Commit Graph

4 Commits

Author SHA1 Message Date
Jiewei Qian
276ae56a8e auth: add pinentry support fido2 plugin
This CL adds pinentry support to ask for security key PIN.

Security key PINs may be required (by the manufacturer, or configured by
the user) to perform FIDO2 assertions.

PIN entry is done by calling pinentry command (or overridden by
LUCI_AUTH_PINENTRY environment variable), which we'll ask users to
install during onboarding.

Bug: 448235795
Change-Id: Ie87389330668dc5eaf8214699defec094757ca9e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/7004844
Reviewed-by: Jiewei Qian <qjw@chromium.org>
Commit-Queue: Jiewei Qian <qjw@chromium.org>
Reviewed-by: Chenlin Fan <fancl@chromium.org>
2025-10-06 21:06:49 -07:00
Jiewei Qian
57f57b0960 luci-auth-fido2-plugin: add a --list-devices flag for troubleshooting
This CL adds a --list-devices for luci-auth-fido2-plugin to print
information about detected FIDO2 devices, then exit itself.

This is useful for debugging udev / permission issues on Linux.

Bug:b/433851494
Change-Id: I4db7e6a56b99e077d4128c74f49d02829b667d8a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6850350
Reviewed-by: Allen Li <ayatane@chromium.org>
Commit-Queue: Jiewei Qian <qjw@chromium.org>
Reviewed-by: Chenlin Fan <fancl@chromium.org>
2025-08-17 22:07:04 -07:00
Jiewei Qian
09f005050e luci-auth-fido2-plugin: use WindowsClient if available
WindowsClient works for both non-admin and admin users. There's no need
to branch and use Fido2Client for admin users.

Bug:b/433851494
Change-Id: I42d52d71749beaf0b2c68d9adc6027a5b6bb2ac2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6844138
Reviewed-by: Allen Li <ayatane@chromium.org>
Reviewed-by: Chenlin Fan <fancl@chromium.org>
Auto-Submit: Jiewei Qian <qjw@chromium.org>
Commit-Queue: Allen Li <ayatane@chromium.org>
2025-08-13 14:49:27 -07:00
Jiewei Qian
59e46a5d18 Add luci-auth-fido2-plugin
This plugin handles FIDO2 security keys for doing auth and integrates
with luci-auth (specifically git-credential-luci).

(It's in Python because tl;dr the Python library is much better.)

Bug: 433851494
Change-Id: Ib956b614588aad8ad4fda7619bfbae17a670438f
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/tools/depot_tools/+/6804585
Reviewed-by: Scott Lee <ddoman@chromium.org>
Commit-Queue: Allen Li <ayatane@chromium.org>
2025-08-11 14:54:09 -07:00