Guard against overflows. Release infos without defer.
Tobiasz Heller