Attachment #416034 for bug #219711

View Details Raw Unified Return to Bug 219711

| Differences between



2020-12-11  Jiewen Tan  <jiewen_tan@apple.com>

        [WebAuthn] Adopt new UI for the Security Key getAssertion flow
        https://bugs.webkit.org/show_bug.cgi?id=219711
        <rdar://problem/72154840>

        Reviewed by NOBODY (OOPS!).

        This patch adopts the new UI for the security key getAssertion flow which contains two part:
        1. showing a informative UI to ask the user to connect their security keys,
        2. showing an account picker for users to select a credential to use.

        Covered by manual tests.

        * Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h:
        Paperwork.

        * UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h:
        * UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm:
        (WebKit::AuthenticatorPresenterCoordinator::AuthenticatorPresenterCoordinator):
        (WebKit::AuthenticatorPresenterCoordinator::selectAssertionResponse):
        (WebKit::AuthenticatorPresenterCoordinator::didSelectAssertionResponse):
        * UIProcess/WebAuthentication/Cocoa/WKASCAuthorizationPresenterDelegate.mm:
        (-[WKASCAuthorizationPresenterDelegate authorizationPresenter:credentialRequestedForLoginChoice:authenticatedContext:completionHandler:]):
        Implements the two flows.

2020-12-10  Jiewen Tan  <jiewen_tan@apple.com>

        [WebAuthn] Adopt new UI for the Platform Authenticator makeCredential flow

Lines 69-74 NS_ASSUME_NONNULL_BEGIN a/Source/WebKit/Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h_sec1
- a/Source/WebKit/Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h -5 / +13 lines
69	@interface ASCAuthorizationPresenter : NSObject <ASCAuthorizationPresenterHostProtocol>	69	@interface ASCAuthorizationPresenter : NSObject <ASCAuthorizationPresenterHostProtocol>
70		70
71	- (void)presentAuthorizationWithContext:(ASCAuthorizationPresentationContext )context completionHandler:(void (^)(id<ASCCredentialProtocol> _Nullable, NSError _Nullable))completionHandler;	71	- (void)presentAuthorizationWithContext:(ASCAuthorizationPresentationContext )context completionHandler:(void (^)(id<ASCCredentialProtocol> _Nullable, NSError _Nullable))completionHandler;
		72	- (void)updateInterfaceWithLoginChoices:(NSArray<id <ASCLoginChoiceProtocol>> *)loginChoices;
72		73
73	@property (nonatomic, weak) id <ASCAuthorizationPresenterDelegate> delegate;	74	@property (nonatomic, weak) id <ASCAuthorizationPresenterDelegate> delegate;
74		75
Lines 89-95 extern NSString * const ASCAuthorizationPresentationContextDataKey; a/Source/WebKit/Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h_sec2
89		90
90	@property (nonatomic, readonly, copy) NSString *appIdentifier;	91	@property (nonatomic, readonly, copy) NSString *appIdentifier;
91	@property (nonatomic, readonly, copy) NSArray<id<ASCLoginChoiceProtocol>> *loginChoices;	92	@property (nonatomic, readonly, copy) NSArray<id<ASCLoginChoiceProtocol>> *loginChoices;
92	@property (nonatomic, nullable, copy) NSString *relyingPartyIdentifier;	93	@property (nonatomic, nullable, copy) NSString *serviceName;
93		94
94	@property (nonatomic, copy) NSString *proxiedAppName;	95	@property (nonatomic, copy) NSString *proxiedAppName;
95	@property (nonatomic, copy) NSArray<NSString > proxiedAssociatedDomains;	96	@property (nonatomic, copy) NSArray<NSString > proxiedAssociatedDomains;
Lines 102-116 extern NSString * const ASCAuthorizationPresentationContextDataKey; a/Source/WebKit/Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h_sec3
102		103
103	@end	104	@end
104		105
		106	typedef NS_ENUM(NSInteger, ASCSecurityKeyPublicKeyCredentialLoginChoiceKind) {
		107	ASCSecurityKeyPublicKeyCredentialLoginChoiceKindRegistration,
		108	ASCSecurityKeyPublicKeyCredentialLoginChoiceKindAssertion,
		109	ASCSecurityKeyPublicKeyCredentialLoginChoiceKindAssertionPlaceholder,
		110	};
		111
105	@interface ASCSecurityKeyPublicKeyCredentialLoginChoice : NSObject <ASCLoginChoiceProtocol>	112	@interface ASCSecurityKeyPublicKeyCredentialLoginChoice : NSObject <ASCLoginChoiceProtocol>
106		113
107	- (instancetype)initRegistrationChoice;	114	- (instancetype)initRegistrationChoice;
108	- (instancetype)initWithName:(NSString )name displayName:(NSString )displayName userHandle:(NSData *)userHandle;	115	- (instancetype)initWithName:(NSString )name displayName:(NSString )displayName userHandle:(NSData *)userHandle;
		116	- (instancetype)initAssertionPlaceholderChoice;
109		117
110	@property (nonatomic, readonly, copy) NSString *name;	118	@property (nonatomic, nullable, readonly, copy) NSString *name;
111	@property (nonatomic, readonly, copy) NSString *displayName;	119	@property (nonatomic, nullable, readonly, copy) NSString *displayName;
112	@property (nonatomic, readonly, copy) NSData *userHandle;	120	@property (nonatomic, nullable, readonly, copy) NSData *userHandle;
113	@property (nonatomic, readonly) BOOL isRegistrationRequest;	121	@property (nonatomic, readonly) ASCSecurityKeyPublicKeyCredentialLoginChoiceKind loginChoiceKind;
114		122
115	+ (instancetype)new NS_UNAVAILABLE;	123	+ (instancetype)new NS_UNAVAILABLE;
116	- (instancetype)init NS_UNAVAILABLE;	124	- (instancetype)init NS_UNAVAILABLE;

