Yubikey: converted U2F keys
@@ -15,7 +15,8 @@ import threading
import time
from typing import Optional, Callable, Union
-from fido2.client import U2fClient, Fido2Client, WindowsClient
+from fido2.client import U2fClient, Fido2Client, WindowsClient, ClientError
+from fido2.ctap import CtapError
from fido2.hid import CtapHidDevice
from fido2.webauthn import PublicKeyCredentialRequestOptions, AuthenticatorAssertionResponse
from prompt_toolkit import PromptSession
@@ -23,6 +24,10 @@ from prompt_toolkit import PromptSession
from .. import utils
+def verify_rp_id_none(rp_id, origin):
+ return True
+
+
def yubikey_authenticate(request): # type: (dict) -> Optional[dict]
auth_func = None # type: Optional[Callable[[], Union[AuthenticatorAssertionResponse, dict, None]]]
evt = threading.Event()
@@ -63,19 +68,40 @@ def yubikey_authenticate(request): # type: (dict) -> Optional[dict]
rq_options = PublicKeyCredentialRequestOptions(utils.base64_url_decode(options['challenge']),
rp_id=options['rpId'], user_verification='discouraged',
allow_credentials=credentials)
+
if WindowsClient.is_available():
- client = WindowsClient(origin)
+ client = WindowsClient(origin, verify=verify_rp_id_none)
else:
dev = next(CtapHidDevice.list_devices(), None)
if not dev:
logging.warning("No Security Key detected")
return
- client = Fido2Client(dev, origin)
+ client = Fido2Client(dev, origin, verify=verify_rp_id_none)
def auth_func():
nonlocal response
+ nonlocal rq_options
+ attempt = 0
+ while attempt < 2:
+ attempt += 1
+ try:
rs = client.get_assertion(rq_options, event=evt)
response = rs.get_response(0)
+ break
+ except ClientError as err:
+ if isinstance(err.cause, CtapError) and attempt == 1:
+ if err.cause.code == CtapError.ERR.NO_CREDENTIALS:
+ print('\n\nKeeper Security stopped supporting U2F security keys starting February 2022.\n'
+ 'If you registered your security key prior to this date please re-register it within the Web Vault.\n'
+ 'For information on using security keys with Keeper see the documentation: \n'
+ 'https://docs.keeper.io/enterprise-guide/two-factor-authentication#security-keys-fido-webauthn\n'
+ 'Commander will use the fallback security key authentication method.\n\n'
+ 'To use your Yubikey with Commander, please touch the flashing Security key one more time.\n')
+ rq_options = PublicKeyCredentialRequestOptions(
+ utils.base64_url_decode(options['challenge']), rp_id=origin, user_verification='discouraged',
+ allow_credentials=credentials)
+ continue
+ raise err
else:
logging.warning('Invalid Security Key request')
return
