зеркало из https://github.com/mozilla/gecko-dev.git
707 строки
28 KiB
C
707 строки
28 KiB
C
// Copyright (c) Microsoft Corporation. All rights reserved.
|
|
// Licensed under the MIT License.
|
|
|
|
#ifndef __WEBAUTHN_H_
|
|
#define __WEBAUTHN_H_
|
|
|
|
#pragma once
|
|
|
|
#include <winapifamily.h>
|
|
|
|
#pragma region Desktop Family or OneCore Family
|
|
#if WINAPI_FAMILY_PARTITION(WINAPI_PARTITION_APP | WINAPI_PARTITION_SYSTEM)
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
#ifndef WINAPI
|
|
#define WINAPI __stdcall
|
|
#endif
|
|
|
|
#ifndef INITGUID
|
|
#define INITGUID
|
|
#include <guiddef.h>
|
|
#undef INITGUID
|
|
#else
|
|
#include <guiddef.h>
|
|
#endif
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// API Version Information.
|
|
// Caller should check for WebAuthNGetApiVersionNumber to check the presence of relevant APIs
|
|
// and features for their usage.
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_API_VERSION_1 1
|
|
// WEBAUTHN_API_VERSION_1 : Baseline Version
|
|
// Data Structures and their sub versions:
|
|
// - WEBAUTHN_RP_ENTITY_INFORMATION : 1
|
|
// - WEBAUTHN_USER_ENTITY_INFORMATION : 1
|
|
// - WEBAUTHN_CLIENT_DATA : 1
|
|
// - WEBAUTHN_COSE_CREDENTIAL_PARAMETER : 1
|
|
// - WEBAUTHN_COSE_CREDENTIAL_PARAMETERS : Not Applicable
|
|
// - WEBAUTHN_CREDENTIAL : 1
|
|
// - WEBAUTHN_CREDENTIALS : Not Applicable
|
|
// - WEBAUTHN_CREDENTIAL_EX : 1
|
|
// - WEBAUTHN_CREDENTIAL_LIST : Not Applicable
|
|
// - WEBAUTHN_EXTENSION : Not Applicable
|
|
// - WEBAUTHN_EXTENSIONS : Not Applicable
|
|
// - WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS : 3
|
|
// - WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS : 4
|
|
// - WEBAUTHN_COMMON_ATTESTATION : 1
|
|
// - WEBAUTHN_CREDENTIAL_ATTESTATION : 3
|
|
// - WEBAUTHN_ASSERTION : 1
|
|
// Extensions:
|
|
// - WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET
|
|
// APIs:
|
|
// - WebAuthNGetApiVersionNumber
|
|
// - WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable
|
|
// - WebAuthNAuthenticatorMakeCredential
|
|
// - WebAuthNAuthenticatorGetAssertion
|
|
// - WebAuthNFreeCredentialAttestation
|
|
// - WebAuthNFreeAssertion
|
|
// - WebAuthNGetCancellationId
|
|
// - WebAuthNCancelCurrentOperation
|
|
// - WebAuthNGetErrorName
|
|
// - WebAuthNGetW3CExceptionDOMError
|
|
|
|
#define WEBAUTHN_API_VERSION_2 2
|
|
// WEBAUTHN_API_VERSION_2 : Delta From WEBAUTHN_API_VERSION_1
|
|
// Added Extensions:
|
|
// - WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT
|
|
//
|
|
|
|
#define WEBAUTHN_API_CURRENT_VERSION WEBAUTHN_API_VERSION_2
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about an RP Entity
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_RP_ENTITY_INFORMATION_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_RP_ENTITY_INFORMATION {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
// This field is required and should be set to CURRENT_VERSION above.
|
|
DWORD dwVersion;
|
|
|
|
// Identifier for the RP. This field is required.
|
|
PCWSTR pwszId;
|
|
|
|
// Contains the friendly name of the Relying Party, such as "Acme Corporation", "Widgets Inc" or "Awesome Site".
|
|
// This field is required.
