fido2_device_credential_registration_and_assertion_authentication.py

1from fido2.hid import CtapHidDevice
2from fido2.client import Fido2Client
3from fido2.server import Fido2Server
4from fido2.utils import websafe_decode, websafe_encode
5
6# 1. Setup the server
7server = Fido2Server({"id": "example.com", "name": "Example Service"})
8user = {"id": b"user_id", "name": "a_user", "displayName": "A. User"}
9
10# 2. Find a device
11device = next(CtapHidDevice.list_devices(), None)
12if not device:
13    print("No FIDO device found")
14    exit()
15
16client = Fido2Client(device, "https://example.com")
17
18# 3. Registration (Make Credential)
19print("--- Registration ---")
20registration_options, state = server.register_begin(user)
21
22# Client side:
23# Note: In a real app, these options would be sent to the browser
24attestation_object = client.make_credential(registration_options["publicKey"])
25
26# Server side:
27auth_data = server.register_complete(
28    state,
29    attestation_object.client_data,
30    attestation_object.attestation_statement
31)
32credential_data = auth_data.credential_data
33print("New credential created!")
34print(f"Credential ID: {websafe_encode(credential_data.credential_id)}")
35
36# 4. Authentication (Get Assertion)
37print("\n--- Authentication ---")
38# Credentials allowed for authentication:
39credentials = [credential_data]
40
41authentication_options, state = server.authenticate_begin(credentials)
42
43# Client side:
44assertion_results = client.get_assertion(authentication_options["publicKey"])
45# Normally there's only one assertion:
46assertion = assertion_results.assertions[0]
47
48# Server side:
49server.authenticate_complete(
50    state,
51    credentials,
52    assertion.credential_id,
53    assertion.client_data,
54    assertion.auth_data,
55    assertion.signature
56)
57print("Authentication successful!")