authentication manager feature addition by JacobBarthelmeh · Pull Request #270 · wolfSSL/wolfHSM

JacobBarthelmeh · 2026-01-16T18:48:33Z

The authentication manager feature adds support for a user login and checking a users permissions for performing a group+action. The API was designed with PKCS11 in mind.

Some things of note:

I added a callback function framework for checking authorization of key use based on key ID and user permissions but did not tie in that check yet. I would like to tie that in later when/if needed. This currently checks for authorization of user for a group/action that they can do. Which ties a user ID to crypto actions done.
The user list in port/posix/posix_auth.c is a simple list not yet in NVM. This initial simplicity is deliberate.
There is a TODO listed for logging of authentication events. Login failures, success, crypto actions should have logging additions in the future.

Copilot

Pull request overview

This pull request adds a comprehensive authentication and authorization manager to wolfHSM, enabling user management, login/logout functionality, and permission-based access control for HSM operations.

Changes:

New authentication manager with PIN and certificate-based authentication support
Authorization system with group and action-level permission checks
User management APIs for adding, deleting, and modifying users and their credentials
Complete client and server implementation with message translation support

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfhsm/wh_auth.h	Core auth manager types, structures, and API definitions
wolfhsm/wh_message_auth.h	Message structures and translation functions for auth operations
wolfhsm/wh_server_auth.h	Server-side auth request handler declaration
wolfhsm/wh_client.h	Client-side auth API function declarations
wolfhsm/wh_server.h	Server context updated with auth context pointer
wolfhsm/wh_message.h	New auth message group and action enums
wolfhsm/wh_error.h	New auth-specific error codes
src/wh_auth.c	Core auth manager implementation with callback wrappers
src/wh_message_auth.c	Message translation implementations for auth messages
src/wh_server_auth.c	Server-side request handler for auth operations
src/wh_client_auth.c	Client-side auth API implementations
src/wh_server.c	Server integration with authorization checks
src/wh_client.c	Minor formatting fixes
port/posix/posix_auth.h	POSIX auth backend declarations
port/posix/posix_auth.c	POSIX auth backend implementation with in-memory user storage
test/wh_test_auth.h	Auth test suite declarations
test/wh_test_auth.c	Comprehensive auth test suite implementation
test/wh_test.c	Test integration for auth tests
examples/posix/wh_posix_server/*	Server configuration with auth context setup
examples/demo/client/wh_demo_client_all.c	Demo integration for auth

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bigbrett · 2026-01-22T17:25:38Z

@JacobBarthelmeh merge conflicts

JacobBarthelmeh · 2026-01-22T17:39:23Z

Force pushed to resolve merge conflict.

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 17 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ove unused enum

…d test that authorization callback override is being called when set

…ique max credentials, add force zero to utils

… to auth translation layer, admin user add restriction, duplicate user name restriction

Copilot

Pull request overview

Copilot reviewed 41 out of 43 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #270

Scan targets checked: wolfhsm-consttime, wolfhsm-core-bugs, wolfhsm-defaults, wolfhsm-mutation, wolfhsm-proptest, wolfhsm-src, wolfhsm-zeroize

Findings: 7
7 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

…ve data before function return

Copilot

Pull request overview

Copilot reviewed 41 out of 43 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (1)

wolfhsm/wh_auth.h:1

The comment says this macro enables the group and only the given action bit, but the implementation ORs the bit into the existing mask (it does not clear other action bits). Either update the comment to match behavior ("enables the given action bit") or change the macro to clear all action words for the group before setting the single bit.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 42 out of 44 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

bigbrett

As discussed offline, one blocking bugfix needed, as well as a documentation update to tag this feature as experimental. I will post a list of the other issues found in a subsequent review that can then be addressed with follow-up PRs

bigbrett · 2026-04-17T22:06:45Z

+        /* do not allow duplicate users with same name */
+        if (strcmp(users[i].user.username, username) == 0) {
+            return WH_ERROR_BADARGS;
+        }


The uniqueness loop in UserAdd breaks at the first empty slot instead of scanning the whole array. UserDelete zeroes slots in place without compacting, so any delete creates a gap that blinds the check to everything past it.

The attack (identity confusion / lockout):

State: [0]=bob, [1]=admin.

Admin deletes bob → [0]=empty, [1]=admin.

Attacker with USER_ADD perm calls UserAdd(username="admin", ...) with their own PIN.

Loop breaks at slot 0 (empty), never scans slot 1 → duplicate admin is inserted.

FindUser("admin") returns the first match → always the impostor.

Real admin's login fails (PIN doesn't match impostor's hash) = locked out. Attacker logs in as "admin" at their own (non-admin) permissions = identity confusion.

Key insight: The attacker doesn't gain admin rights — they gain the name "admin", which is enough to shadow the real account in every name-based lookup.

Fix: Two-pass the loop — scan all slots for duplicates, then find a free slot. Or compact the array on delete.

