Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
# POSSIBILITY OF SUCH DAMAGE.
"""
Connects to each FIDO device found, and causes them all to blink until the user
triggers one to select it. A new credential is created for that authenticator,
and the operation is cancelled for the others.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice, STATUS
from fido2.client import Fido2Client, ClientError
from threading import Event, Thread
import sys
# Locate a device
devs = list(CtapHidDevice.list_devices())
if not devs:
print("No FIDO device found")
sys.exit(1)
clients = [Fido2Client(d, "https://example.com") for d in devs]
# Prepare parameters for makeCredential
rp = {"id": "example.com", "name": "Example RP"}
user = {"id": b"user_id", "name": "A. User"}
challenge = b"Y2hhbGxlbmdl"
cancel = Event()
attestation, client_data = None, None
has_prompted = False
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client, WindowsClient
from fido2.server import Fido2Server
from getpass import getpass
import sys
use_prompt = False
pin = None
uv = "discouraged"
if WindowsClient.is_available():
# Use the Windows WebAuthn API if available
client = WindowsClient("https://example.com")
else:
# Locate a device
dev = next(CtapHidDevice.list_devices(), None)
if dev is not None:
print("Use USB HID channel.")
use_prompt = True
else:
try:
from fido2.pcsc import CtapPcscDevice
dev = next(CtapPcscDevice.list_devices(), None)
print("Use NFC channel.")
except Exception as e:
print("NFC channel search error:", e)
if not dev:
print("No FIDO device found")
sys.exit(1)
Connects to the first FIDO device found (starts from USB, then looks into NFC),
creates a new credential for it, and authenticates the credential.
This works with both FIDO 2.0 devices as well as with U2F devices.
"""
from __future__ import print_function, absolute_import, unicode_literals
from fido2.hid import CtapHidDevice
from fido2.client import Fido2Client
from fido2.attestation import Attestation
from getpass import getpass
import sys
use_nfc = False
# Locate a device
dev = next(CtapHidDevice.list_devices(), None)
if dev is not None:
print("Use USB HID channel.")
else:
try:
from fido2.pcsc import CtapPcscDevice
dev = next(CtapPcscDevice.list_devices(), None)
print("Use NFC channel.")
use_nfc = True
except Exception as e:
print("NFC channel search error:", e)
if not dev:
print("No FIDO device found")
sys.exit(1)
def enumerate_devices():
for dev in CtapHidDevice.list_devices():
yield dev
if CtapPcscDevice:
for dev in CtapPcscDevice.list_devices():
yield dev
def open_devices():
for dev in CtapHidDevice.list_devices(descriptor_filter):
try:
yield FidoDriver(dev)
except Exception as e:
logger.debug('Failed opening FIDO device', exc_info=e)
def okta_mfa_webauthn(conf, factor, state_token):
# type: (Conf, Dict[str, str], str) -> Optional[Dict[str, Any]]
if not have_fido:
err('Need fido2 package(s) for webauthn. Consider doing `pip install fido2` (or similar)')
devices = list(CtapHidDevice.list_devices())
if not devices:
err('webauthn configured, but no U2F devices found')
provider = factor.get('provider', '')
log('mfa {0} challenge request [okta_url]'.format(provider))
data = {
'stateToken': state_token
}
_, _h, j = send_json_req(conf, 'okta', 'webauthn mfa challenge', factor.get('url', ''), data, expected_url=conf.okta_url)
rfactor = j['_embedded']['factor']
profile = rfactor['profile']
purl = parse_url(conf.okta_url)
origin = '{0}://{1}'.format(purl[0], purl[1])
challenge = rfactor['_embedded']['challenge']['challenge']
credentialId = websafe_decode(profile['credentialId'])
allow_list = [{'type': 'public-key', 'id': credentialId}]
for dev in devices:
response.text
)
)
if json_response['response']['status_code'] in ['pushed', 'answered', 'allow']:
return duo_transaction_id
if json_response['response']['status_code'] == 'u2f_sent' and len(json_response['response']['u2f_sign_request']) > 0:
u2f_sign_requests = json_response['response']['u2f_sign_request']
# appId, challenge and session is the same for all requests, get them from the first
u2f_app_id = u2f_sign_requests[0]['appId']
u2f_challenge = u2f_sign_requests[0]['challenge']
u2f_session_id = u2f_sign_requests[0]['sessionId']
devices = list(CtapHidDevice.list_devices())
if CtapPcscDevice:
devices.extend(list(CtapPcscDevice.list_devices()))
if not devices:
click.echo("No FIDO U2F authenticator is eligible.")
return "cancelled"
threads = []
u2f_response = {
"sessionId": u2f_session_id
}
rq = queue.Queue()
cancel = Event()
for device in devices:
t = Thread(
target=_u2f_sign,
def u2f_authenticate(authenticateRequests):
# type: ([dict]) -> dict or None
global should_cancel_u2f
global u2f_response
if not authenticateRequests:
return None
devices = list(CtapHidDevice.list_devices())
if not devices:
return None
to_auth = []
for i in range(len(devices)):
u2f_client = CTAP1(devices[i])
u2f_version = u2f_client.get_version()
for request in authenticateRequests:
try:
version = request['version']
if version == u2f_version:
app_id = request['appId']
challenge = request['challenge']
key_handle = base64.urlsafe_b64decode(request['keyHandle'] + '==')
app_id_hash = sha256(app_id.encode('ascii')).digest()
cl_data = {