feat(webauthn): Skip 2FA for user verified logins

A WebAuthn login with user verification is already a second factor,
so do not ask for an additional 2FA challenge

Signed-off-by: Michel Le Bihan <michel@lebihan.pl>

Author: mimi89999

core/Controller/WebAuthnController.php

@@ -77,18 +77,19 @@ public function finishAuthentication(string $data): JSONResponse {
 		// Obtain the publicKeyCredentialOptions from when we started the registration
 		$publicKeyCredentialRequestOptions = PublicKeyCredentialRequestOptions::createFromString($this->session->get(self::WEBAUTHN_LOGIN));
 		$uid = $this->session->get(self::WEBAUTHN_LOGIN_UID);
-		$this->webAuthnManger->finishAuthentication($publicKeyCredentialRequestOptions, $data, $uid);
+		$authenticatorData = $this->webAuthnManger->finishAuthentication($publicKeyCredentialRequestOptions, $data, $uid);
 
 		//TODO: add other parameters
 		$loginData = new LoginData(
 			$this->request,
 			$uid,
 			''
 		);
-		$this->webAuthnChain->process($loginData);
+		$loginData->setWebAuthnUserVerified($authenticatorData->isUserVerified());
+		$result = $this->webAuthnChain->process($loginData);
 
 		return new JSONResponse([
-			'defaultRedirectUrl' => $this->urlGenerator->linkToDefaultPageUrl(),
+			'defaultRedirectUrl' => $result->getRedirectUrl() ?? $this->urlGenerator->linkToDefaultPageUrl(),
 		]);
 	}
 }

lib/private/Authentication/Login/LoginData.php

@@ -16,6 +16,13 @@ class LoginData {
 	/** @var IUser|false|null */
 	private $user = null;
 
+	/**
+	 * True when this login was performed via WebAuthn *and* the authenticator
+	 * verified the user (PIN, biometrics, …), which makes the login itself a
+	 * multi-factor authentication.
+	 */
+	private bool $webAuthnUserVerified = false;
+
 	public function __construct(
 		private IRequest $request,
 		private string $username,
@@ -76,4 +83,12 @@ public function setRememberLogin(bool $rememberLogin): void {
 	public function isRememberLogin(): bool {
 		return $this->rememberLogin;
 	}
+
+	public function setWebAuthnUserVerified(bool $webAuthnUserVerified): void {
+		$this->webAuthnUserVerified = $webAuthnUserVerified;
+	}
+
+	public function isWebAuthnUserVerified(): bool {
+		return $this->webAuthnUserVerified;
+	}
 }

lib/private/Authentication/Login/TwoFactorCommand.php

@@ -25,7 +25,10 @@ public function __construct(
 
 	#[\Override]
 	public function process(LoginData $loginData): LoginResult {
-		if (!$this->twoFactorManager->isTwoFactorAuthenticated($loginData->getUser())) {
+		// A WebAuthn login with user verification combines possession of the
+		// authenticator with a PIN or a biometric, so it is a second factor already
+		if ($loginData->isWebAuthnUserVerified()
+			|| !$this->twoFactorManager->isTwoFactorAuthenticated($loginData->getUser())) {
 			return $this->processNextOrFinishSuccessfully($loginData);
 		}
 

lib/private/Authentication/WebAuthn/Manager.php

@@ -27,6 +27,7 @@
 use Webauthn\AuthenticatorAssertionResponseValidator;
 use Webauthn\AuthenticatorAttestationResponse;
 use Webauthn\AuthenticatorAttestationResponseValidator;
+use Webauthn\AuthenticatorData;
 use Webauthn\AuthenticatorSelectionCriteria;
 use Webauthn\PublicKeyCredentialCreationOptions;
 use Webauthn\PublicKeyCredentialDescriptor;
@@ -168,7 +169,7 @@ public function startAuthentication(string $uid, string $serverHost): PublicKeyC
 		);
 	}
 
-	public function finishAuthentication(PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions, string $data, string $uid) {
+	public function finishAuthentication(PublicKeyCredentialRequestOptions $publicKeyCredentialRequestOptions, string $data, string $uid): AuthenticatorData {
 		$attestationStatementSupportManager = new AttestationStatementSupportManager();
 		$attestationStatementSupportManager->add(new NoneAttestationStatementSupport());
 
@@ -216,7 +217,7 @@ public function finishAuthentication(PublicKeyCredentialRequestOptions $publicKe
 			throw $e;
 		}
 
-		return true;
+		return $response->authenticatorData;
 	}
 
 	public function deleteRegistration(IUser $user, int $id): void {

tests/lib/Authentication/Login/TwoFactorCommandTest.php

@@ -56,6 +56,41 @@ public function testNotTwoFactorAuthenticated(): void {
 		$this->assertTrue($result->isSuccess());
 	}
 
+	public function testSkippedForVerifiedWebAuthnLogin(): void {
+		$data = $this->getLoggedInLoginData();
+		$data->setWebAuthnUserVerified(true);
+		$this->twoFactorManager->expects($this->never())
+			->method('prepareTwoFactorLogin');
+
+		$result = $this->cmd->process($data);
+
+		$this->assertTrue($result->isSuccess());
+		$this->assertNull($result->getRedirectUrl());
+	}
+
+	public function testNotSkippedForWebAuthnLoginWithoutUserVerification(): void {
+		$data = $this->getLoggedInLoginData();
+		$data->setWebAuthnUserVerified(false);
+		$this->twoFactorManager->expects($this->once())
+			->method('isTwoFactorAuthenticated')
+			->willReturn(true);
+		$this->twoFactorManager->expects($this->once())
+			->method('prepareTwoFactorLogin');
+		$this->twoFactorManager->expects($this->once())
+			->method('getProviderSet')
+			->willReturn(new ProviderSet([], false));
+		$this->twoFactorManager->expects($this->once())
+			->method('getLoginSetupProviders')
+			->willReturn([]);
+		$this->urlGenerator->expects($this->once())
+			->method('linkToRoute')
+			->willReturn('two/factor/url');
+
+		$result = $this->cmd->process($data);
+
+		$this->assertEquals('two/factor/url', $result->getRedirectUrl());
+	}
+
 	public function testProcessOneActiveProvider(): void {
 		$data = $this->getLoggedInLoginData();
 		$this->twoFactorManager->expects($this->once())