|
|
PCWSTR pwszName;
|
|
|
|
// Optional URL pointing to RP's logo.
|
|
PCWSTR pwszIcon;
|
|
} WEBAUTHN_RP_ENTITY_INFORMATION, *PWEBAUTHN_RP_ENTITY_INFORMATION;
|
|
typedef const WEBAUTHN_RP_ENTITY_INFORMATION *PCWEBAUTHN_RP_ENTITY_INFORMATION;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about an User Entity
|
|
//-------------------------------------------------------------------------------------------
|
|
#define WEBAUTHN_MAX_USER_ID_LENGTH 64
|
|
|
|
#define WEBAUTHN_USER_ENTITY_INFORMATION_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_USER_ENTITY_INFORMATION {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
// This field is required and should be set to CURRENT_VERSION above.
|
|
DWORD dwVersion;
|
|
|
|
// Identifier for the User. This field is required.
|
|
DWORD cbId;
|
|
_Field_size_bytes_(cbId)
|
|
PBYTE pbId;
|
|
|
|
// Contains a detailed name for this account, such as "john.p.smith@example.com".
|
|
PCWSTR pwszName;
|
|
|
|
// Optional URL that can be used to retrieve an image containing the user's current avatar,
|
|
// or a data URI that contains the image data.
|
|
PCWSTR pwszIcon;
|
|
|
|
// For User: Contains the friendly name associated with the user account by the Relying Party, such as "John P. Smith".
|
|
PCWSTR pwszDisplayName;
|
|
} WEBAUTHN_USER_ENTITY_INFORMATION, *PWEBAUTHN_USER_ENTITY_INFORMATION;
|
|
typedef const WEBAUTHN_USER_ENTITY_INFORMATION *PCWEBAUTHN_USER_ENTITY_INFORMATION;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about client data.
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_HASH_ALGORITHM_SHA_256 L"SHA-256"
|
|
#define WEBAUTHN_HASH_ALGORITHM_SHA_384 L"SHA-384"
|
|
#define WEBAUTHN_HASH_ALGORITHM_SHA_512 L"SHA-512"
|
|
|
|
#define WEBAUTHN_CLIENT_DATA_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_CLIENT_DATA {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
// This field is required and should be set to CURRENT_VERSION above.
|
|
DWORD dwVersion;
|
|
|
|
// Size of the pbClientDataJSON field.
|
|
DWORD cbClientDataJSON;
|
|
// UTF-8 encoded JSON serialization of the client data.
|
|
_Field_size_bytes_(cbClientDataJSON)
|
|
PBYTE pbClientDataJSON;
|
|
|
|
// Hash algorithm ID used to hash the pbClientDataJSON field.
|
|
LPCWSTR pwszHashAlgId;
|
|
} WEBAUTHN_CLIENT_DATA, *PWEBAUTHN_CLIENT_DATA;
|
|
typedef const WEBAUTHN_CLIENT_DATA *PCWEBAUTHN_CLIENT_DATA;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about credential parameters.
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_CREDENTIAL_TYPE_PUBLIC_KEY L"public-key"
|
|
|
|
#define WEBAUTHN_COSE_ALGORITHM_ECDSA_P256_WITH_SHA256 -7
|
|
#define WEBAUTHN_COSE_ALGORITHM_ECDSA_P384_WITH_SHA384 -35
|
|
#define WEBAUTHN_COSE_ALGORITHM_ECDSA_P521_WITH_SHA512 -36
|
|
|
|
#define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA256 -257
|
|
#define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA384 -258
|
|
#define WEBAUTHN_COSE_ALGORITHM_RSASSA_PKCS1_V1_5_WITH_SHA512 -259
|
|
|
|
#define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA256 -37
|
|
#define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA384 -38
|
|
#define WEBAUTHN_COSE_ALGORITHM_RSA_PSS_WITH_SHA512 -39
|
|
|
|
#define WEBAUTHN_COSE_CREDENTIAL_PARAMETER_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_COSE_CREDENTIAL_PARAMETER {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Well-known credential type specifying a credential to create.