Lines 35-40 a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h_sec1
- a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h +6 lines
35	#include <wtf/WeakPtr.h>	35	#include <wtf/WeakPtr.h>
36		36
37	OBJC_CLASS ASCAuthorizationPresenter;	37	OBJC_CLASS ASCAuthorizationPresenter;
		38	OBJC_CLASS ASCLoginChoiceProtocol;
38	OBJC_CLASS LAContext;	39	OBJC_CLASS LAContext;
39	OBJC_CLASS WKASCAuthorizationPresenterDelegate;	40	OBJC_CLASS WKASCAuthorizationPresenterDelegate;
40		41
Lines 64-69 public: a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h_sec2
64	void setCredentialRequestHandler(CredentialRequestHandler&& handler) { m_credentialRequestHandler = WTFMove(handler); }	65	void setCredentialRequestHandler(CredentialRequestHandler&& handler) { m_credentialRequestHandler = WTFMove(handler); }
65	void setLAContext(LAContext *);	66	void setLAContext(LAContext *);
66		67
		68	void didSelectAssertionResponse(ASCLoginChoiceProtocol *);
		69
67	private:	70	private:
68	WeakPtr<AuthenticatorManager> m_manager;	71	WeakPtr<AuthenticatorManager> m_manager;
69	RetainPtr<ASCAuthorizationPresenter> m_presenter;	72	RetainPtr<ASCAuthorizationPresenter> m_presenter;
Lines 73-78 private: a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h_sec3
73		76
74	CompletionHandler<void(LAContext *)> m_laContextHandler;	77	CompletionHandler<void(LAContext *)> m_laContextHandler;
75	RetainPtr<LAContext> m_laContext;	78	RetainPtr<LAContext> m_laContext;
		79
		80	CompletionHandler<void(WebCore::AuthenticatorAssertionResponse*)> m_responseHandler;
		81	HashMap<ASCLoginChoiceProtocol , WebCore::AuthenticatorAssertionResponse> m_credentials;
76	};	82	};
77		83
78	} // namespace WebKit	84	} // namespace WebKit




