From 9a4653412c304a68baa38e92fe27082a1f55653a Mon Sep 17 00:00:00 2001 From: Jarrod Johnson Date: Tue, 7 Jul 2026 16:37:45 -0400 Subject: [PATCH] Fix webauthn related issues The block on user modification shorted out webauthn hooks. Further, be more picky about the prefix before the username in webauthn registered credentials and validation. --- confluent_server/confluent/auth.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/confluent_server/confluent/auth.py b/confluent_server/confluent/auth.py index 6fe925c2..4f0e69f8 100644 --- a/confluent_server/confluent/auth.py +++ b/confluent_server/confluent/auth.py @@ -20,6 +20,8 @@ # time import asyncio + +import confluent.exceptions as exc import confluent.config.configmanager as configmanager from concurrent.futures import ProcessPoolExecutor @@ -208,7 +210,7 @@ def authorize(name, element, tenant=False, operation='create', # even if pam does authentication. if operation not in ('create', 'start', 'update', 'retrieve', 'delete', None): return False - if operation != 'retrieve' and (element.startswith('/users') or element.startswith('/usergroups')): + if operation != 'retrieve' and element and (element.startswith('/users') or element.startswith('/usergroups')): return False user, tenant = _get_usertenant(name, tenant) if tenant is not None and not configmanager.is_tenant(tenant): @@ -216,6 +218,11 @@ def authorize(name, element, tenant=False, operation='create', manager = configmanager.ConfigManager(tenant, username=user) userobj = manager.get_user(user) if element and (element.startswith('/sessions/current/webauthn/registered_credentials/') or element.startswith('/sessions/current/webauthn/validate/')): + name = element.rsplit('/')[-1] + baseelement = element.rsplit(name, 1)[0] + if baseelement not in ['/sessions/current/webauthn/registered_credentials/', + '/sessions/current/webauthn/validate/']: + raise exc.InvalidParameterValue('Invalid username for passkey operation') return userobj, manager, user, tenant, skipuserobj if userobj and userobj.get('role', None) == 'Stub': userobj = None