|
|
LPCWSTR pwszCredentialType;
|
|
|
|
// Well-known COSE algorithm specifying the algorithm to use for the credential.
|
|
LONG lAlg;
|
|
} WEBAUTHN_COSE_CREDENTIAL_PARAMETER, *PWEBAUTHN_COSE_CREDENTIAL_PARAMETER;
|
|
typedef const WEBAUTHN_COSE_CREDENTIAL_PARAMETER *PCWEBAUTHN_COSE_CREDENTIAL_PARAMETER;
|
|
|
|
typedef struct _WEBAUTHN_COSE_CREDENTIAL_PARAMETERS {
|
|
DWORD cCredentialParameters;
|
|
_Field_size_(cCredentialParameters)
|
|
PWEBAUTHN_COSE_CREDENTIAL_PARAMETER pCredentialParameters;
|
|
} WEBAUTHN_COSE_CREDENTIAL_PARAMETERS, *PWEBAUTHN_COSE_CREDENTIAL_PARAMETERS;
|
|
typedef const WEBAUTHN_COSE_CREDENTIAL_PARAMETERS *PCWEBAUTHN_COSE_CREDENTIAL_PARAMETERS;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about credential.
|
|
//-------------------------------------------------------------------------------------------
|
|
#define WEBAUTHN_CREDENTIAL_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_CREDENTIAL {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Size of pbID.
|
|
DWORD cbId;
|
|
// Unique ID for this particular credential.
|
|
_Field_size_bytes_(cbId)
|
|
PBYTE pbId;
|
|
|
|
// Well-known credential type specifying what this particular credential is.
|
|
LPCWSTR pwszCredentialType;
|
|
} WEBAUTHN_CREDENTIAL, *PWEBAUTHN_CREDENTIAL;
|
|
typedef const WEBAUTHN_CREDENTIAL *PCWEBAUTHN_CREDENTIAL;
|
|
|
|
typedef struct _WEBAUTHN_CREDENTIALS {
|
|
DWORD cCredentials;
|
|
_Field_size_(cCredentials)
|
|
PWEBAUTHN_CREDENTIAL pCredentials;
|
|
} WEBAUTHN_CREDENTIALS, *PWEBAUTHN_CREDENTIALS;
|
|
typedef const WEBAUTHN_CREDENTIALS *PCWEBAUTHN_CREDENTIALS;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about credential with extra information, such as, dwTransports
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_CTAP_TRANSPORT_USB 0x00000001
|
|
#define WEBAUTHN_CTAP_TRANSPORT_NFC 0x00000002
|
|
#define WEBAUTHN_CTAP_TRANSPORT_BLE 0x00000004
|
|
#define WEBAUTHN_CTAP_TRANSPORT_TEST 0x00000008
|
|
#define WEBAUTHN_CTAP_TRANSPORT_INTERNAL 0x00000010
|
|
#define WEBAUTHN_CTAP_TRANSPORT_FLAGS_MASK 0x0000001F
|
|
|
|
#define WEBAUTHN_CREDENTIAL_EX_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_CREDENTIAL_EX {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Size of pbID.
|
|
DWORD cbId;
|
|
// Unique ID for this particular credential.
|
|
_Field_size_bytes_(cbId)
|
|
PBYTE pbId;
|
|
|
|
// Well-known credential type specifying what this particular credential is.
|
|
LPCWSTR pwszCredentialType;
|
|
|
|
// Transports. 0 implies no transport restrictions.
|
|
DWORD dwTransports;
|
|
} WEBAUTHN_CREDENTIAL_EX, *PWEBAUTHN_CREDENTIAL_EX;
|
|
typedef const WEBAUTHN_CREDENTIAL_EX *PCWEBAUTHN_CREDENTIAL_EX;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about credential list with extra information
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
typedef struct _WEBAUTHN_CREDENTIAL_LIST {
|
|
DWORD cCredentials;
|
|
_Field_size_(cCredentials)
|
|
PWEBAUTHN_CREDENTIAL_EX *ppCredentials;
|
|
} WEBAUTHN_CREDENTIAL_LIST, *PWEBAUTHN_CREDENTIAL_LIST;
|
|
typedef const WEBAUTHN_CREDENTIAL_LIST *PCWEBAUTHN_CREDENTIAL_LIST;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Hmac-Secret extension
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET L"hmac-secret"
|
|
// Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_HMAC_SECRET
|
|
// MakeCredential Input Type: BOOL.
