feat: Implement passkey support from keystone-ng

Allow user register and authenticate with the passkeys (security device)
using the keystone-ng project. This is currently an optional feature
since the keystone-ng is not deployed by anybody productively.

Author: gtema

.github/workflows/functional.yml

@@ -77,4 +77,4 @@ jobs:
       - name: Execute functional tests
         env:
           OS_CLOUD: devstack
-        run: cargo nextest run --test functional --all-features -- --skip network::v2::auto_allocated_topology::list::list
+        run: cargo nextest run --test functional

Cargo.lock

@@ -19,6 +19,7 @@ repository = "https://github.com/gtema/openstack"
 
 [workspace.dependencies]
 async-trait = { version = "^0.1" } #, optional = true }
+base64 = "0.22"
 bytes = "^1.10"
 chrono = { version = "^0.4", default-features = false, features = ["clock", "serde"] }
 clap = { version = "^4.5", features = ["cargo", "color", "derive", "env"] }
@@ -51,6 +52,8 @@ tracing = "^0.1"
 tracing-error = { version = "^0.2" }
 tracing-subscriber = { version = "^0.3", features = ["env-filter", "serde"] }
 url = { version = "^2.5", features = ["serde"] }
+webauthn-authenticator-rs = { version = "0.5", features = ["ctap2", "mozilla", "ui-cli"]}
+webauthn-rs-proto = { version = "0.5" }
 
 [profile.dev]
 debug = 0

Cargo.toml

@@ -46,7 +46,7 @@ network = ["openstack_sdk/network"]
 object_store = ["openstack_sdk/object_store"]
 placement = ["openstack_sdk/placement"]
 keystone_ng = ["openstack_sdk/keystone_ng", "openstack_types/keystone_ng"]
-passkey = ["dep:webauthn-authenticator-rs", "dep:webauthn-rs-proto"]
+passkey = ["keystone_ng", "openstack_sdk/passkey", "dep:webauthn-authenticator-rs", "dep:webauthn-rs-proto"]
 
 _test_admin = []
 _test_net_auto-allocated-topology = []
@@ -57,10 +57,9 @@ _test_net_logging = []
 _test_net_network-ip-availability = []
 _test_net_network-segment-range = []
 _test_net_vpn = []
-webauthn-rs-proto = ["dep:webauthn-rs-proto"]
 
 [dependencies]
-base64 = "0.22"
+base64 = { workspace = true }
 bytes = { workspace = true }
 config.workspace = true
 chrono = { workspace= true }
@@ -72,6 +71,7 @@ dialoguer = { workspace = true, features=["fuzzy-select"] }
 dirs = { workspace = true }
 eyre = { workspace = true }
 http = { workspace = true }
+itertools = { workspace = true }
 json-patch = { workspace = true }
 openstack_sdk = { path="../openstack_sdk", version = "^0.22", default-features = false, features = ["async", "identity"] }
 openstack_types = { path="../openstack_types", version = "^0.22" }
@@ -90,10 +90,8 @@ thiserror = { workspace = true }
 tracing = { workspace = true}
 tracing-subscriber = { workspace = true }
 url = { workspace = true }
-itertools = { workspace = true }
-webauthn-authenticator-rs = { optional = true, version = "0.5", features = ["ctap2", "mozilla", "ui-cli"]}
-webauthn-rs-proto = { version = "0.5", optional = true }
-
+webauthn-authenticator-rs = { workspace = true, optional = true }
+webauthn-rs-proto = { workspace = true, optional = true }
 
 [dev-dependencies]
 assert_cmd = "^2.0"

openstack_cli/Cargo.toml

@@ -41,9 +41,11 @@ async = []
 client_der = []
 client_pem = []
 keystone_ng = []
+passkey = ["keystone_ng", "dep:webauthn-authenticator-rs", "dep:webauthn-rs-proto"]
 
 [dependencies]
 async-trait = {workspace = true}
+base64 = { workspace = true }
 bincode = { version = "^2.0", default-features = false, features = ["serde", "std"] }
 bytes = {workspace = true}
 chrono = { workspace= true }
@@ -73,6 +75,8 @@ tokio = { workspace = true }
 tokio-util = {workspace = true}
 tracing = { workspace = true}
 url = { workspace = true }
+webauthn-authenticator-rs = { workspace = true, optional = true }
+webauthn-rs-proto = { workspace = true, optional = true }
 
 [dev-dependencies]
 httpmock = "^0.7"

openstack_sdk/Cargo.toml

@@ -38,6 +38,8 @@ pub mod v3totp;
 pub mod v3websso;
 #[cfg(feature = "keystone_ng")]
 pub mod v4federation;
+#[cfg(feature = "passkey")]
+pub mod v4passkey;
 
 use authtoken::{AuthToken, AuthTokenError};
 use authtoken_scope::AuthTokenScopeError;
@@ -103,6 +105,15 @@ impl From<FederationError> for AuthError {
     }
 }
 
