Ankur Mhatre
6535ca9343
Fourth Maven project in the repository. Registration and authentication run end to end with no browser and no hardware key: VirtualAuthenticator emits real CBOR attestation objects and real ES256 assertion signatures, and tools/PasskeyCeremony.java drives the live HTTP endpoints with them. Profiles cover userVerification REQUIRED, DIRECT attestation, a disallowed origin and JDBC persistence. Eleven doc chapters and twelve captured transcripts under docs/passkeys and docs/output/pk-*.txt, all regenerated by passkeys/scripts/run-all.sh.
8 lines
325 B
YAML
8 lines
325 B
YAML
# Ask the authenticator for DIRECT attestation instead of the default NONE.
|
|
#
|
|
# Registration still succeeds against an authenticator that answers with fmt "none" and an
|
|
# all-zero AAGUID, because the default WebAuthnManager verifies no attestation statement at
|
|
# all. Asking is not checking.
|
|
demo:
|
|
attestation-direct: true
|