•  
     
    story #31177 check my identity when doing a risky action
Summary
user
check my identity when doing a risky action

If I'm doing a risky action, I need to assert my identity by using my passkey.

By risky action, I mean : an action that can create a security failure in Tuleap.

For example, I want to add a new ssh key, When clicking on the add button, I'm asked to use my passkey to check my identity. After I confirm it, I can add the the ssh key.


A non-exhaustive list of risky actions :

  • add/delete ssh key in user preferences
  • add/delete access key in user preferences
  • As site administrator, delete one of the passkeys of a user (story #31179)
Empty
Empty
Empty
Status
Authentication & LDAP
Done
Development
  • [ ] Does it involves User Interface? 
  • [ ] Are there any mockups?
  • [ ] Are permissions checked?
  • [ ] Does it need Javascript development?
  • [ ] Does it need a forge upgrade bucket?
  • [ ] Does it need to execute things in system events?
  • [ ] Does it impact project creation (templates)?
  • [ ] Is it exploratory?
  • Implement WebAuthnOptions (create, get) for authentication
  • Add REST route GET /api/webauthn/generate_authentication_options
  • Add REST route POST /api/webauthn/check_authentication
  • Create js library
    • one method to do authentication on current user
  • Use it for manipulating ssh and access keys
Details
#31177
Kevin Traini (ktraini)
2023-07-18 15:25
2023-03-20 12:36
32781

References
Referencing story #31177

Follow-ups

User avatar
Joris MASSON (jmasson)2023-06-28 14:58

gerrit #28818 (feat: webauthn modal advise user then auth is done in target modal) integrated in Tuleap 14.10.99.48


  • Status changed from Done to On going
User avatar
Joris MASSON (jmasson)2023-03-20 14:20
  • So that
    Something went wrong, the follow up content couldn't be loaded
    Only formatting have been changed, you should switch to markup to see the changes
  • As a
    - 
    +user 
  • Permissions set to
User avatar
Kevin Traini (ktraini)2023-03-20 13:56
  • So that
    Something went wrong, the follow up content couldn't be loaded
    Only formatting have been changed, you should switch to markup to see the changes
User avatar
Kevin Traini (ktraini)2023-03-20 12:37
  • Technical informations
    Something went wrong, the follow up content couldn't be loaded
    Only formatting have been changed, you should switch to markup to see the changes
  • Category set to Authentication & LDAP