passkeyRows = this.driver.findElements(passkeyTableRows());
+ assertThat(passkeyRows).hasSize(1)
+ .first()
+ .extracting((row) -> row.findElement(firstCell()))
+ .extracting(WebElement::getText)
+ .isEqualTo("Virtual authenticator");
+
+ // Step 3: log out
+ logout();
+
+ // Step 4: log in with the virtual authenticator
+ this.driver.get(this.baseUrl + "/webauthn/register");
+ this.driver.findElement(signinWithPasskeyButton()).click();
+ await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/webauthn/register?continue"));
+ }
+
+ /**
+ * Add a virtual authenticator.
+ *
+ * Note that Selenium docs for {@link HasCdp} strongly encourage to use
+ * {@link HasDevTools} instead. However, devtools require more dependencies and
+ * boilerplate, notably to sync the Devtools-CDP version with the current browser
+ * version, whereas CDP runs out of the box.
+ *
+ * @param userIsVerified whether the authenticator simulates user verification.
+ * Setting it to false will make the ceremonies fail.
+ * @see https://chromedevtools.github.io/devtools-protocol/tot/WebAuthn/
+ */
+ private void createVirtualAuthenticator(boolean userIsVerified) {
+ HasCdp cdpDriver = (HasCdp) this.driver;
+ cdpDriver.executeCdpCommand("WebAuthn.enable", Map.of("enableUI", false));
+ // this.driver.addVirtualAuthenticator(createVirtualAuthenticatorOptions());
+ //@formatter:off
+ cdpDriver.executeCdpCommand("WebAuthn.addVirtualAuthenticator",
+ Map.of(
+ "options",
+ Map.of(
+ "protocol", "ctap2",
+ "transport", "usb",
+ "hasUserVerification", true,
+ "hasResidentKey", true,
+ "isUserVerified", userIsVerified,
+ "automaticPresenceSimulation", true
+ )
+ ));
+ //@formatter:on
+ }
+
+ private void login() {
+ this.driver.get(this.baseUrl);
+ this.driver.findElement(usernameField()).sendKeys(USERNAME);
+ this.driver.findElement(passwordField()).sendKeys(PASSWORD);
+ this.driver.findElement(signinWithUsernamePasswordButton()).click();
+ }
+
+ private void logout() {
+ this.driver.get(this.baseUrl + "/logout");
+ this.driver.findElement(logoutButton()).click();
+ await(() -> assertThat(this.driver.getCurrentUrl()).endsWith("/login?logout"));
+ }
+
+ private AbstractStringAssert assertHasAlertStartingWith(String alertType, String alertMessage) {
+ WebElement alert = this.driver.findElement(new By.ById(alertType));
+ assertThat(alert.isDisplayed())
+ .withFailMessage(
+ () -> alertType + " alert was not displayed. Full page source:\n\n" + this.driver.getPageSource())
+ .isTrue();
+
+ return assertThat(alert.getText()).startsWith(alertMessage);
+ }
+
+ /**
+ * Await until the assertion passes. If the assertion fails, it will display the
+ * assertion error in stdout.
+ */
+ private void await(Supplier> assertion) {
+ new FluentWait<>(this.driver).withTimeout(Duration.ofSeconds(2))
+ .pollingEvery(Duration.ofMillis(100))
+ .ignoring(AssertionError.class)
+ .until((d) -> {
+ assertion.get();
+ return true;
+ });
+ }
+
+ private static By.ById passkeyLabel() {
+ return new By.ById("label");
+ }
+
+ private static By.ById registerPasskeyButton() {
+ return new By.ById("register");
+ }
+
+ private static By.ByCssSelector passkeyTableRows() {
+ return new By.ByCssSelector("table > tbody > tr");
+ }
+
+ private static By.ByCssSelector firstCell() {
+ return new By.ByCssSelector("td:first-child");
+ }
+
+ private static By.ById passwordField() {
+ return new By.ById(PASSWORD);
+ }
+
+ private static By.ById usernameField() {
+ return new By.ById("username");
+ }
+
+ private static By.ByCssSelector signinWithUsernamePasswordButton() {
+ return new By.ByCssSelector("form > button[type=\"submit\"]");
+ }
+
+ private static By.ById signinWithPasskeyButton() {
+ return new By.ById("passkey-signin");
+ }
+
+ private static By.ByCssSelector logoutButton() {
+ return new By.ByCssSelector("button");
+ }
+
+ /**
+ * The configuration for WebAuthN tests. It accesses the Server's current port, so we
+ * can configurer WebAuthnConfigurer#allowedOrigin
+ */
+ @Configuration
+ @EnableWebMvc
+ @EnableWebSecurity
+ static class WebAuthnConfiguration {
+
+ @Bean
+ UserDetailsService userDetailsService() {
+ return new InMemoryUserDetailsManager(
+ User.withDefaultPasswordEncoder().username(USERNAME).password(PASSWORD).build());
+ }
+
+ @Bean
+ FilterChainProxy securityFilterChain(HttpSecurity http, Environment environment) throws Exception {
+ SecurityFilterChain securityFilterChain = http
+ .authorizeHttpRequests((auth) -> auth.anyRequest().authenticated())
+ .formLogin(Customizer.withDefaults())
+ .webAuthn((passkeys) -> passkeys.rpId("localhost")
+ .rpName("Spring Security WebAuthN tests")
+ .allowedOrigins("http://localhost:" + environment.getProperty("server.port")))
+ .build();
+ return new FilterChainProxy(securityFilterChain);
+ }
+
+ }
+
+}