Mobile DPoP FIDO Authn

A design for a first party mobile application that leverages dynamic client registration (DCR), DPoP access tokens, and FIDO user authenticaiton. In Jans Auth Server, we would end up having at least three long lived entries: one for the person, one for each device (client), and one for each FIDO credential.

This spec leverages the following IETF drafts

• OAuth 2.0 for First-Party Native Applications
• The Use of Attestation in OAuth 2.0 Dynamic Client Registration.
• OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP)

title Mobile Authentication with DPoP and FIDO

actor Person
participant App
participant Device
participant Device Keystore
participant Auth Server
participant Fido2 Server
participant API
participant App Store

fontfamily mono

critical Download App
Person->App Store: Search for App
Device<->App Store: Install App
end 

critical Dynamic Client Registration
Person->App: Start App
App<->Device: Get Device info
Device<->Device Keystore: Generate keys
Device->Auth Server: /register : Send public key\nfor client authn + app attestation
Auth Server->Auth Server: validate\napp attestation
alt attestation good
Auth Server->Device: client registration response
else attestation bad
Auth Server->Device: 400 {"error":"bad_attestation",\n"error_description": "Server verification of app attestation failed"}
end
end

alt Enrollment (First time using app)

Person<->App: uid / pw\n(future: NFC card,\n or verifiable credential)
App->Auth Server: POST /authz-challenge \n  {"acr_values":"pw-enroll",\n  "client_id":"1234",\n  "scope":"authz-challenge"}
Auth Server->Auth Server: validate pw
App<->Fido2 Server: FIDO biometric enrollment
Auth Server->App: code
end
 
alt Call API
App->Auth Server: POST /authz-challenge \n  {"acr_values":"fido2",\n  "client_id":"1234",\n  "scope":"authz-challenge"}
Auth Server->App: 403 Forbidden\n  {"error": "authorization_required",\n   "device_session":"uY29tL2F1dGhlbnRpY"}
loop authn required because id_token invalid
App->Device: Android / iOS\nFIDO API
Person<->Device: present biometric
App->Fido2 Server: /fido 2: Find user by keyHandle+RP, check fido2 response signature
Fido2 Server-> App: Mint token with type fido2
App->Auth Server: POST /authz-challenge\n  {"acr_values":"fido2",\n  "client_id":"1234",\n  "scope":"xyz",\n  "device_session":"uY29tL2F1dGhlbnRpY",\n  "fido2_token":"9d2d-848919ce89c9"}
Auth Server->Auth Server: Verify fido2 token
Auth Server->App: code
end
App->Auth Server: /token\ncode + private key authn
Auth Server->App: Issue DPoP access_token
App->API: access_token
end

Paste Source here

See also: https://github.com/JanssenProject/jans/issues/5563