Support MFA factor requirements like “WebAuthn ∨ (Password ∧ OTT)”

Expected Behavior

WebAuthn alone with user verification is often regarded as MFA in a single gesture. When building a website implementing 2FA, a developer may want to require that either WebAuthn is used for authentication, or a pair of traditional factors like “Password + One-time token” is provided.

It would be great if Spring Security can make such kind of MFA setup easier. With such a setup, a user who has authenticated with a passkey will be granted access; for a user who has only authenticated with his/her password, he/she should be redirected to reauthenticate with either OTT or passkey.

Current Behavior

Spring Security 7.0 only provides AllRequiredFactorsAuthorizationManager for MFA. There is no built-in way to express a logical OR relationship between factors.

The only MFA-related AuthorizationResult checked by DelegatingMissingAuthorityAccessDeniedHandler is FactorAuthorizationDecision constructed by AllRequiredFactorsAuthorizationManager.

Therefore, developers need to write and wire up custom AuthorizationManager and AccessDeniedHandler for a common MFA requirement like “WebAuthn ∨ (Password ∧ OTT)”.

Context

My intuition guided me to try the following configuration:

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) {
	var mfa = new DefaultAuthorizationManagerFactory<RequestAuthorizationContext>();
	mfa.setAdditionalAuthorization(AuthorizationManagers.anyOf(
		AllRequiredFactorsAuthorizationManager.<RequestAuthorizationContext>builder()
			.requireFactor(RequiredFactor.Builder::webauthnAuthority)
			.build(),
		AllRequiredFactorsAuthorizationManager.<RequestAuthorizationContext>builder()
			.requireFactor(RequiredFactor.Builder::passwordAuthority)
			.requireFactor(RequiredFactor.Builder::ottAuthority)
			.build()));
	http
		.formLogin(withDefaults())
		.oneTimeTokenLogin(withDefaults())
		.webAuthn(withDefaults())
		.authorizeHttpRequests(auth -> auth
			.requestMatchers("/webauthn/register/**").access(mfa.authenticated())
			.requestMatchers("/dashboard/**").access(mfa.authenticated())
			.anyRequest().permitAll());
	return http.build();
}

// For required user verification
@Bean
WebAuthnRelyingPartyOperations webAuthnRelyingPartyOperations(
		PublicKeyCredentialUserEntityRepository userEntities,
		UserCredentialRepository userCredentials) {
	var rpEntity = PublicKeyCredentialRpEntity.builder().id("localhost").name("localhost").build();
	var allowedOrigins = Set.of("http://localhost:8080");
	var operations = new Webauthn4JRelyingPartyOperations(userEntities, userCredentials, rpEntity, allowedOrigins);
	operations.setCustomizeRequestOptions(req ->
		req.userVerification(UserVerificationRequirement.REQUIRED));
	return operations;
}

The above configuration works when a user has authenticated with WebAuthn. However, if a user only provided his/her password, this setup simply rejects with a 403 error, instead of redirecting the user to provide a second factor.

This is because the AuthorizationManagers#anyOf(...) AuthorizationManager produces CompositeAuthorizationDecision, which is ignored by DelegatingMissingAuthorityAccessDeniedHandler#authorityErrors(AccessDeniedException).