webauthn: add internal enterprise policy for universal WebAuthn access
This adds a new (internal_only, platform_only, per_profile) enterprise
policy WebAuthenticationAllowGoogleCorpRemoteRequestProxying. When
enabled, this policy gives the Google-internal origin for the Chrome
Remote Desktop client app (https://remotedesktop.corp.google.com) the
ability to bypass regular security checks for determining whether an
origin can claim a WebAuthn Relying Party ID (RP ID), so that the CRD
client can execute proxied WebAuthn API requests that originate on
remote hosts.
An additional command-line switch,
--webauthn-remote-request-proxying-allow-additional-origin,
allows granting the same capability to one additional origin, as long as
the enterprise policy is enabled. The origin passed to this flag needs
to be generally authorized to make WebAuthn requests (i.e. it needs to
be a secure HTTPS origin or http://localhost).
Enterprise policy and command-line switch are both gated on a
default-disabled feature flag.
Design doc:
https://docs.google.com/document/d/12x_DWJ6AyaHSCNYvWs-YoONmaEIp7dAdAC2l_jrQ2n8/edit#
Bug: 1231802, 1246145
Change-Id: I57b9d3bad1e8a9c8471fae6d86336740efc2a5e5
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3461752
Reviewed-by: Gabriel Charette <[email protected]>
Reviewed-by: Nicolas Ouellet-Payeur <[email protected]>
Reviewed-by: Avi Drissman <[email protected]>
Reviewed-by: Adam Langley <[email protected]>
Reviewed-by: Owen Min <[email protected]>
Commit-Queue: Martin Kreichgauer <[email protected]>
Cr-Commit-Position: refs/heads/main@{#973895}
diff --git a/chrome/browser/BUILD.gn b/chrome/browser/BUILD.gn
index ef66c096..4c8e3fd 100644
--- a/chrome/browser/BUILD.gn
+++ b/chrome/browser/BUILD.gn
@@ -4403,6 +4403,10 @@
"webauthn/chrome_authenticator_request_delegate.h",
"webauthn/observable_authenticator_list.cc",
"webauthn/observable_authenticator_list.h",
+ "webauthn/webauthn_pref_names.cc",
+ "webauthn/webauthn_pref_names.h",
+ "webauthn/webauthn_switches.cc",
+ "webauthn/webauthn_switches.h",
]
deps += [
":browser_themes",
