authentication manager feature addition by JacobBarthelmeh · Pull Request #270 · wolfSSL/wolfHSM

JacobBarthelmeh · 2026-01-16T18:48:33Z

The authentication manager feature adds support for a user login and checking a users permissions for performing a group+action. The API was designed with PKCS11 in mind.

Some things of note:

I added a callback function framework for checking authorization of key use based on key ID and user permissions but did not tie in that check yet. I would like to tie that in later when/if needed. This currently checks for authorization of user for a group/action that they can do. Which ties a user ID to crypto actions done.
The user list in port/posix/posix_auth.c is a simple list not yet in NVM. This initial simplicity is deliberate.
There is a TODO listed for logging of authentication events. Login failures, success, crypto actions should have logging additions in the future.

Copilot

Pull request overview

This pull request adds a comprehensive authentication and authorization manager to wolfHSM, enabling user management, login/logout functionality, and permission-based access control for HSM operations.

Changes:

New authentication manager with PIN and certificate-based authentication support
Authorization system with group and action-level permission checks
User management APIs for adding, deleting, and modifying users and their credentials
Complete client and server implementation with message translation support

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfhsm/wh_auth.h	Core auth manager types, structures, and API definitions
wolfhsm/wh_message_auth.h	Message structures and translation functions for auth operations
wolfhsm/wh_server_auth.h	Server-side auth request handler declaration
wolfhsm/wh_client.h	Client-side auth API function declarations
wolfhsm/wh_server.h	Server context updated with auth context pointer
wolfhsm/wh_message.h	New auth message group and action enums
wolfhsm/wh_error.h	New auth-specific error codes
src/wh_auth.c	Core auth manager implementation with callback wrappers
src/wh_message_auth.c	Message translation implementations for auth messages
src/wh_server_auth.c	Server-side request handler for auth operations
src/wh_client_auth.c	Client-side auth API implementations
src/wh_server.c	Server integration with authorization checks
src/wh_client.c	Minor formatting fixes
port/posix/posix_auth.h	POSIX auth backend declarations
port/posix/posix_auth.c	POSIX auth backend implementation with in-memory user storage
test/wh_test_auth.h	Auth test suite declarations
test/wh_test_auth.c	Comprehensive auth test suite implementation
test/wh_test.c	Test integration for auth tests
examples/posix/wh_posix_server/*	Server configuration with auth context setup
examples/demo/client/wh_demo_client_all.c	Demo integration for auth

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfhsm/wh_client.h

test/wh_test_auth.c

port/posix/posix_auth.c

wolfhsm/wh_message_auth.h

wolfhsm/wh_client.h

Copilot

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

port/posix/posix_auth.c

src/wh_message_auth.c

port/posix/posix_auth.c

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

examples/demo/client/wh_demo_client_auth.c

bigbrett · 2026-01-22T17:25:38Z

@JacobBarthelmeh merge conflicts

JacobBarthelmeh · 2026-01-22T17:39:23Z

Force pushed to resolve merge conflict.

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 17 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/wh_auth_base.c

src/wh_auth.c

src/wh_server_auth.c

test/wh_test_clientserver.c

src/wh_client_auth.c

src/wh_server_auth.c

src/wh_message_auth.c

src/wh_client_auth.c

port/posix/posix_auth.c

…g WOLFHSM_CFG_ENABLE_AUTHENTICATION

…port auth

…ouch up for test cases

…ove unused enum

…d test that authorization callback override is being called when set

…ique max credentials, add force zero to utils

… to auth translation layer, admin user add restriction, duplicate user name restriction

JacobBarthelmeh · 2026-03-18T21:43:47Z

Rebased to resolve merge conflicts

Copilot

Pull request overview

Copilot reviewed 41 out of 43 changed files in this pull request and generated 9 comments.

