tree e5d6f0b2b98d4615d280a48e37757f0ed26a09ae
parent 9a9347aa642f3301817d385d1ac37e91510093d1
author Yicheng Li <yichengli@chromium.org> 1606958330 -0800
committer Commit Bot <commit-bot@chromium.org> 1607121544 +0000

u2fd: Don't initialize WebAuthn if u2f is enabled

We want enterprise users who have the legacy cr50 U2F authenticator
(enabled via enterprise policy or debug flags) to continue to use U2F in
the short term, so don't offer WebAuthn platform authenticator. In the
long term, after some plumbing on the browser side, we will call
the WebAuthn interface if a legacy credential is known to be recognized
by cr50.

BUG=chromium:1155335, b:174709984
TEST=Enable U2F and enable ChromeOS WebAuthn feature flag, register PIN,
     restart u2fd
     ==> Logs show WebAuthn handler isn't initialized
     ==> PublicKeyCredential
         .isUserVerifyingPlatformAuthenticatorAvailable()
         .then(console.log) returns false even if PIN is available.
     ==> When attachment=undefined or cross-platform, can use u2fhid to
         do WebAuthn MakeCredential and GetAssertion.
     ==> When attachment=platform, "Your device doesn't support the type
         of security key requested by this site".
TEST=Disable U2F and enable ChromeOS WebAuthn feature flag,
     register PIN, restart u2fd
     => Logs show WebAuthn handler is initialized
     => PublicKeyCredential
        .isUserVerifyingPlatformAuthenticatorAvailable()
        .then(console.log) returns true.
     => When attachment=undefined or cross-platform, u2fhid doesn't show
        up.
     => When attachment=platform, can use ChromeOS PIN to do
        MakeCredential and GetAssertion.

Change-Id: I2513518e6f33aff77d149667dcfe2bdae8747b65
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/2572025
Tested-by: Yicheng Li <yichengli@chromium.org>
Reviewed-by: Andrey Pronin <apronin@chromium.org>
Reviewed-by: Martin Kreichgauer <martinkr@google.com>
Commit-Queue: Yicheng Li <yichengli@chromium.org>