|
|
// - pvExtension must point to a BOOL with the value TRUE.
|
|
// - cbExtension must contain the sizeof(BOOL).
|
|
// MakeCredential Output Type: BOOL.
|
|
// - pvExtension will point to a BOOL with the value TRUE if credential
|
|
// was successfully created with HMAC_SECRET.
|
|
// - cbExtension will contain the sizeof(BOOL).
|
|
// GetAssertion Input Type: Not Supported
|
|
// GetAssertion Output Type: Not Supported
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// credProtect extension
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_USER_VERIFICATION_ANY 0
|
|
#define WEBAUTHN_USER_VERIFICATION_OPTIONAL 1
|
|
#define WEBAUTHN_USER_VERIFICATION_OPTIONAL_WITH_CREDENTIAL_ID_LIST 2
|
|
#define WEBAUTHN_USER_VERIFICATION_REQUIRED 3
|
|
|
|
typedef struct _WEBAUTHN_CRED_PROTECT_EXTENSION_IN {
|
|
// One of the above WEBAUTHN_USER_VERIFICATION_* values
|
|
DWORD dwCredProtect;
|
|
// Set the following to TRUE to require authenticator support for the credProtect extension
|
|
BOOL bRequireCredProtect;
|
|
} WEBAUTHN_CRED_PROTECT_EXTENSION_IN, *PWEBAUTHN_CRED_PROTECT_EXTENSION_IN;
|
|
typedef const WEBAUTHN_CRED_PROTECT_EXTENSION_IN *PCWEBAUTHN_CRED_PROTECT_EXTENSION_IN;
|
|
|
|
|
|
#define WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT L"credProtect"
|
|
// Below type definitions is for WEBAUTHN_EXTENSIONS_IDENTIFIER_CRED_PROTECT
|
|
// MakeCredential Input Type: WEBAUTHN_CRED_PROTECT_EXTENSION_IN.
|
|
// - pvExtension must point to a WEBAUTHN_CRED_PROTECT_EXTENSION_IN struct
|
|
// - cbExtension will contain the sizeof(WEBAUTHN_CRED_PROTECT_EXTENSION_IN).
|
|
// MakeCredential Output Type: DWORD.
|
|
// - pvExtension will point to a DWORD with one of the above WEBAUTHN_USER_VERIFICATION_* values
|
|
// if credential was successfully created with CRED_PROTECT.
|
|
// - cbExtension will contain the sizeof(DWORD).
|
|
// GetAssertion Input Type: Not Supported
|
|
// GetAssertion Output Type: Not Supported
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Information about Extensions.
|
|
//-------------------------------------------------------------------------------------------
|
|
typedef struct _WEBAUTHN_EXTENSION {
|
|
LPCWSTR pwszExtensionIdentifier;
|
|
DWORD cbExtension;
|
|
PVOID pvExtension;
|
|
} WEBAUTHN_EXTENSION, *PWEBAUTHN_EXTENSION;
|
|
typedef const WEBAUTHN_EXTENSION *PCWEBAUTHN_EXTENSION;
|
|
|
|
typedef struct _WEBAUTHN_EXTENSIONS {
|
|
DWORD cExtensions;
|
|
_Field_size_(cExtensions)
|
|
PWEBAUTHN_EXTENSION pExtensions;
|
|
} WEBAUTHN_EXTENSIONS, *PWEBAUTHN_EXTENSIONS;
|
|
typedef const WEBAUTHN_EXTENSIONS *PCWEBAUTHN_EXTENSIONS;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Options.
