#Enter the persons who are participating in the team that works on this Activity - delete this line after using the template#

#Please describe the goals of Activity, including what needs to be delivered, participants, the community(ies) that require a solution. Describe when the Activity is done and how to measure the success of it, in a SMART way. - delete this line after using the template#

<Enter here>

The goal of this activity is to contribute to the SimpleSAMLphp Webauthn module as well as to develop a new custom module for SATOSA to support 2FA using the WebAuthn API. Resulted modules would be integrated and tested in eduTEAMS (SATOSA) and ELIXIR AAI (SimpleSAMLphp).

Authentication proxies translate between authentication protocols such as SAML2, OIDC, and OAuth2. A proxy receives authentication requests from SPs or RPs and relays them onto IdPs or OPs. If a service requires two-factor authentication, for example, using the REFEDS assurance framework, and the identity provider does not support it, the proxy may perform the second-factor authentication. Two significant open-source examples are SimpleSAMLphp which can serve as an authentication proxy and Python-based​ SATOSA which was explicitly developed as a proxy.

WebAuthn can be used for passwordless authentication or for second-factor authentication to increase users‘ security. As of October 2019, a​ module for SimpleSAMLphp​ is being developed to bring WebAuthn support.

#Please describe the technical details for the Activity. - delete this line after using the template#

<Enter here>

#What is the business case for the Activity? Who would be beneficiaries of the results of the Activity and what would potential business case look like if applicable? - delete this line after using the template#

<Enter here>

The implementation of WebAuthN modules for SATOSA and SimpleSAMLphp would enable major parts of the T&I community to use state-of-the-art multi factor authentication without implementing something on their own.

#How do data protection and privacy impact the Activity? Think about e.g. handling of personal data of users - delete this line after using the template#

<Enter here>

The product handles highly sensitive authentication data which provide access to user identities. High standards for coding, security and quality control are required.

#Please describe here the set of criteria that the product must meet in order to be considered finished. - delete this line after using the template#

<Enter here>

This activity is done when:

• A prototype of a WebAuthN module for SATOSA and SimpleSAMLphp is implemented
• The prototypes are successfully tested with eduTEAMS and ELIXIR
• The module are provided to the SATOSA/SimpleSAMLphp community

#How are the results of the Activity intended to be used? If this requires further engagement, can you describe how you intent to sustain it? - delete this line after using the template#

<Enter here>

The modules will be submitted to the upstream repositories and later managed by the corresponding communities.

• WebAuthnN module available via CESTNET github repository: https://github.com/CESNET/satosa-module-webauthn
• Example flows:
  

  • webauthn_01_new_ui_register.mp4
    webauthn_02_new_ui_login.mp4
    webauthn_03_new_ui_manage.mp4
    webauthn_04_new_ui_turnoff.mp4