Allow explicit Touch ID prompts to be triggered via Go code, which will be used
to guard the (upcoming) credential picker prompt.
To avoid double-prompting users during Touch ID authentication we have to set a
grace period in the underlying LAContext and share it between the functions.
Note that AuthContextGuard (native) uses the LAContext explicitly, whereas
Authenticate (native) uses it through the SecItemCopyMatching query dictionary.
No UX visible changes are made in the PR, despite the fact that prompting occurs
a bit earlier.
#13901
* Allow explicit Touch ID prompts
Implement touch ID credential management via tsh touchid ls and tsh touchid rm.
Departs slightly from RFD command names in order to better match the tsh mfa.
See https://github.com/gravitational/teleport/blob/master/rfd/0054-passwordless-macos.md.
#9160
* Implement touch ID credential listing
* Add the `tsh touchid ls` command
* Implement touch ID credential deletion
* Add the `tsh touchid rm` command
* Delegate MFA prompts to WebAuthn
* Undo changes to tsh.go command switch
* Prompt newline. Trace errors.
* Update e/ to 6abb96b
* Var initialization. Guard against NULL. Return all credentials.
* Address review comments: simplifications and style
Introduce the touchid package and add the ability to register and login using
Secure Enclave keys.
The code is not yet wired to tsh, plus there are additional parts to come
(listing and deleting keys). This is tricky to properly execute, as the Secure
Enclave requires, at the very least, a signed binary and a provisioning profile
installed. Future PRs will attempt to bridge that gap and provide ways for
Teleport devs to compile and run this locally as well (but not for external
devs, sorry).
I've elected to keep native as simple as I could. Objc uses ARC for memory
management and good old C uses malloc/free, but there are relatively few naked
pointers (many of which are handled by Go with defer-frees). I've kept the
language boundary in plan C, so it's easier to reason about the Go<->C bridge.
The package is protected by the touchid build tag, but a good part of it exists
outside of it - that is in hope that it gets well exercised by CI. In the near
future the build tag will be used as a proxy for good builds (ie, if tagged then
we assume signed, notarized, etc) - this makes releasing safer in the short time,
without us having to code too many safeguards.
#9160
* Implement touch ID registration and login
* Validate raw public key length
* Use string concatenation in place of fmt.Sprintf
* Keep pubKeyFromRawAppleKey calls centered on api.go
* Compare strings using NSString (instead of string.h)
* Break early in params loop. Comments.
* Add license to headers
* Move native var. Non-pointer receiver. C tweaks.
* Use SecCopyErrorMessageString
* Guard against overflows. Release infos without defer.
Alan Parra