Comments suppressed due to low confidence (1)

test/wh_test_crypto.c:1

The TEST_ADMIN_USERNAME / TEST_ADMIN_PIN definitions are duplicated across multiple test files (crypto/keywrap/she/clientserver/auth). Centralizing these in a shared header (e.g., test/wh_test_common.h) reduces the chance of inconsistencies and keeps test configuration in one place.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

src/wh_auth.c

+int wh_Auth_Logout(whAuthContext* context, whUserId user_id)
+{
+    int rc;
+
+    if ((context == NULL) || (context->cb == NULL) ||
+        (context->cb->Logout == NULL)) {
+        return WH_ERROR_BADARGS;
+    }
+
+    rc = WH_AUTH_LOCK(context);
+    if (rc == WH_ERROR_OK) {
+        rc = context->cb->Logout(context->context, context->user.user_id,
+            user_id);
+        if (rc == WH_ERROR_OK) {
+            /* Clear the user context */
+            memset(&context->user, 0, sizeof(whAuthUser));
+        }
+
+        (void)WH_AUTH_UNLOCK(context);
+    } /* LOCK() */
+    return rc;
+}


src/wh_server.c

+        if (server->auth != NULL) {
+            rc = wh_Auth_CheckRequestAuthorization(server->auth, group, action);
+            if (rc != WH_ERROR_OK) {
+                /* Authorization failed - format and send error response to
+                 * client */
+                int32_t  error_code = (int32_t)WH_AUTH_PERMISSION_ERROR;
+                uint16_t resp_size  = _FormatAuthErrorResponse(
+                    magic, group, action, error_code, data);


src/wh_server.c

+#ifdef WOLFHSM_CFG_ENABLE_AUTHENTICATION
+/* Helper to format an authorization error response for any group/action.
+ * All response structures have int32_t rc as the first field.
+ * Returns the response size to send. */
+static uint16_t _FormatAuthErrorResponse(uint16_t magic, uint16_t group,
+                                         uint16_t action, int32_t error_code,
+                                         void* resp_packet)
+{


src/wh_server.c

+        default:
+            /* For other groups, use minimum size (just rc field).
+             * Most response structures have int32_t rc as first field, so
+             * clients should be able to read at least the error code. If a
+             * group needs special handling, it can be added above. */
+            /* Error code already written above */
+            resp_size = sizeof(int32_t);
+            break;
+    }


src/wh_client_auth.c

+    rc = wh_Client_RecvResponse(c, &resp_group, &resp_action, &resp_size,
+                                buffer);
+    if (rc == WH_ERROR_OK) {
+        /* Validate response */
+        if ((resp_group != WH_MESSAGE_GROUP_AUTH) ||
+            (resp_action != WH_MESSAGE_AUTH_ACTION_LOGIN) ||
+            (resp_size != sizeof(whMessageAuth_LoginResponse))) {
+            rc = WH_ERROR_ABORTED;
+
+            /* check if server did not understand the request and responded with
+             * a simple error response */
+            if (resp_size == sizeof(whMessageAuth_SimpleResponse)) {
+                /* NOT accepting WH_ERROR_OK from server if we got a response
+                 * other than a login response */
+                if (out_rc != NULL && msg->rc != WH_ERROR_OK) {
+                    *out_rc = msg->rc;
+                    rc      = WH_ERROR_OK;
+                }
+            }
+        }
+        else {
+            /* Valid message */
+            if (out_rc != NULL) {
+                *out_rc = msg->rc;
+            }
+            if (out_user_id != NULL) {
+                *out_user_id = msg->user_id;
+            }
+        }
+    }


src/wh_auth_base.c

+int wh_Auth_BaseUserAdd(void* context, const char* username,
+                        whUserId* out_user_id, whAuthPermissions permissions,
+                        whAuthMethod method, const void* credentials,
+                        uint16_t credentials_len)
+{


src/wh_auth_base.c

+    for (i = 0; i < WH_AUTH_BASE_MAX_USERS; i++) {
+        if (users[i].user.user_id == WH_USER_ID_INVALID) {
+            break;
+        }
+
+        /* do not allow duplicate users with same name */
+        if (strcmp(users[i].user.username, username) == 0) {
+            return WH_ERROR_BADARGS;
+        }
+    }


src/wh_message_auth.c

+    expected_size = (uint16_t)(header_size + dest_header->auth_data_len);
+    if (dest_header->auth_data_len > WH_MESSAGE_AUTH_LOGIN_MAX_AUTH_DATA_LEN ||
+        src_size < expected_size) {
+        return WH_ERROR_BADARGS;
+    }


src/wh_message_auth.c

+    expected_size = (uint16_t)(header_size + dest_header->credentials_len);
+    if (dest_header->credentials_len > WH_MESSAGE_AUTH_USERADD_MAX_CREDENTIALS_LEN ||
+        src_size < expected_size) {
+        return WH_ERROR_BUFFER_SIZE;
+    }