… is a experimental feature in development

JacobBarthelmeh self-assigned this Jan 16, 2026

JacobBarthelmeh requested a review from Copilot January 16, 2026 18:48

Copilot started reviewing on behalf of JacobBarthelmeh January 16, 2026 18:49 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot January 16, 2026 21:50

Copilot started reviewing on behalf of JacobBarthelmeh January 16, 2026 21:50 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

Comment thread port/posix/posix_auth.c Outdated

Comment thread src/wh_message_auth.c

Comment thread port/posix/posix_auth.c Outdated

JacobBarthelmeh force-pushed the auth_manager branch 2 times, most recently from 6b32384 to 1bd722a Compare January 19, 2026 22:06

JacobBarthelmeh requested a review from Copilot January 19, 2026 22:17

Copilot started reviewing on behalf of JacobBarthelmeh January 19, 2026 22:18 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot January 20, 2026 17:27

JacobBarthelmeh marked this pull request as ready for review January 20, 2026 17:30

JacobBarthelmeh assigned bigbrett, wolfSSL-Bot and billphipps and unassigned JacobBarthelmeh Jan 20, 2026

Copilot started reviewing on behalf of JacobBarthelmeh January 20, 2026 17:37 View session

Copilot AI reviewed Jan 20, 2026

View reviewed changes

Comment thread examples/demo/client/wh_demo_client_auth.c Outdated

Comment thread examples/demo/client/wh_demo_client_auth.c Outdated

bigbrett assigned JacobBarthelmeh Jan 22, 2026

JacobBarthelmeh force-pushed the auth_manager branch from 04bd058 to 4d0af48 Compare January 22, 2026 17:38

JacobBarthelmeh requested a review from Copilot January 22, 2026 20:33

Copilot started reviewing on behalf of JacobBarthelmeh January 22, 2026 20:34 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

JacobBarthelmeh unassigned bigbrett, wolfSSL-Bot and billphipps Jan 22, 2026

JacobBarthelmeh added 12 commits April 13, 2026 10:48

fix for scan-build warning

39c2103

spelling fix, additional sanity checks

6301993

add flag to avoid gcc coverage bug 68080

4a6d222

use boolean array for group permissions, fix permissions bitmask, rem…

31b7a90

…ove unused enum

add locks around user login / modify sections of code for thread safety

0050bdd

move base implementation from port/posix to src/wh_auth_base.c and ad…

4e6697a

…d test that authorization callback override is being called when set

git-clang-format, add additional sanity checks, add lock for auth check

ab3bfca

add admin boolean to permissions, aditional delete user test case, un…

724cafe

…ique max credentials, add force zero to utils

add a WH_MESSAGE_GROUP_MAX and use it to get the number of groups

05adbf0

add constant compare utils function, permissions helper macros, fixes…

4fd04bf

… to auth translation layer, admin user add restriction, duplicate user name restriction

add authentication documentation

93e2219

sanity checks on input and adjust return value

bebc912

JacobBarthelmeh force-pushed the auth_manager branch from 0c79e67 to bebc912 Compare April 13, 2026 16:48

Copilot AI review requested due to automatic review settings April 13, 2026 16:48

Copilot started reviewing on behalf of JacobBarthelmeh April 13, 2026 16:52 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread wolfhsm/wh_server.h

Comment thread src/wh_client_auth.c

Comment thread src/wh_utils.c

Comment thread src/wh_auth_base.c Outdated

Comment thread src/wh_auth.c

JacobBarthelmeh requested review from Copilot and wolfSSL-Fenrir-bot April 13, 2026 22:29

JacobBarthelmeh force-pushed the auth_manager branch from a6b484b to fce94f6 Compare April 13, 2026 22:54

wolfSSL-Fenrir-bot reviewed Apr 13, 2026

View reviewed changes

Comment thread src/wh_auth_base.c

Comment thread src/wh_auth_base.c

Comment thread src/wh_auth_base.c

Comment thread src/wh_auth.c

Comment thread src/wh_server.c

Comment thread src/wh_auth_base.c

Comment thread src/wh_auth_base.c Outdated

add more macro guards around authentication feature, zero out sensiti…

6dfa0cf

…ve data before function return

JacobBarthelmeh force-pushed the auth_manager branch from fce94f6 to 6dfa0cf Compare April 13, 2026 22:57

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Comment thread src/wh_server.c

Comment thread src/wh_server_auth.c

Comment thread src/wh_client_auth.c

Comment thread src/wh_auth_base.c

Comment thread src/wh_auth_base.c Outdated

Comment thread test/wh_test_common.h

JacobBarthelmeh added 4 commits April 14, 2026 22:21

add more force zero calls and remove dead code path

4514d0c

results from git-clang-format

89976cf

remove const on input buffer that gets zeroized

b368ee0

adjust test case to account of SECEVNT log when auth enabled but not set

fa54634

Copilot AI reviewed Apr 16, 2026

View reviewed changes

Comment thread src/wh_server.c

Comment thread wolfhsm/wh_message_auth.h

bigbrett requested changes Apr 17, 2026

View reviewed changes

fix for duplicate user check and update documentation to clarify auth…

80c8d60

… is a experimental feature in development

Conversation

JacobBarthelmeh commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

bigbrett commented Jan 22, 2026

Uh oh!

JacobBarthelmeh commented Jan 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #270

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JacobBarthelmeh commented Jan 16, 2026 •

edited

Loading