[v15] Add UserVerification capabilities to LoginFlow #38487
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* Disallow the passwordless scope on regular LoginFlow * fix: Use the correct `t` for assertions * nit: Fix test target name * Add UserVerificationRequirement to ChallengeExtensions * Update generated protos * Add user verification support to LoginFlow * nit: Add my scopes TODO * Change user_verification_requirement to a string * nit: Use slices.Clone * Tweak disallowed scope error message
|
The PR changelog entry failed validation: Changelog entry not found in the PR body. Please add a "no-changelog" label to the PR, or changelog lines starting with |
codingllama
added
the
no-changelog
rosstimothy
approved these changes
Feb 21, 2024
bl-nero
approved these changes
Feb 21, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport #37963 to branch/v15.
Add user verification capabilities to "logged in" challenges, as in those issued by wanlib.LoginFlow.
We take advantage of mfav1.ChallengeExtensions by adding a user verification option that is orthogonal to the challenge scope, so that challenges may be issued with or without UV requirements based on external factors (like the user actually having a password).
LoginFlow is used for those challenges, instead of PasswordlessFlow, as the former already works with the logged in user, issues challenges with a larger timeout and has all the correct parameters in its API. PasswordlessFlow is meant only for discoverable logins, as in logins where the user is not yet known.
This is related to and meant to facilitate RFD 0159 - Password Status.