Enterprise Attestation

As the title reads, I’m researching how to do enterprise attestation where the the devices serial number is attested to reduce the incidence of spam account creation.

Among other settings, it requires enterprise as the value for credentialCreationData.attestationConveyancePreferenceOption during registration.

I appreciate any insight from the community, and it may turn out this is supported by all good webauthn RP and clients by default. I’m not sure.

[mangoplane]

Also I have an issue to raise, around how the current JSON seraliser is semi-broken, insofar as it doesn’t work with Swagger client code gen without having to make manual changes to the code generated client.

For starters, the Enum attribute names that are linted above each enum value aren’t respected, so what should be “xyz” is “XYZ” causing a lot of extra frontend work to get it working.

[aseigler]

I added enterprise as an option in #277. I don’t think there is anything defined for an RP to do with it, it’s more for the client to tell the user that the registration is going to supply the RP with the make/model/serial number of the authenticator, and that the authenticator supply the serial number in the attestation statement so the RP can ensure the user is registering the device with the serial number that was issued to that user.

I’ve never actually seen this kind of flow in action with a WebAuthn server, but this is a common scenario with smart card deployments.