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_ANY 0
|
|
#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_PLATFORM 1
|
|
#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM 2
|
|
#define WEBAUTHN_AUTHENTICATOR_ATTACHMENT_CROSS_PLATFORM_U2F_V2 3
|
|
|
|
#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_ANY 0
|
|
#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_REQUIRED 1
|
|
#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_PREFERRED 2
|
|
#define WEBAUTHN_USER_VERIFICATION_REQUIREMENT_DISCOURAGED 3
|
|
|
|
#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_ANY 0
|
|
#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_NONE 1
|
|
#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_INDIRECT 2
|
|
#define WEBAUTHN_ATTESTATION_CONVEYANCE_PREFERENCE_DIRECT 3
|
|
|
|
#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_1 1
|
|
#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_2 2
|
|
#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3 3
|
|
#define WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_CURRENT_VERSION WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3
|
|
|
|
typedef struct _WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Time that the operation is expected to complete within.
|
|
// This is used as guidance, and can be overridden by the platform.
|
|
DWORD dwTimeoutMilliseconds;
|
|
|
|
// Credentials used for exclusion.
|
|
WEBAUTHN_CREDENTIALS CredentialList;
|
|
|
|
// Optional extensions to parse when performing the operation.
|
|
WEBAUTHN_EXTENSIONS Extensions;
|
|
|
|
// Optional. Platform vs Cross-Platform Authenticators.
|
|
DWORD dwAuthenticatorAttachment;
|
|
|
|
// Optional. Require key to be resident or not. Defaulting to FALSE;
|
|
BOOL bRequireResidentKey;
|
|
|
|
// User Verification Requirement.
|
|
DWORD dwUserVerificationRequirement;
|
|
|
|
// Attestation Conveyance Preference.
|
|
DWORD dwAttestationConveyancePreference;
|
|
|
|
// Reserved for future Use
|
|
DWORD dwFlags;
|
|
|
|
//
|
|
// The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_2
|
|
//
|
|
|
|
// Cancellation Id - Optional - See WebAuthNGetCancellationId
|
|
GUID *pCancellationId;
|
|
|
|
//
|
|
// The following fields have been added in WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS_VERSION_3
|
|
//
|
|
|
|
// Exclude Credential List. If present, "CredentialList" will be ignored.
|
|
PWEBAUTHN_CREDENTIAL_LIST pExcludeCredentialList;
|
|
|
|
} WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS, *PWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS;
|
|
typedef const WEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS *PCWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS;
|
|
|
|
|
|
#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_1 1
|
|
#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_2 2
|
|
#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_3 3
|
|
#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4 4
|
|
#define WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_CURRENT_VERSION WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4
|
|
|
|
typedef struct _WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Time that the operation is expected to complete within.
|
|
// This is used as guidance, and can be overridden by the platform.
|
|
DWORD dwTimeoutMilliseconds;
|
|
|
|
// Allowed Credentials List.
|
|
WEBAUTHN_CREDENTIALS CredentialList;
|
|
|
|
// Optional extensions to parse when performing the operation.
|
|
WEBAUTHN_EXTENSIONS Extensions;
|
|
|
|
// Optional. Platform vs Cross-Platform Authenticators.
|
|
DWORD dwAuthenticatorAttachment;
|
|
|
|
// User Verification Requirement.
|
|
DWORD dwUserVerificationRequirement;
|
|
|
|
// Reserved for future Use
|
|
DWORD dwFlags;
|
|
|
|
//
|
|
// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_2
|
|
//
|
|
|
|
// Optional identifier for the U2F AppId. Converted to UTF8 before being hashed. Not lower cased.
|
|
PCWSTR pwszU2fAppId;
|
|
|
|
// If the following is non-NULL, then, set to TRUE if the above pwszU2fAppid was used instead of
|
|
// PCWSTR pwszRpId;
|
|
BOOL *pbU2fAppId;
|
|
|
|
//
|
|
// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_3
|
|
//
|
|
|
|
// Cancellation Id - Optional - See WebAuthNGetCancellationId
|
|
GUID *pCancellationId;
|
|
|
|
//
|
|
// The following fields have been added in WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS_VERSION_4
|
|
//
|
|
|
|
// Allow Credential List. If present, "CredentialList" will be ignored.