#import "AuthenticatorManager.h"
#import "WKASCAuthorizationPresenterDelegate.h"
#import <WebCore/AuthenticatorAssertionResponse.h>
#import <wtf/BlockPtr.h>

#import "AuthenticationServicesCoreSoftLink.h"

{
#if HAVE(ASC_AUTH_UI)
    auto presentationContext = adoptNS([allocASCAuthorizationPresentationContextInstance() initWithRequestContext:nullptr appIdentifier:nullptr]);
    [presentationContext setServiceName: rpId];

    switch (type) {
    case ClientDataType::Create:

            [presentationContext addLoginChoice:adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initRegistrationChoice]).get()];
        break;
    case ClientDataType::Get:
        if (transports.contains(AuthenticatorTransport::Usb) || transports.contains(AuthenticatorTransport::Nfc))
            [presentationContext addLoginChoice:adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initAssertionPlaceholderChoice]).get()];
        break;
    default:
        ASSERT_NOT_REACHED();

    // FIXME(219712): Adopt new UI for the Client PIN flow.
}

void AuthenticatorPresenterCoordinator::selectAssertionResponse(Vector<Ref<AuthenticatorAssertionResponse>>&& responses, WebAuthenticationSource source, CompletionHandler<void(AuthenticatorAssertionResponse*)>&& completionHandler)
{
#if HAVE(ASC_AUTH_UI)
    if (m_responseHandler)
        m_responseHandler(nullptr);
    m_responseHandler = WTFMove(completionHandler);

    if (source == WebAuthenticationSource::External) {
        auto loginChoices = adoptNS([[NSMutableArray alloc] init]);

        for (auto& response : responses) {
            RetainPtr<NSData> userHandle;
            if (response->userHandle())
                userHandle = adoptNS([[NSData alloc] initWithBytes:response->userHandle()->data() length:response->userHandle()->byteLength()]);

            auto loginChoice = adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initWithName:response->name() displayName:response->displayName() userHandle:userHandle.get()]);
            [loginChoices addObject:loginChoice.get()];

            m_credentials.add((ASCLoginChoiceProtocol *)loginChoice.get(), response.ptr());
        }

        [m_presenter updateInterfaceWithLoginChoices:loginChoices.get()];
        return;
    }
    // FIXME(219710): Adopt new UI for the Platform Authenticator getAssertion flow.
#endif // HAVE(ASC_AUTH_UI)
}

void AuthenticatorPresenterCoordinator::requestLAContextForUserVerification(CompletionHandler<void(LAContext *)>&& completionHandler)

    m_laContext = context;
}

void AuthenticatorPresenterCoordinator::didSelectAssertionResponse(ASCLoginChoiceProtocol *loginChoice)
{
    auto* response = m_credentials.take(loginChoice);
    if (!response)
        return;

    m_responseHandler(response);
}

} // namespace WebKit

#endif // ENABLE(WEB_AUTHN)



            return;
        }
    }

    if ([loginChoice isKindOfClass:WebKit::getASCSecurityKeyPublicKeyCredentialLoginChoiceClass()]) {
        if ([(ASCSecurityKeyPublicKeyCredentialLoginChoice *)loginChoice loginChoiceKind] == ASCSecurityKeyPublicKeyCredentialLoginChoiceKindAssertion) {
            [self dispatchCoordinatorCallback:[loginChoice] (WebKit::AuthenticatorPresenterCoordinator& coordinator) mutable {
                coordinator.didSelectAssertionResponse((ASCLoginChoiceProtocol *)loginChoice);
            }];

            return;
        }
    }
}

- (void)authorizationPresenter:(ASCAuthorizationPresenter *)presenter validateUserEnteredPIN:(NSString *)pin completionHandler:(void (^)(id <ASCCredentialProtocol> credential, NSError *error))completionHandler

