Skip to content

Fix push signature verification: include question in the signed string#116

Open
sysrow wants to merge 1 commit into
eduMFA:mainfrom
sysrow:fix/push-signature-question
Open

Fix push signature verification: include question in the signed string#116
sysrow wants to merge 1 commit into
eduMFA:mainfrom
sysrow:fix/push-signature-question

Conversation

@sysrow
Copy link
Copy Markdown

@sysrow sysrow commented May 24, 2026

The eduMFA server signs the push challenge as
{nonce}|{url}|{serial}|{question}|{title}|{sslverify} (6 fields). Upstream
commit 031858d ("Remove question from push request payload and replace it
with a static localizable question") dropped question from the payload and,
with it, from the signed-string reconstruction. The app now rebuilds only
5 fields, so the RSA signature of every incoming challenge fails to verify,
the request is rejected before the dialog is shown, and push approval is
impossible against a stock eduMFA server.

Re-add question to PushRequest (model, JSON, identifier) and insert it into
the signed string in the position the server uses. The on-screen text stays
the static localized question introduced by 031858d; question is used only
to reconstruct the signed payload, not for display.

The eduMFA server signs the push challenge as
{nonce}|{url}|{serial}|{question}|{title}|{sslverify} (6 fields). Upstream
commit 031858d ("Remove question from push request payload and replace it
with a static localizable question") dropped question from the payload and,
with it, from the signed-string reconstruction. The app now rebuilds only
5 fields, so the RSA signature of every incoming challenge fails to verify,
the request is rejected before the dialog is shown, and push approval is
impossible against a stock eduMFA server.

Re-add question to PushRequest (model, JSON, identifier) and insert it into
the signed string in the position the server uses. The on-screen text stays
the static localized question introduced by 031858d; question is used only
to reconstruct the signed payload, not for display.
@Luc1412
Copy link
Copy Markdown
Member

Luc1412 commented May 26, 2026

I didn't encounter this problem yet within my eduMFA testing setup yet. Could this be related to question being customized or not?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants