feat(webauthn): passkeys (#7942)

Add support for passkeys, granular attachment modality, granular authenticator selection, and authenticator filtering which is commonly used in an enterprise environment. This also adds metadata verification elements utilizing the MDS3 to the project, including saving attestation statements, verification of attestation statements, etc. This also makes a significant change to the authentication level logic to purely use RFC8176 authentication method references to ensure the future-proof nature of the implementation. This change paves the way for the future of Authelia ensuring we can add custom policies in the future to allow administrators to very deliberately decide what authentication methods are sufficient for a given resource as well as the ability to clearly communicate these authentication methods to third parties via OpenID Connect 1.0 and SAML 2.0. It should be noted that at the time of this commit Passkey authentication is considered a single factor and we will at a later stage add the customizable policies described here to handle other use cases, though we've included a flag that considers properly implemented passkeys as if they were MFA.

Closes #2827, Closes #2761

Signed-off-by: James Elliott <james-d-elliott@users.noreply.github.com>

1 files changed, 51 insertions, 1 deletions

diff --git a/internal/configuration/decode_hooks.go b/internal/configuration/decode_hooks.go
index c92834d2f..bb1ee7fdd 100644
--- a/internal/configuration/decode_hooks.go
+++ b/internal/configuration/decode_hooks.go
@@ -18,6 +18,7 @@ import (
 
 	"github.com/go-crypt/crypt/algorithm/plaintext"
 	"github.com/go-viper/mapstructure/v2"
+	"github.com/google/uuid"
 
 	"github.com/authelia/authelia/v4/internal/configuration/schema"
 	"github.com/authelia/authelia/v4/internal/utils"
@@ -559,12 +560,13 @@ func StringToTLSVersionHookFunc() mapstructure.DecodeHookFuncType {
 
 // StringToCryptoPrivateKeyHookFunc decodes strings to schema.CryptographicPrivateKey's.
 func StringToCryptoPrivateKeyHookFunc() mapstructure.DecodeHookFuncType {
+	field, _ := reflect.TypeOf(schema.TLS{}).FieldByName("PrivateKey")
+
 	return func(f reflect.Type, t reflect.Type, data any) (value any, err error) {
 		if f.Kind() != reflect.String {
 			return data, nil
 		}
 
-		field, _ := reflect.TypeOf(schema.TLS{}).FieldByName("PrivateKey")
 		expectedType := field.Type
 
 		if t != expectedType {
@@ -823,3 +825,51 @@ func StringToIPNetworksHookFunc(definitions map[string][]*net.IPNet) mapstructur
 		return networks, nil
 	}
 }
+
+// StringToUUIDHookFunc decodes a string into a uuid.UUID.
+func StringToUUIDHookFunc() mapstructure.DecodeHookFuncType {
+	return func(f reflect.Type, t reflect.Type, data any) (value any, err error) {
+		var ptr bool
+
+		if f.Kind() != reflect.String {
+			return data, nil
+		}
+
+		prefixType := ""
+
+		if t.Kind() == reflect.Ptr {
+			ptr = true
+			prefixType = "*"
+		}
+
+		expectedType := reflect.TypeOf(uuid.UUID{})
+
+		if ptr && t.Elem() != expectedType {
+			return data, nil
+		} else if !ptr && t != expectedType {
+			return data, nil
+		}
+
+		dataStr := data.(string)
+
+		var result uuid.UUID
+
+		if dataStr == "" {
+			if ptr {
+				return (*uuid.UUID)(nil), nil
+			} else {
+				return nil, fmt.Errorf(errFmtDecodeHookCouldNotParseEmptyValue, prefixType, expectedType.String(), errDecodeNonPtrMustHaveValue)
+			}
+		}
+
+		if result, err = uuid.Parse(dataStr); err != nil {
+			return nil, fmt.Errorf(errFmtDecodeHookCouldNotParse, dataStr, prefixType, expectedType.String(), err)
+		}
+
+		if ptr {
+			return &result, nil
+		}
+
+		return result, nil
+	}
+}