Return to Bug 219711

Lines 1-3 a/Source/WebKit/ChangeLog_sec1
- a/Source/WebKit/ChangeLog +26 lines
		1	2020-12-11 Jiewen Tan <jiewen_tan@apple.com>
		2
		3	[WebAuthn] Adopt new UI for the Security Key getAssertion flow
		4	https://bugs.webkit.org/show_bug.cgi?id=219711
		5	<rdar://problem/72154840>
		6
		7	Reviewed by NOBODY (OOPS!).
		8
		9	This patch adopts the new UI for the security key getAssertion flow which contains two part:
		10	1. showing a informative UI to ask the user to connect their security keys,
		11	2. showing an account picker for users to select a credential to use.
		12
		13	Covered by manual tests.
		14
		15	* Platform/spi/Cocoa/AuthenticationServicesCoreSPI.h:
		16	Paperwork.
		17
		18	* UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.h:
		19	* UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm:
		20	(WebKit::AuthenticatorPresenterCoordinator::AuthenticatorPresenterCoordinator):
		21	(WebKit::AuthenticatorPresenterCoordinator::selectAssertionResponse):
		22	(WebKit::AuthenticatorPresenterCoordinator::didSelectAssertionResponse):
		23	* UIProcess/WebAuthentication/Cocoa/WKASCAuthorizationPresenterDelegate.mm:
		24	(-[WKASCAuthorizationPresenterDelegate authorizationPresenter:credentialRequestedForLoginChoice:authenticatedContext:completionHandler:]):
		25	Implements the two flows.
		26
1	2020-12-10 Jiewen Tan <jiewen_tan@apple.com>	27	2020-12-10 Jiewen Tan <jiewen_tan@apple.com>
2		28
3	[WebAuthn] Adopt new UI for the Platform Authenticator makeCredential flow	29	[WebAuthn] Adopt new UI for the Platform Authenticator makeCredential flow

