LDAPCon 2019 Sofia

1. Using LDAP directory for
FIDO 2.0
Open Source Solution Technology Corporation
HAMANO Tsukasa <hamano@osstech.co.jp>
LDAPCon 2019 Sofia

2. YubiKey
NEO
Solo
Hacker Solo
keysGoogle
Titan
FEITIAN
BioPass
Yubico
Security Key
Using LDAP directory for FIDO 2.0
Authenticators
1

3. Using LDAP directory for FIDO 2.0
Mt. Витоша
2

4. Using LDAP directory for FIDO 2.0
FIDO2 Flow
• 2-factor with Password
• Password + Authenticator
• Single-factor Password-less
• Authenticator with UserPresence
• Multi-factor Password-less
• Autenticator with UserVerify
• Username-less
• Autenticator with Resident Key
3

5. RP Server
Authenticator
JavaScript
Application
LDAP Repository
Registration
Authentication
add and search
credentials
Browser/App
Client
WebAuthn API
CTAP
Using LDAP directory for FIDO 2.0
Overview
4

6. fido2CredentialID: XXXXXXXX...uid=guest
ou=example,ou=com
ou=Users ou=Credentials
uid=user1
uid=user2
uid=user3
fido2CredentialID: XXXXXXXX...
fido2CredentialID: XXXXXXXX...
fido2CredentialID: XXXXXXXX...
Using LDAP directory for FIDO 2.0
Directory Structure
5

7. Using LDAP directory for FIDO 2.0
LDAP Schema
objectclass ( 1.3.6.1.4.1.34468.2.56.2.1
NAME 'fido2Credential'
DESC 'objectClass for FIDO2 Credential'
SUP top STRUCTURAL
MUST ( fido2CredentialID $ fido2PublicKey $
fido2SignCount $ fido2UserID )
MAY ( fido2RawID $ fido2AAGUID $
fido2CredentialName ))
6

8. Using LDAP directory for FIDO 2.0
Attributes
• fido2CredentialID
• fido2RawID
• fido2PublicKey
• fido2SignCount
• fido2UserID
• fido2AAGUID
• fido2CredentialName
7

9. Using LDAP directory for FIDO 2.0
Why COSE Key
format size
JWK 179 bytes
PKCS#1 PEM 178 bytes
PKCS#1 DER 91 bytes
COSE Key 77 bytes
8

10. Using LDAP directory for FIDO 2.0
What’s user.id
W3C WebAuthn Spec:
the Relying Party SHOULD NOT include personally identifying
information, e.g., e-mail addresses or usernames, in the user handle.
RFC8266 6.1:
To ensure secure operation of applications that use nicknames,
authentication and authorization decisions MUST be made on the basis
of the thing's identity, not its nickname.
9

11. objetctClass: [“fido2Credential”]
fido2CredentialID: XXXXXXXX...
fido2UserID: XXXXXXXX
fido2PublicKey: XXXXXXXXXX...
fido2Counter: 255
fido2AAGUID: 0000000000...
objetctClass: [“account,
extra...”]
uid: guest
fido2UserID: XXXXXXXX
ou=example,ou=com
ou=Users ou=Credentials
Using LDAP directory for FIDO 2.0
Entity mapping(1)
10

12. objetctClass: [“fido2Credential”]
fido2CredentialID: XXXXXXXX...
fido2UserID: XXXXXXXX
fido2PublicKey: XXXXXXXXXX...
fido2Counter: 255
fido2AAGUID: 0000000000...
objetctClass: [“account”]
uid: guest
entryUUID: XXXXXXXX
ou=example,ou=com
ou=Users ou=Credentials
Using LDAP directory for FIDO 2.0
Entity Mapping(2)
11

13. Using LDAP directory for FIDO 2.0
Demonstration
https://demo.osstech.co.jp
Username: guest
Password: guest
12

14. Using LDAP directory for FIDO 2.0
Try your self
$ git clone
https://github.com/osstech-jp/fido2-ldap-demo.git
$ cd fido2-ldap-demo
$ docker-compose up --build
13

15. Using LDAP directory for FIDO 2.0
Resource
• Demo server
• https://demo.osstech.co.jp/
• FIDO2 schema & Demo server source
• https://github.com/osstech-jp/fido2-ldap-demo/
• Blog
• https://www.osstech.co.jp/~hamano/posts/fido2-ldap/
14