Error when registering a FIDO2 token

[peterclijsters1]

On the SSID test environment, when trying to register a FIDO2 token this error is thrown:

• sa.test.surfconext.nl
• institution-a
• Chrome browser
• Yubikey that works fine with exisiting FIDO2 token registrations
• Followed these steps in Chrome:
  
  
  

[peterclijsters1]

Also tested in Safari, same error.

[pmeulen]

Logs:

webauthn[791]: {"message":"AuthnRequest processing complete, received AuthnRequest from \"https://sa-gw.test.surfconext.nl/gssp/webauthn/metadata\", request ID: \"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0\"","context":{},"level":250,"level_name":"NOTICE","channel":"app","datetime":"2024-12-04T13:12:46+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"391c73a41c6c1db9f0f15cc6bc66b14d"}}
webauthn[791]: {"message":"Invalid attestation \"Of the 0 StatusReports tested, none met one of the required FIDO Certified statuses,\n                        or the status was explicitly denied. Reports tested: \"\"\"","context":{"nameId":"28fb6eac-188d-4ec6-94c1-8e2c906c4f85","sari":"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0"},"level":300,"level_name":"WARNING","channel":"app","datetime":"2024-12-04T13:12:54+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"acd79171e486c88cbf27ab83ef81e467"}}
webauthn[791]: {"message":"User cancelled the request","context":{"sari":"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0"},"level":250,"level_name":"NOTICE","channel":"app","datetime":"2024-12-04T13:13:40+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"479bff0c93d859f8c0345454e6cb9eee"}}
webauthn[791]: {"message":"User cancelled the request","context":{"sari":"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0"},"level":500,"level_name":"CRITICAL","channel":"app","datetime":"2024-12-04T13:13:40+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"479bff0c93d859f8c0345454e6cb9eee"}}
webauthn[791]: {"message":"Redirect to sso return endpoint with registration reject response","context":{"sari":"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0"},"level":200,"level_name":"INFO","channel":"app","datetime":"2024-12-04T13:13:40+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"479bff0c93d859f8c0345454e6cb9eee"}}
webauthn[791]: {"message":"Created redirect response for sso return endpoint \"/saml/sso_return\"","context":{"sari":"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0"},"level":250,"level_name":"NOTICE","channel":"app","datetime":"2024-12-04T13:13:40+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"479bff0c93d859f8c0345454e6cb9eee"}}
webauthn[791]: {"message":"Saml response created with id \"_37d945ad6a721a1e636f23fb093c902aa597adaf41c2f6b7a144d22b88dc\", request ID: \"_a78d29a5a49cab74e25c1ef2ccf3ea47f91389290eec7827bcad4ea82eb0\"","context":{},"level":250,"level_name":"NOTICE","channel":"app","datetime":"2024-12-04T13:13:40+01:00","extra":{"server":"webauthn.test.surfconext.nl","application":"Webauthn","request_id":"120bf56df725d0082135bf1153a55368"}}

[phavekes]

This should be forcing roaming authenticators, and possibly prevent these issues.

https://webauthn-doc.spomky-labs.com/symfony-bundle/advanced-behaviors/authenticator-selection-criteria#:~:text=AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM

I'll create a test-build for this

[phavekes]

test version in https://github.com/OpenConext/Stepup-Webauthn/tree/feature/authenticator_selection_criteria