Lines 30-36 a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm_sec1
- a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm -6 / +37 lines
30		30
31	#import "AuthenticatorManager.h"	31	#import "AuthenticatorManager.h"
32	#import "WKASCAuthorizationPresenterDelegate.h"	32	#import "WKASCAuthorizationPresenterDelegate.h"
33	#import <WebCore/NotImplemented.h>	33	#import <WebCore/AuthenticatorAssertionResponse.h>
34	#import <wtf/BlockPtr.h>	34	#import <wtf/BlockPtr.h>
35		35
36	#import "AuthenticationServicesCoreSoftLink.h"	36	#import "AuthenticationServicesCoreSoftLink.h"
Lines 43-49 AuthenticatorPresenterCoordinator::AuthenticatorPresenterCoordinator(const Authe a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm_sec2
43	{	43	{
44	#if HAVE(ASC_AUTH_UI)	44	#if HAVE(ASC_AUTH_UI)
45	auto presentationContext = adoptNS([allocASCAuthorizationPresentationContextInstance() initWithRequestContext:nullptr appIdentifier:nullptr]);	45	auto presentationContext = adoptNS([allocASCAuthorizationPresentationContextInstance() initWithRequestContext:nullptr appIdentifier:nullptr]);
46	[presentationContext setRelyingPartyIdentifier: rpId];	46	[presentationContext setServiceName: rpId];
47		47
48	switch (type) {	48	switch (type) {
49	case ClientDataType::Create:	49	case ClientDataType::Create:
Lines 53-60 AuthenticatorPresenterCoordinator::AuthenticatorPresenterCoordinator(const Authe a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm_sec3
53	[presentationContext addLoginChoice:adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initRegistrationChoice]).get()];	53	[presentationContext addLoginChoice:adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initRegistrationChoice]).get()];
54	break;	54	break;
55	case ClientDataType::Get:	55	case ClientDataType::Get:
56	// FIXME(219710): Adopt new UI for the Platform Authenticator getAssertion flow.	56	if (transports.contains(AuthenticatorTransport::Usb) \|\| transports.contains(AuthenticatorTransport::Nfc))
57	// FIXME(219711): Adopt new UI for the Security Key getAssertion flow.	57	[presentationContext addLoginChoice:adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initAssertionPlaceholderChoice]).get()];
58	break;	58	break;
59	default:	59	default:
60	ASSERT_NOT_REACHED();	60	ASSERT_NOT_REACHED();
Lines 90-99 void AuthenticatorPresenterCoordinator::requestPin(uint64_t, CompletionHandler<v a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm_sec4
90	// FIXME(219712): Adopt new UI for the Client PIN flow.	90	// FIXME(219712): Adopt new UI for the Client PIN flow.
91	}	91	}
92		92
93	void AuthenticatorPresenterCoordinator::selectAssertionResponse(Vector<Ref<AuthenticatorAssertionResponse>>&&, WebAuthenticationSource, CompletionHandler<void(AuthenticatorAssertionResponse*)>&&)	93	void AuthenticatorPresenterCoordinator::selectAssertionResponse(Vector<Ref<AuthenticatorAssertionResponse>>&& responses, WebAuthenticationSource source, CompletionHandler<void(AuthenticatorAssertionResponse*)>&& completionHandler)
94	{	94	{
		95	#if HAVE(ASC_AUTH_UI)
		96	if (m_responseHandler)
		97	m_responseHandler(nullptr);
		98	m_responseHandler = WTFMove(completionHandler);
		99
		100	if (source == WebAuthenticationSource::External) {
		101	auto loginChoices = adoptNS([[NSMutableArray alloc] init]);
		102
		103	for (auto& response : responses) {
		104	RetainPtr<NSData> userHandle;
		105	if (response->userHandle())
		106	userHandle = adoptNS([[NSData alloc] initWithBytes:response->userHandle()->data() length:response->userHandle()->byteLength()]);
		107
		108	auto loginChoice = adoptNS([allocASCSecurityKeyPublicKeyCredentialLoginChoiceInstance() initWithName:response->name() displayName:response->displayName() userHandle:userHandle.get()]);
		109	[loginChoices addObject:loginChoice.get()];
		110
		111	m_credentials.add((ASCLoginChoiceProtocol *)loginChoice.get(), response.ptr());
		112	}
		113
		114	[m_presenter updateInterfaceWithLoginChoices:loginChoices.get()];
		115	return;
		116	}
95	// FIXME(219710): Adopt new UI for the Platform Authenticator getAssertion flow.	117	// FIXME(219710): Adopt new UI for the Platform Authenticator getAssertion flow.
96	// FIXME(219711): Adopt new UI for the Security Key getAssertion flow.	118	#endif // HAVE(ASC_AUTH_UI)
97	}	119	}
98		120
99	void AuthenticatorPresenterCoordinator::requestLAContextForUserVerification(CompletionHandler<void(LAContext *)>&& completionHandler)	121	void AuthenticatorPresenterCoordinator::requestLAContextForUserVerification(CompletionHandler<void(LAContext *)>&& completionHandler)
Lines 125-130 void AuthenticatorPresenterCoordinator::setLAContext(LAContext *context) a/Source/WebKit/UIProcess/WebAuthentication/Cocoa/AuthenticatorPresenterCoordinator.mm_sec5
125	m_laContext = context;	147	m_laContext = context;
126	}	148	}
127		149
		150	void AuthenticatorPresenterCoordinator::didSelectAssertionResponse(ASCLoginChoiceProtocol *loginChoice)
		151	{
		152	auto* response = m_credentials.take(loginChoice);
		153	if (!response)
		154	return;
		155
		156	m_responseHandler(response);
		157	}
		158
128	} // namespace WebKit	159	} // namespace WebKit
129		160
130	#endif // ENABLE(WEB_AUTHN)	161	#endif // ENABLE(WEB_AUTHN)