{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webauthn/issues/1149","repository_url":"https://api.github.com/repos/w3c/webauthn","labels_url":"https://api.github.com/repos/w3c/webauthn/issues/1149/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webauthn/issues/1149/comments","events_url":"https://api.github.com/repos/w3c/webauthn/issues/1149/events","html_url":"https://github.com/w3c/webauthn/issues/1149","id":404078671,"node_id":"MDU6SXNzdWU0MDQwNzg2NzE=","number":1149,"title":"Add notion of forbidding resident credential creation","user":{"login":"equalsJeffH","id":226571,"node_id":"MDQ6VXNlcjIyNjU3MQ==","avatar_url":"https://avatars0.githubusercontent.com/u/226571?v=4","gravatar_id":"","url":"https://api.github.com/users/equalsJeffH","html_url":"https://github.com/equalsJeffH","followers_url":"https://api.github.com/users/equalsJeffH/followers","following_url":"https://api.github.com/users/equalsJeffH/following{/other_user}","gists_url":"https://api.github.com/users/equalsJeffH/gists{/gist_id}","starred_url":"https://api.github.com/users/equalsJeffH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/equalsJeffH/subscriptions","organizations_url":"https://api.github.com/users/equalsJeffH/orgs","repos_url":"https://api.github.com/users/equalsJeffH/repos","events_url":"https://api.github.com/users/equalsJeffH/events{/privacy}","received_events_url":"https://api.github.com/users/equalsJeffH/received_events","type":"User","site_admin":false},"labels":[{"id":1343771945,"node_id":"MDU6TGFiZWwxMzQzNzcxOTQ1","url":"https://api.github.com/repos/w3c/webauthn/labels/stat:Blocked","name":"stat:Blocked","color":"e25356","default":false},{"id":340916443,"node_id":"MDU6TGFiZWwzNDA5MTY0NDM=","url":"https://api.github.com/repos/w3c/webauthn/labels/stat:Discuss","name":"stat:Discuss","color":"207de5","default":false},{"id":1196189598,"node_id":"MDU6TGFiZWwxMTk2MTg5NTk4","url":"https://api.github.com/repos/w3c/webauthn/labels/subtype:AuthnrSelection","name":"subtype:AuthnrSelection","color":"e99695","default":false},{"id":717194584,"node_id":"MDU6TGFiZWw3MTcxOTQ1ODQ=","url":"https://api.github.com/repos/w3c/webauthn/labels/subtype:underspecifiedBehaviors","name":"subtype:underspecifiedBehaviors","color":"1d76db","default":false},{"id":340916444,"node_id":"MDU6TGFiZWwzNDA5MTY0NDQ=","url":"https://api.github.com/repos/w3c/webauthn/labels/type:technical","name":"type:technical","color":"ffca04","default":false}],"state":"open","locked":false,"assignee":{"login":"equalsJeffH","id":226571,"node_id":"MDQ6VXNlcjIyNjU3MQ==","avatar_url":"https://avatars0.githubusercontent.com/u/226571?v=4","gravatar_id":"","url":"https://api.github.com/users/equalsJeffH","html_url":"https://github.com/equalsJeffH","followers_url":"https://api.github.com/users/equalsJeffH/followers","following_url":"https://api.github.com/users/equalsJeffH/following{/other_user}","gists_url":"https://api.github.com/users/equalsJeffH/gists{/gist_id}","starred_url":"https://api.github.com/users/equalsJeffH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/equalsJeffH/subscriptions","organizations_url":"https://api.github.com/users/equalsJeffH/orgs","repos_url":"https://api.github.com/users/equalsJeffH/repos","events_url":"https://api.github.com/users/equalsJeffH/events{/privacy}","received_events_url":"https://api.github.com/users/equalsJeffH/received_events","type":"User","site_admin":false},"assignees":[{"login":"equalsJeffH","id":226571,"node_id":"MDQ6VXNlcjIyNjU3MQ==","avatar_url":"https://avatars0.githubusercontent.com/u/226571?v=4","gravatar_id":"","url":"https://api.github.com/users/equalsJeffH","html_url":"https://github.com/equalsJeffH","followers_url":"https://api.github.com/users/equalsJeffH/followers","following_url":"https://api.github.com/users/equalsJeffH/following{/other_user}","gists_url":"https://api.github.com/users/equalsJeffH/gists{/gist_id}","starred_url":"https://api.github.com/users/equalsJeffH/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/equalsJeffH/subscriptions","organizations_url":"https://api.github.com/users/equalsJeffH/orgs","repos_url":"https://api.github.com/users/equalsJeffH/repos","events_url":"https://api.github.com/users/equalsJeffH/events{/privacy}","received_events_url":"https://api.github.com/users/equalsJeffH/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/w3c/webauthn/milestones/17","html_url":"https://github.com/w3c/webauthn/milestone/17","labels_url":"https://api.github.com/repos/w3c/webauthn/milestones/17/labels","id":4054882,"node_id":"MDk6TWlsZXN0b25lNDA1NDg4Mg==","number":17,"title":"L2-WD-02","description":"Issues to address in a WebAuthn Level 2 