mirror of
https://github.com/gravitational/teleport.git
synced 2026-11-01 21:52:02 +08:00
Alan Parra
d62da80174
Attestation allows Teleport admins a manner of control over the devices used for MFA. Attestation support for Webauthn works similarly to U2F attestation, but provides both allow and deny lists for device CAs. The device's attestation certificate must clear both lists before registration is complete. Previously-registered devices are not affected (similarly to U2F). * Better error messages on webauthn/httpserver * Make mocku2f attestation cert public * Implement attestation for Webauthn
Webauthn httpserver
The httpserver package contains a toy Webauthn HTTPS server used to test web integration and the interplay between web-registered and tsh-registered devices.
Devices registered via either interface should be able to be used interchangeably (with the exception of Touch ID, which is always tied to a specific app).
This is meant for local testing and debugging only. Keep it far away from any production uses.
Why this exists?
- It is a simple way to test web integration
- It is a simple way to interact with Touch ID
- Device registration (currently) relies on a streaming RPC, which is difficult to interact with using pure Js
Note that browser Webauthn APIs need a secure context (or you have to disable a bunch of checks in your browser, YMMV).
Usage
- Start the Teleport service
- Start the httpserver
# Generate TLS certificates for the server
# (Eg, `cd; mkcert localhost 127.0.0.1 ::1`)
# Start the test server
# cd /path/to/teleport/repo
go run ./lib/auth/webauthn/httpserver/ \
-cert_file ~/localhost+2.pem \
-key_file ~/localhost+3-key.pem
- Navigate to https://localhost:8080/index.html
- ?
- Profit