JacobBarthelmeh self-assigned this Jan 16, 2026

JacobBarthelmeh requested a review from Copilot January 16, 2026 18:48

Copilot started reviewing on behalf of JacobBarthelmeh January 16, 2026 18:49 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot January 16, 2026 21:50

Copilot started reviewing on behalf of JacobBarthelmeh January 16, 2026 21:50 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

port/posix/posix_auth.c Outdated Show resolved Hide resolved

src/wh_message_auth.c Show resolved Hide resolved

port/posix/posix_auth.c Outdated Show resolved Hide resolved

JacobBarthelmeh force-pushed the auth_manager branch 2 times, most recently from 6b32384 to 1bd722a Compare January 19, 2026 22:06

JacobBarthelmeh requested a review from Copilot January 19, 2026 22:17

Copilot started reviewing on behalf of JacobBarthelmeh January 19, 2026 22:18 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot January 20, 2026 17:27

JacobBarthelmeh marked this pull request as ready for review January 20, 2026 17:30

JacobBarthelmeh assigned bigbrett, wolfSSL-Bot and billphipps and unassigned JacobBarthelmeh Jan 20, 2026

Copilot started reviewing on behalf of JacobBarthelmeh January 20, 2026 17:37 View session

Copilot AI reviewed Jan 20, 2026

View reviewed changes

examples/demo/client/wh_demo_client_auth.c Outdated Show resolved Hide resolved

examples/demo/client/wh_demo_client_auth.c Outdated Show resolved Hide resolved

bigbrett assigned JacobBarthelmeh Jan 22, 2026

JacobBarthelmeh force-pushed the auth_manager branch from 04bd058 to 4d0af48 Compare January 22, 2026 17:38

JacobBarthelmeh requested a review from Copilot January 22, 2026 20:33

Copilot started reviewing on behalf of JacobBarthelmeh January 22, 2026 20:34 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

JacobBarthelmeh unassigned bigbrett, wolfSSL-Bot and billphipps Jan 22, 2026

JacobBarthelmeh added 26 commits March 18, 2026 15:38

check in auth demo client files

2d8da52

update action permissions and method in message layer

da9ea3f

fix for bitmask of permissions and remove permissions return from login

f08485f

add auth login as admin during SHE tests

b8f8e52

update posix client auth demo for new login function signature

d2508bb

touch up of comments and demo

d06a3cd

Fix typo and remove redundent return value check

c974192

account for no WOLFHSM_CFG_ENABLE_SERVER build with test case

790cd36

addressing some feedback about sanity checks and null string terminators

f3c16ee

update login comments and add defensive memset's

6fac461

add hashing of example pin, use of WH_ERROR_OK, update comment

39b6d19

make the authentication feature off by default and enabled by definin…

55c197f

…g WOLFHSM_CFG_ENABLE_AUTHENTICATION

add server simple response back of auth not enabled

d095f70

add WH_TEST_SKIP and authentication skipping when server does not sup…

f2a5f06

…port auth

move most of authentication logic into wolfHSM rather than in port, t…

99d52e0

…ouch up for test cases

fix for scan-build warning

43d1cbc

spelling fix, additional sanity checks

7dfe1fb

add flag to avoid gcc coverage bug 68080

3726a0f

use boolean array for group permissions, fix permissions bitmask, rem…

9bb24a7

…ove unused enum

add locks around user login / modify sections of code for thread safety

116b113

move base implementation from port/posix to src/wh_auth_base.c and ad…

1425a22

…d test that authorization callback override is being called when set

git-clang-format, add additional sanity checks, add lock for auth check

c901ebd

add admin boolean to permissions, aditional delete user test case, un…

8f3a0be

…ique max credentials, add force zero to utils

add a WH_MESSAGE_GROUP_MAX and use it to get the number of groups

7d9f935

add constant compare utils function, permissions helper macros, fixes…

b22ace6

… to auth translation layer, admin user add restriction, duplicate user name restriction

add authentication documentation

104e5e1

Copilot AI review requested due to automatic review settings March 18, 2026 21:40

JacobBarthelmeh force-pushed the auth_manager branch from ae3efd5 to 104e5e1 Compare March 18, 2026 21:40

Copilot AI reviewed Mar 18, 2026

View reviewed changes

Conversation

JacobBarthelmeh commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

bigbrett commented Jan 22, 2026

Uh oh!

JacobBarthelmeh commented Jan 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JacobBarthelmeh commented Mar 18, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

JacobBarthelmeh commented Jan 16, 2026 •

edited

Loading