|
|
PWEBAUTHN_CREDENTIAL_LIST pAllowCredentialList;
|
|
|
|
} WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS, *PWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS;
|
|
typedef const WEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS *PCWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS;
|
|
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// Attestation Info.
|
|
//
|
|
//-------------------------------------------------------------------------------------------
|
|
#define WEBAUTHN_ATTESTATION_DECODE_NONE 0
|
|
#define WEBAUTHN_ATTESTATION_DECODE_COMMON 1
|
|
// WEBAUTHN_ATTESTATION_DECODE_COMMON supports format types
|
|
// L"packed"
|
|
// L"fido-u2f"
|
|
|
|
#define WEBAUTHN_ATTESTATION_VER_TPM_2_0 L"2.0"
|
|
|
|
typedef struct _WEBAUTHN_X5C {
|
|
// Length of X.509 encoded certificate
|
|
DWORD cbData;
|
|
// X.509 encoded certificate bytes
|
|
_Field_size_bytes_(cbData)
|
|
PBYTE pbData;
|
|
} WEBAUTHN_X5C, *PWEBAUTHN_X5C;
|
|
|
|
// Supports either Self or Full Basic Attestation
|
|
|
|
// Note, new fields will be added to the following data structure to
|
|
// support additional attestation format types, such as, TPM.
|
|
// When fields are added, the dwVersion will be incremented.
|
|
//
|
|
// Therefore, your code must make the following check:
|
|
// "if (dwVersion >= WEBAUTHN_COMMON_ATTESTATION_CURRENT_VERSION)"
|
|
|
|
#define WEBAUTHN_COMMON_ATTESTATION_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_COMMON_ATTESTATION {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Hash and Padding Algorithm
|
|
//
|
|
// The following won't be set for "fido-u2f" which assumes "ES256".
|
|
PCWSTR pwszAlg;
|
|
LONG lAlg; // COSE algorithm
|
|
|
|
// Signature that was generated for this attestation.
|
|
DWORD cbSignature;
|
|
_Field_size_bytes_(cbSignature)
|
|
PBYTE pbSignature;
|
|
|
|
// Following is set for Full Basic Attestation. If not, set then, this is Self Attestation.
|
|
// Array of X.509 DER encoded certificates. The first certificate is the signer, leaf certificate.
|
|
DWORD cX5c;
|
|
_Field_size_(cX5c)
|
|
PWEBAUTHN_X5C pX5c;
|
|
|
|
// Following are also set for tpm
|
|
PCWSTR pwszVer; // L"2.0"
|
|
DWORD cbCertInfo;
|
|
_Field_size_bytes_(cbCertInfo)
|
|
PBYTE pbCertInfo;
|
|
DWORD cbPubArea;
|
|
_Field_size_bytes_(cbPubArea)
|
|
PBYTE pbPubArea;
|
|
} WEBAUTHN_COMMON_ATTESTATION, *PWEBAUTHN_COMMON_ATTESTATION;
|
|
typedef const WEBAUTHN_COMMON_ATTESTATION *PCWEBAUTHN_COMMON_ATTESTATION;
|
|
|
|
#define WEBAUTHN_ATTESTATION_TYPE_PACKED L"packed"
|
|
#define WEBAUTHN_ATTESTATION_TYPE_U2F L"fido-u2f"
|
|
#define WEBAUTHN_ATTESTATION_TYPE_TPM L"tpm"
|
|
#define WEBAUTHN_ATTESTATION_TYPE_NONE L"none"
|
|
|
|
#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_1 1
|
|
#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2 2
|
|
#define WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3 3
|
|
#define WEBAUTHN_CREDENTIAL_ATTESTATION_CURRENT_VERSION WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3
|
|
|
|
typedef struct _WEBAUTHN_CREDENTIAL_ATTESTATION {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Attestation format type
|
|
PCWSTR pwszFormatType;
|
|
|
|
// Size of cbAuthenticatorData.