+#[cfg(feature = "passkey")]
+impl From<v4passkey::PasskeyError> for AuthError {
+    fn from(source: v4passkey::PasskeyError) -> Self {
+        Self::AuthToken {
+            source: source.into(),
+        }
+    }
+}
+
 /// Authentication state enum
 #[derive(Debug, Eq, PartialEq)]
 pub enum AuthState {

openstack_sdk/src/auth.rs

@@ -28,6 +28,8 @@ use crate::api::RestEndpoint;
 use crate::auth::auth_token_endpoint as token_v3;
 #[cfg(feature = "keystone_ng")]
 use crate::auth::v4federation;
+#[cfg(feature = "passkey")]
+use crate::auth::v4passkey;
 use crate::auth::{
     auth_helper::AuthHelper, authtoken_scope, v3applicationcredential, v3oidcaccesstoken,
     v3password, v3token, v3totp, v3websso, AuthState,
@@ -166,6 +168,15 @@ pub enum AuthTokenError {
         #[from]
         source: v4federation::FederationError,
     },
+
+    /// Passkey error
+    #[cfg(feature = "passkey")]
+    #[error("Passkey based authentication error: {}", source)]
+    Passkey {
+        /// The error source
+        #[from]
+        source: v4passkey::PasskeyError,
+    },
 }
 
 type AuthResult<T> = Result<T, AuthTokenError>;
@@ -261,9 +272,12 @@ pub enum AuthType {
     V3Multifactor,
     /// WebSSO
     V3WebSso,
-    /// Federation
     #[cfg(feature = "keystone_ng")]
+    /// Federation.
     V4Federation,
+    #[cfg(feature = "passkey")]
+    /// Passkey.
+    V4Passkey,
 }
 
 impl FromStr for AuthType {
@@ -282,6 +296,8 @@ impl FromStr for AuthType {
             "v3websso" => Ok(Self::V3WebSso),
             #[cfg(feature = "keystone_ng")]
             "v4federation" | "federation" => Ok(Self::V4Federation),
+            #[cfg(feature = "passkey")]
+            "v4passkey" | "passkey" => Ok(Self::V4Passkey),
             other => Err(Self::Err::IdentityMethod {
                 auth_type: other.into(),
             }),
@@ -311,6 +327,8 @@ impl AuthType {
             Self::V3WebSso => "v3websso",
             #[cfg(feature = "keystone_ng")]
             Self::V4Federation => "v4federation",
+            #[cfg(feature = "passkey")]
+            Self::V4Passkey => "v4passkey",
         }
     }
 }

openstack_sdk/src/auth/authtoken.rs

@@ -0,0 +1,24 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+//! Passkey (security device) based login.
+//!
+
+mod error;
+mod finish;
+mod start;
+
+pub use error::PasskeyError;
+pub use finish::get_finish_auth_ep;
+pub use start::{get_init_auth_ep, PasskeyAuthenticationStartResponse};

openstack_sdk/src/auth/v4passkey.rs

@@ -0,0 +1,86 @@
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// SPDX-License-Identifier: Apache-2.0
+
+//! Passkey (security device) based login.
+//!
+
+use thiserror::Error;
+use tracing::error;
+
+use super::finish;
+use super::start;
+
+/// Passkey auth related errors.
+#[derive(Debug, Error)]
+#[non_exhaustive]
+pub enum PasskeyError {
+    /// Auth data is missing
+    #[error("auth data is missing")]
+    MissingAuthData,
+
+    /// Start authentication request builder.
+    #[error("error preparing auth request: {}", source)]
+    InitAuthBuilder {
+        #[from]
+        source: start::AuthStartRequestBuilderError,
+    },
+
+    /// Start authentication passkey request builder.
+    #[error("error preparing auth request: {}", source)]
+    InitPasskeyBuilder {
+        #[from]
+        source: start::PasskeyBuilderError,
+    },
+
+    /// Finish authentication request builder.
+    #[error(transparent)]
+    FinishPasskeyBuilder {
+        #[from]
+        source: finish::AuthFinishRequestBuilderError,
+    },
+
+    /// HmacGetSecretOutput.
+    #[error(transparent)]
+    HmacGetSecretOutput {
+        #[from]
+        source: finish::HmacGetSecretOutputBuilderError,
+    },
+
+    /// Passkey auth extensions.
+    #[error(transparent)]
+    AuthExtensions {
+        #[from]
+        source: finish::AuthenticationExtensionsClientOutputsBuilderError,
+    },
+
+    /// Passkey auth response.
+    #[error(transparent)]
+    AuthResponse {
+        #[from]
+        source: finish::AuthenticatorAssertionResponseRawBuilderError,
+    },
+    /// Base64 decode.
+    #[error(transparent)]
+    Base64 {
+        #[from]
+        source: base64::DecodeError,
+    },
+
+    /// WebAuthn.
+    #[error(transparent)]
+    WebAuthn {
+        #[from]
+        source: webauthn_authenticator_rs::error::WebauthnCError,
+    },
+}