java-webauthn-server
java-webauthn-server copied to clipboard
Lookup credentials based only on user_handle instead of user_name
Hello team,
I've observed that sometime we use user_name
to look up stored public key credentials, examples are when we resolve the allowCredentials
list in authentication ceremony and excludeCredentials
list in registration ceremony.
I wonder if we can just use user_handle to resolve for credential instead? as user_handle is more "immutable" than user_name, which could be changed from time to time.
Is that to accomodate sometime user_handle is missing but only user_name is presenting?
Hi! This sounds like a duplicate of issue #274, which is about supporting username-less accounts. There is some experimental support for that available, see the most recent few comments in the #274 thread. Does that answer your questions?
Hi! This sounds like a duplicate of issue #274, which is about supporting username-less accounts. There is some experimental support for that available, see the most recent few comments in the #274 thread. Does that answer your questions?
Hi, thanks for the response! I take a look at the v2 interface, it seems exactly fit our need - prefer using user_handle as the key to fetch data in the repository
. I wonder what's the plan for promoting the experimental branch to mainline, is there any plan for that?
We want to do it eventually, but there's no concrete time plan at the moment. Perhaps in one or two months from now, but I can't promise that either. Sorry I can't give you a better answer.
But please let us know if there's a particular time frame that would help you, and we can take that into consideration when prioritizing work. We could probably also make the v2 interfaces available in a shorter time frame as an experimental release, like 2.6.0-alpha1
, if you need it for prototyping.
But please let us know if there's a particular time frame that would help you, and we can take that into consideration when prioritizing work. We could probably also make the v2 interfaces available in a shorter time frame as an experimental release, like
2.6.0-alpha1
, if you need it for prototyping.
Thanks for quick reply, I think releasing it to an alpha could help a lot and we will start integrating v2 repository.
Our feature is not launched yet, we do want to launch it sometime in Q4 (October/November 2023), integrating with v2 repository will allow us to avoid some user_name -> user_handle lookup so if time permits we do want to include it in the first release.
Thanks for letting us know! I can't promise an experimental release yet, but we'll let you know if we set a planned release date.
Hi again! We're aiming to make the experimental release with the new V2
interfaces soon, hopefully this week or next week. Would that be helpful for you?
Hi again! We're aiming to make the experimental release with the new
V2
interfaces soon, hopefully this week or next week. Would that be helpful for you?
That would be awesome and will help our timeline 🙏
Sorry, the release has slipped a bit, but we hope to finish it this week.
This is now released in experimental release 2.6.0-alpha4
. Thanks for your patience!