|
|
DWORD cbAuthenticatorData;
|
|
// Authenticator data that was created for this credential.
|
|
_Field_size_bytes_(cbAuthenticatorData)
|
|
PBYTE pbAuthenticatorData;
|
|
|
|
// Size of CBOR encoded attestation information
|
|
//0 => encoded as CBOR null value.
|
|
DWORD cbAttestation;
|
|
//Encoded CBOR attestation information
|
|
_Field_size_bytes_(cbAttestation)
|
|
PBYTE pbAttestation;
|
|
|
|
DWORD dwAttestationDecodeType;
|
|
// Following depends on the dwAttestationDecodeType
|
|
// WEBAUTHN_ATTESTATION_DECODE_NONE
|
|
// NULL - not able to decode the CBOR attestation information
|
|
// WEBAUTHN_ATTESTATION_DECODE_COMMON
|
|
// PWEBAUTHN_COMMON_ATTESTATION;
|
|
PVOID pvAttestationDecode;
|
|
|
|
// The CBOR encoded Attestation Object to be returned to the RP.
|
|
DWORD cbAttestationObject;
|
|
_Field_size_bytes_(cbAttestationObject)
|
|
PBYTE pbAttestationObject;
|
|
|
|
// The CredentialId bytes extracted from the Authenticator Data.
|
|
// Used by Edge to return to the RP.
|
|
DWORD cbCredentialId;
|
|
_Field_size_bytes_(cbCredentialId)
|
|
PBYTE pbCredentialId;
|
|
|
|
//
|
|
// Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_2
|
|
//
|
|
|
|
WEBAUTHN_EXTENSIONS Extensions;
|
|
|
|
//
|
|
// Following fields have been added in WEBAUTHN_CREDENTIAL_ATTESTATION_VERSION_3
|
|
//
|
|
|
|
// One of the WEBAUTHN_CTAP_TRANSPORT_* bits will be set corresponding to
|
|
// the transport that was used.
|
|
DWORD dwUsedTransport;
|
|
|
|
} WEBAUTHN_CREDENTIAL_ATTESTATION, *PWEBAUTHN_CREDENTIAL_ATTESTATION;
|
|
typedef const WEBAUTHN_CREDENTIAL_ATTESTATION *PCWEBAUTHN_CREDENTIAL_ATTESTATION;
|
|
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// authenticatorGetAssertion output.
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
#define WEBAUTHN_ASSERTION_CURRENT_VERSION 1
|
|
|
|
typedef struct _WEBAUTHN_ASSERTION {
|
|
// Version of this structure, to allow for modifications in the future.
|
|
DWORD dwVersion;
|
|
|
|
// Size of cbAuthenticatorData.
|
|
DWORD cbAuthenticatorData;
|
|
// Authenticator data that was created for this assertion.
|
|
_Field_size_bytes_(cbAuthenticatorData)
|
|
PBYTE pbAuthenticatorData;
|
|
|
|
// Size of pbSignature.
|
|
DWORD cbSignature;
|
|
// Signature that was generated for this assertion.
|
|
_Field_size_bytes_(cbSignature)
|
|
PBYTE pbSignature;
|
|
|
|
// Credential that was used for this assertion.
|
|
WEBAUTHN_CREDENTIAL Credential;
|
|
|
|
// Size of User Id
|
|
DWORD cbUserId;
|
|
// UserId
|
|
_Field_size_bytes_(cbUserId)
|
|
PBYTE pbUserId;
|
|
} WEBAUTHN_ASSERTION, *PWEBAUTHN_ASSERTION;
|
|
typedef const WEBAUTHN_ASSERTION *PCWEBAUTHN_ASSERTION;
|
|
|
|
//+------------------------------------------------------------------------------------------
|
|
// APIs.
