fido2_device_discovery_registration_and_authentication_quickstart.py

1from fido2.hid import CtapHidDevice
2from fido2.client import Fido2Client
3from fido2.server import Fido2Server
4from fido2.utils import websafe_decode, websafe_encode
5
6# 1. Setup: Define the server/relying party
7rp = {"id": "example.com", "name": "Example RP"}
8server = Fido2Server(rp)
9user = {"id": b"user_id", "name": "alice", "displayName": "Alice Smith"}
10
11# 2. Locate a FIDO2 device
12dev = next(CtapHidDevice.list(), None)
13if not dev:
14    print("No FIDO2 device found")
15    exit()
16
17client = Fido2Client(dev, "https://example.com")
18
19# 3. Registration (Make Credential)
20print("--- Registration ---")
21print("Touch your authenticator now...")
22
23# Server generates options
24registration_data, state = server.register_begin(
25    user, user_verification="discouraged"
26)
27
28# Client interacts with the device
29result = client.make_credential(registration_data["publicKey"])
30
31# Server completes registration and saves credential
32auth_data = server.register_complete(
33    state, result.client_data, result.attestation_object
34)
35credentials = [auth_data.credential_data]
36print("New credential created!")
37
38
39# 4. Authentication (Get Assertion)
40print("\n--- Authentication ---")
41print("Touch your authenticator now...")
42
43# Server generates options based on known credentials
44authentication_data, state = server.authenticate_begin(credentials)
45
46# Client interacts with the device
47result = client.get_assertion(authentication_data["publicKey"])
48
49# Server verifies the assertion
50server.authenticate_complete(
51    state,
52    credentials,
53    result.assertions[0].credential.id,
54    result.client_data,
55    result.assertions[0].auth_data,
56    result.assertions[0].signature,
57)
58
59print("Authentication successful!")