Draft: Webauthn

backend/file/file.go

@@ -23,18 +23,29 @@ type fileUser struct {
 	TOTPSecret        string   `yaml:"totp_secret"`
 	Groups            []string `yaml:"groups"`
 
-	// WebAuthN/U2F registrations are encoded in a similar format
-	// as the one produced by 'pamu2fcfg': the key handle is
-	// base64-encoded (this is "websafe" base64, without padding),
-	// the public key is hex encoded.
-	WebAuthnRegistrations []struct {
+	// Legacy U2F registrations are encoded in a similar format as
+	// the one produced by old versions of 'pamu2fcfg': the key
+	// handle is base64-encoded (this is "websafe" base64, without
+	// padding), the public key is hex encoded.
+	U2FRegistrations []struct {
 		KeyHandle string `yaml:"key_handle"`
 		PublicKey string `yaml:"public_key"`
+		Comment   string `yaml:"comment"`
 	} `yaml:"u2f_registrations"`
 
+	// WebAuthN registrations are encoded as emitted by modern
+	// versions of pamu2fcfg: both values are base64-encoded
+	// (standard, with padding). The key is actually in COSE format.
+	WebAuthNRegistrations []struct {
+		KeyHandle string `yaml:"key_handle"`
+		PublicKey string `yaml:"public_key"`
+		Comment   string `yaml:"comment"`
+	} `yaml:"webauthn_registrations"`
+
 	AppSpecificPasswords []struct {
 		Service           string `yaml:"service"`
 		EncryptedPassword string `yaml:"password"`
+		Comment           string `yaml:"comment"`
 	} `yaml:"app_specific_passwords"`
 }
 
@@ -55,8 +66,23 @@ func (f *fileUser) toUser(filename string) *backend.User {
 		})
 	}
 
-	for _, r := range f.WebAuthnRegistrations {
+	for _, r := range f.WebAuthNRegistrations {
 		reg, err := ct.ParseU2FRegistrationFromStrings(r.KeyHandle, r.PublicKey)
+		if err != nil {
+			log.Printf("warning: %s: user %s: could not decode WebAuthN registration: %v", filename, f.Name, err)
+			continue
+		}
+
+		cred, err := reg.Decode()
+		if err != nil {
+			log.Printf("warning: %s: user %s: could not decode WebAuthN registration: %v", filename, f.Name, err)
+			continue
+		}
+		u.WebAuthnRegistrations = append(u.WebAuthnRegistrations, cred)
+	}
+
+	for _, r := range f.U2FRegistrations {
+		reg, err := ct.ParseLegacyU2FRegistrationFromStrings(r.KeyHandle, r.PublicKey)
 		if err != nil {
 			log.Printf("warning: %s: user %s: could not decode U2F registration: %v", filename, f.Name, err)
 			continue