|
|
//-------------------------------------------------------------------------------------------
|
|
|
|
DWORD
|
|
WINAPI
|
|
WebAuthNGetApiVersionNumber();
|
|
|
|
HRESULT
|
|
WINAPI
|
|
WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable(
|
|
_Out_ BOOL *pbIsUserVerifyingPlatformAuthenticatorAvailable);
|
|
|
|
|
|
HRESULT
|
|
WINAPI
|
|
WebAuthNAuthenticatorMakeCredential(
|
|
_In_ HWND hWnd,
|
|
_In_ PCWEBAUTHN_RP_ENTITY_INFORMATION pRpInformation,
|
|
_In_ PCWEBAUTHN_USER_ENTITY_INFORMATION pUserInformation,
|
|
_In_ PCWEBAUTHN_COSE_CREDENTIAL_PARAMETERS pPubKeyCredParams,
|
|
_In_ PCWEBAUTHN_CLIENT_DATA pWebAuthNClientData,
|
|
_In_opt_ PCWEBAUTHN_AUTHENTICATOR_MAKE_CREDENTIAL_OPTIONS pWebAuthNMakeCredentialOptions,
|
|
_Outptr_result_maybenull_ PWEBAUTHN_CREDENTIAL_ATTESTATION *ppWebAuthNCredentialAttestation);
|
|
|
|
|
|
HRESULT
|
|
WINAPI
|
|
WebAuthNAuthenticatorGetAssertion(
|
|
_In_ HWND hWnd,
|
|
_In_ LPCWSTR pwszRpId,
|
|
_In_ PCWEBAUTHN_CLIENT_DATA pWebAuthNClientData,
|
|
_In_opt_ PCWEBAUTHN_AUTHENTICATOR_GET_ASSERTION_OPTIONS pWebAuthNGetAssertionOptions,
|
|
_Outptr_result_maybenull_ PWEBAUTHN_ASSERTION *ppWebAuthNAssertion);
|
|
|
|
void
|
|
WINAPI
|
|
WebAuthNFreeCredentialAttestation(
|
|
_In_opt_ PWEBAUTHN_CREDENTIAL_ATTESTATION pWebAuthNCredentialAttestation);
|
|
|
|
void
|
|
WINAPI
|
|
WebAuthNFreeAssertion(
|
|
_In_ PWEBAUTHN_ASSERTION pWebAuthNAssertion);
|
|
|
|
HRESULT
|
|
WINAPI
|
|
WebAuthNGetCancellationId(
|
|
_Out_ GUID* pCancellationId);
|
|
|
|
HRESULT
|
|
WINAPI
|
|
WebAuthNCancelCurrentOperation(
|
|
_In_ const GUID* pCancellationId);
|
|
|
|
//
|
|
// Returns the following Error Names:
|
|
// L"Success" - S_OK
|
|
// L"InvalidStateError" - NTE_EXISTS
|
|
// L"ConstraintError" - HRESULT_FROM_WIN32(ERROR_NOT_SUPPORTED),
|
|
// NTE_NOT_SUPPORTED,
|
|
// NTE_TOKEN_KEYSET_STORAGE_FULL
|
|
// L"NotSupportedError" - NTE_INVALID_PARAMETER
|
|
// L"NotAllowedError" - NTE_DEVICE_NOT_FOUND,
|
|
// NTE_NOT_FOUND,
|
|
// HRESULT_FROM_WIN32(ERROR_CANCELLED),
|
|
// NTE_USER_CANCELLED,
|
|
// HRESULT_FROM_WIN32(ERROR_TIMEOUT)
|
|
// L"UnknownError" - All other hr values
|
|
//
|
|
PCWSTR
|
|
WINAPI
|
|
WebAuthNGetErrorName(
|
|
_In_ HRESULT hr);
|
|
|
|
HRESULT
|
|
WINAPI
|
|
WebAuthNGetW3CExceptionDOMError(
|
|
_In_ HRESULT hr);
|
|
|
|
|
|
#ifdef __cplusplus
|
|
} // Balance extern "C" above
|
|
#endif
|
|
|
|
#endif // WINAPI_FAMILY_PARTITION
|
|
#pragma endregion
|
|
|
|
#endif // __WEBAUTHN_H_
|