Provide some form of "credential state" management

[grzuy]

As a webauthn gem user
I want the gem to provide some sort of automatic credential storage management
So that I don't have to manually code that myself in my ruby app

---

This maps to steps 22, 23 and 24 of the Registering a new credential in the WebAuthn spec.

[grzuy]

Generic code could probably live in this gem.
Code specific to the ORM or DB client/driver might become pluggable adapters.

[joshbuker]

@grzuy I also mentioned this on cedarcode/webauthn-rails-demo-app#116, but I'm currently working on Sorcery v1 and plan on adding WebAuthn support as a plugin. Perhaps Sorcery could fill the role of managing credential storage in those use-cases? Let me know what you think! 😄

Also a question if you don't mind: How much of the authentication stack does WebAuthn cover? I'm looking at it primarily to provide U2F support for Rails applications, but it looks like it's a little more comprehensive than just providing 2FA.

[bdewater]

@athix that's great to hear! Rodauth also recently added support for WebAuthn.

On the subject of this issue: IMO storage is better handled completely outside of this gem, I have a hard time imagining what a useful abstraction here would look like for external consumers.

How much of the authentication stack does WebAuthn cover? I'm looking at it primarily to provide U2F support for Rails applications

U2F is the legacy browser API, not to be confused with 2FA. WebAuthn can be used for second factor and multi-factor authentication without a username and password. The FIDO Alliance recently released the How to FIDO document to provide additional implementation guidance beyond the W3C standard.

[joshbuker]

Ah, it seems I've confused U2F and FIDO 2nd-factor!

Thanks for clarifying that, and the great documentation link. I'll give the How to FIDO README a thorough look-through this weekend.