Add support for EntraID FIDO2/WebAuthn authentication

[dpreetam]

EntraID supports device bound passkeys which are FIDO2 compliant and users webauthn protocol for end user authentication. With move towards phishing resistant authentication methods lack of support for passkeys by saml2aws makes it a weak link where administrators have to exempt it from fido2 requirements.

Users should be able to authenticate to EntraID SSO enabled AWS admin interface using WebAuthn protocol. Users should be able to sign-in with Yubikey/Security key with pin or Windows Hello for Business.

[seppestas]

I already did this for Okta in #1221. This works by using the Windows Hello platform Webautn API.

I'm not sure "Windows Hello" and "Windows Hello for Business" are the same here though. Looks like "Windows Hello for Business" is Windows Hello + extra features like passwordless options. I think/hope the Webauthn 2FA API is the same.

@dpreetam what are you looking for "Windows Hello" as 2nd factor through Webauthn, or "Windows Hello for Business" passwordless authentication?

I think it should be fairly straight-forward to support other SAML providers like AAD / EntraID. Is there some test EntraID environment I could use / set up to register and authenticate a Windows Hello Webauthn factor? If so, I would be willing to look into this.

@missingcharacter is there any documentation on the AAD / EntraID API? Specifically, what the mfaReq should look like for a Webauthn / FIDO2 response.

[seppestas]

This discussion pretty much describes the same as #912, but specifies AAD / EntraID as the IDP instead of Okta.

Would it make sense to create a "support FIDO2/Webauthn for X" (X being any IDP, not the new Twitter 😄) ticket / discussion?
Supporting FIDO2 MFA in the IDPs that support it should be fairly straight forward, because the FIDO2 spec is the same for all.

It could be worthwhile to also separate some of the common "FIDO2" functionality to prevent things like what is done in 37b5ef to add support for Webauthn MFA in Keycloak. Here the code from the Okta package is used to support Fido2 in Keycloak.

I still plan to one day add support for MacOS Touch ID, https://github.com/linux-credentials/libwebauthn and Android Fido2 API, especially since my GF now has a Macbook with Touch ID and I have an Android with fingerprint reader. I might as well test with multiple IDPs as well when I get to it.

However, because my use-case of Okta with Windows is already covered and my current job only has a Hackathon for 1 day per year, progress is slow...