Re:Passkey Implementation: Misconceptions, pitfalls and unkn...
by recursive on Friday May 03, 2024 @12:50AM
(#40244161)
You must know something about the domain. One time I spent several weeks falling to implement a minimal SAML relying party. Not even an idp. I found the spec to be impenetrable without a baseline understanding of the jargon. All the definitions seemed to be circular like when I end up on a Wikipedia article for some fancy math concept.
Re:Passkey Implementation: Misconceptions, pitfalls and unkn...
by rkeene2 on Friday May 03, 2024 @01:30AM
(#40244383)
It's been a while, but I read through the OASIS spec for SAML for my implementation. There is a lot of yak shaving and I also had to implement XML Digital Signatures (XML-DS), and XML Canonicalization (C14N), but overall I don't think it took too long for something that worked, and was a library so I could just give it a key (or PKCS#11 handle) an identity and get back a SAML Assertion, which is fundamentally what I was after. It's available for viewing here [0].
[0] https://github.com/rkeene/saml-idp/blob/master/lib/saml/saml...
Re:Passkey Implementation: Misconceptions, pitfalls and unkn...
by michaelt on Friday May 03, 2024 @07:05AM
(#40246305)
Implementing SAML from scratch should take a long time - it's one of the most footgun-prone designs I've ever seen.
Re:Passkey Implementation: Misconceptions, pitfalls and unkn...
by sierra1011 on Friday May 03, 2024 @08:24AM
(#40246871)
'Yak shaving' as a phrase is new to me, and I love it.
The hardest part of dealing with the Passkeys was remembering to read the whole specification before implementing it -- I spent a lot of time parsing their CBOR/COSE-based specification so that I could get the public key before "discovering" that there was a method for that defined by the specification.