spec. WD-02","creator":{"login":"nadalin","id":7937635,"node_id":"MDQ6VXNlcjc5Mzc2MzU=","avatar_url":"https://avatars2.githubusercontent.com/u/7937635?v=4","gravatar_id":"","url":"https://api.github.com/users/nadalin","html_url":"https://github.com/nadalin","followers_url":"https://api.github.com/users/nadalin/followers","following_url":"https://api.github.com/users/nadalin/following{/other_user}","gists_url":"https://api.github.com/users/nadalin/gists{/gist_id}","starred_url":"https://api.github.com/users/nadalin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nadalin/subscriptions","organizations_url":"https://api.github.com/users/nadalin/orgs","repos_url":"https://api.github.com/users/nadalin/repos","events_url":"https://api.github.com/users/nadalin/events{/privacy}","received_events_url":"https://api.github.com/users/nadalin/received_events","type":"User","site_admin":false},"open_issues":42,"closed_issues":22,"state":"open","created_at":"2019-02-13T18:48:44Z","updated_at":"2019-06-12T20:02:27Z","due_on":"2019-07-30T07:00:00Z","closed_at":null},"comments":13,"created_at":"2019-01-29T01:15:16Z","updated_at":"2019-06-12T20:09:21Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Update 16-May-2019: \r\nThis issue was _improved_ by merging PR #1191, and _may_ be addressed (in practice) by the latter. Need to assess this. \r\n\r\n<hr>\r\n**Original post 28-Jan-2019**:\r\nToday, when making a credential, an RP can specify that they either require a [(client-side) resident credential](http://w3c.github.io/webauthn/#resident-credential), or that they can live with either that or the alternative server-side resident credential (think U2F). \r\n\r\nThinking forward to how we’d like to migrate users with security keys to the “resident credential” world (and thus enabling password-less and typing-free flows), we propose that we add an additional value to the [`requireResidentKey`](http://w3c.github.io/webauthn/#dom-authenticatorselectioncriteria-requireresidentkey) parameter during Create. With this, we’ll end up with ResidentCredential being one of three values: `{Required, Preferred, Forbidden}`:\r\n\r\n`Required` maps to the current setting of [`requireResidentKey = true`](http://w3c.github.io/webauthn/#dom-authenticatorselectioncriteria-requireresidentkey), explicitly requiring the authnr to create a [resident credential](http://w3c.github.io/webauthn/#resident-credential).\r\n\r\n`Preferred`, indicates that the RP prefers to create a [resident credential](http://w3c.github.io/webauthn/#resident-credential), but would also be fine with a non-resident credential (aka \"[server-side cred](http://w3c.github.io/webauthn/#server-side-credential-storage-modality)\"), if that’s the only thing the authenticator supports. Presently, [`requireResidentKey = false`](http://w3c.github.io/webauthn/#dom-authenticatorselectioncriteria-requireresidentkey) largely maps to this.\r\n\r\n`Forbidden` will map to a new, explicit sense of “false”&mdash;it’s better defined&mdash;it means that the authenticator must explicitly create a [server-side resident credential](http://w3c.github.io/webauthn/#server-side-credential-storage-modality). \r\n\r\nSee also:  [Credential Storage Modality](http://w3c.github.io/webauthn/#sctn-credential-storage-modality) and [Authenticator Taxonomy](http://w3c.github.io/webauthn/#sctn-authenticator-taxonomy)\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/w3c/webauthn/issues/comments/501436248","html_url":"https://github.com/w3c/webauthn/issues/1149#issuecomment-501436248","issue_url":"https://api.github.com/repos/w3c/webauthn/issues/1149","id":501436248,"node_id":"MDEyOklzc3VlQ29tbWVudDUwMTQzNjI0OA==","user":{"login":"christiaanbrand","id":6946519,"node_id":"MDQ6VXNlcjY5NDY1MTk=","avatar_url":"https://avatars2.githubusercontent.com/u/6946519?v=4","gravatar_id":"","url":"https://api.github.com/users/christiaanbrand","html_url":"https://github.com/christiaanbrand","followers_url":"https://api.github.com/users/christiaanbrand/followers","following_url":"https://api.github.com/users/christiaanbrand/following{/other_user}","gists_url":"https://api.github.com/users/christiaanbrand/gists{/gist_id}","starred_url":"https://api.github.com/users/christiaanbrand/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/christiaanbrand/subscriptions","organizations_url":"https://api.github.com/users/christiaanbrand/orgs","repos_url":"https://api.github.com/users/christiaanbrand/repos","events_url":"https://api.github.com/users/christiaanbrand/events{/privacy}","received_events_url":"https://api.github.com/users/christiaanbrand/received_events","type":"User","site_admin":false},"created_at":"2019-06-12T20:09:21Z","updated_at":"2019-06-12T20:09:21Z","author_association":"NONE","body":"Forbidden is a requirement here. Else, how am I suppose to make a credential on a security key, if I *never* want the silly key to prompt my user for PIN. We arrived at a point where the folks from MS told me that they'd be okay to not prompt for PIN (even if the \"security key does have a PIN set up\"), but only if it's not a resident credential. How am I suppose to enforce *NOT CREATING* a resident credential if I don't have this option?"}}
{"actor":{"display_login":"christiaanbrand"}}