authentication manager feature addition by JacobBarthelmeh · Pull Request #270 · wolfSSL/wolfHSM

JacobBarthelmeh · 2026-01-16T18:48:33Z

The authentication manager feature adds support for a user login and checking a users permissions for performing a group+action. The API was designed with PKCS11 in mind.

Some things of note:

I added a callback function framework for checking authorization of key use based on key ID and user permissions but did not tie in that check yet. I would like to tie that in later when/if needed. This currently checks for authorization of user for a group/action that they can do. Which ties a user ID to crypto actions done.
The user list in port/posix/posix_auth.c is a simple list not yet in NVM. This initial simplicity is deliberate.
There is a TODO listed for logging of authentication events. Login failures, success, crypto actions should have logging additions in the future.

Copilot

Pull request overview

This pull request adds a comprehensive authentication and authorization manager to wolfHSM, enabling user management, login/logout functionality, and permission-based access control for HSM operations.

Changes:

New authentication manager with PIN and certificate-based authentication support
Authorization system with group and action-level permission checks
User management APIs for adding, deleting, and modifying users and their credentials
Complete client and server implementation with message translation support

Reviewed changes

Copilot reviewed 22 out of 23 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
wolfhsm/wh_auth.h	Core auth manager types, structures, and API definitions
wolfhsm/wh_message_auth.h	Message structures and translation functions for auth operations
wolfhsm/wh_server_auth.h	Server-side auth request handler declaration
wolfhsm/wh_client.h	Client-side auth API function declarations
wolfhsm/wh_server.h	Server context updated with auth context pointer
wolfhsm/wh_message.h	New auth message group and action enums
wolfhsm/wh_error.h	New auth-specific error codes
src/wh_auth.c	Core auth manager implementation with callback wrappers
src/wh_message_auth.c	Message translation implementations for auth messages
src/wh_server_auth.c	Server-side request handler for auth operations
src/wh_client_auth.c	Client-side auth API implementations
src/wh_server.c	Server integration with authorization checks
src/wh_client.c	Minor formatting fixes
port/posix/posix_auth.h	POSIX auth backend declarations
port/posix/posix_auth.c	POSIX auth backend implementation with in-memory user storage
test/wh_test_auth.h	Auth test suite declarations
test/wh_test_auth.c	Comprehensive auth test suite implementation
test/wh_test.c	Test integration for auth tests
examples/posix/wh_posix_server/*	Server configuration with auth context setup
examples/demo/client/wh_demo_client_all.c	Demo integration for auth

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

wolfhsm/wh_client.h

test/wh_test_auth.c

port/posix/posix_auth.c

wolfhsm/wh_message_auth.h

wolfhsm/wh_client.h

Copilot

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

port/posix/posix_auth.c

src/wh_message_auth.c

port/posix/posix_auth.c

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

examples/demo/client/wh_demo_client_auth.c

bigbrett · 2026-01-22T17:25:38Z

@JacobBarthelmeh merge conflicts

JacobBarthelmeh · 2026-01-22T17:39:23Z

Force pushed to resolve merge conflict.

Copilot

Pull request overview

Copilot reviewed 28 out of 29 changed files in this pull request and generated 17 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

src/wh_auth_base.c

src/wh_auth.c

src/wh_server_auth.c

test/wh_test_clientserver.c

src/wh_client_auth.c

src/wh_server_auth.c

src/wh_message_auth.c

src/wh_client_auth.c

port/posix/posix_auth.c

…g WOLFHSM_CFG_ENABLE_AUTHENTICATION

…port auth

…ouch up for test cases

…ove unused enum

…d test that authorization callback override is being called when set

…ique max credentials, add force zero to utils

… to auth translation layer, admin user add restriction, duplicate user name restriction

Copilot

Pull request overview

Copilot reviewed 41 out of 43 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-13T16:59:54Z

wolfhsm/wh_server.h

@@ -138,6 +139,7 @@ typedef struct {
 typedef struct whServerConfig_t {
    whCommServerConfig* comm_config;
    whNvmContext*       nvm;
+    whAuthContext*      auth;

 #ifndef WOLFHSM_CFG_NO_CRYPTO
    whServerCryptoContext* crypto;
@@ -160,6 +162,7 @@ typedef struct whServerConfig_t {
 /* Context structure to maintain the state of an HSM server */
 struct whServerContext_t {
    whNvmContext* nvm;
+    whAuthContext* auth;
    whCommServer  comm[1];


whServerConfig / whServerContext now unconditionally include whAuthContext* auth and #include "wolfhsm/wh_auth.h", which changes the public struct layout/ABI even when authentication is not enabled. If auth is meant to be optional (as other features are), consider wrapping the include and these struct members in #ifdef WOLFHSM_CFG_ENABLE_AUTHENTICATION (or adding an opaque extension pointer) to avoid forcing an ABI break and extra footprint in non-auth builds.

Copilot · 2026-04-13T16:59:54Z

src/wh_client_auth.c

+    size_t len;
+
+    if (username == NULL) {
+        return 0;
+    }
+
+    len = strnlen(username, WH_MESSAGE_AUTH_MAX_USERNAME_LEN);
+    return (len < WH_MESSAGE_AUTH_MAX_USERNAME_LEN);


_UserNameIsValid() relies on strnlen(), which is not ISO C90/C99 and may not exist on some embedded/libc configurations. Also, it currently accepts the empty string as a valid username. Consider switching to a small bounded loop (or memchr) for portability and require username[0] != '\0' to prevent empty-user edge cases.

Suggested change

size_t len;

if (username == NULL) {

return 0;

}

len = strnlen(username, WH_MESSAGE_AUTH_MAX_USERNAME_LEN);

return (len < WH_MESSAGE_AUTH_MAX_USERNAME_LEN);

size_t i;

if (username == NULL || username[0] == '\0') {

return 0;

}

for (i = 0; i < WH_MESSAGE_AUTH_MAX_USERNAME_LEN; i++) {

if (username[i] == '\0') {

return 1;

}

}

return 0;

Copilot · 2026-04-13T16:59:55Z

src/wh_utils.c

+/* Secure zeroization that resists compiler optimization.
+ * Uses volatile to prevent the compiler from optimizing away the writes. */
+void wh_Utils_ForceZero(void* mem, uint32_t size)
+{
+    volatile uint8_t* p = (volatile uint8_t*)mem;
+    while (size > 0) {
+        *p = 0;
+        p++;
+        size--;
+    }
+}


wh_Utils_ForceZero() will dereference mem when size > 0 even if mem == NULL, which can crash callers. Consider guarding if (mem == NULL || size == 0) return; (and optionally using memset_s/explicit_bzero where available) so it’s safe as a general-purpose utility.

Copilot · 2026-04-13T16:59:55Z

src/wh_auth_base.c

+static whAuthBase_User* wh_Auth_BaseCheckPin(const char* username,
+                                             const void* auth_data,
+                                             uint16_t    auth_data_len)
+{
+    whAuthBase_User* found_user;
+    unsigned char    authCheck[WH_AUTH_BASE_MAX_CREDENTIALS_LEN];
+    uint16_t         authCheck_len;
+    int              rc;
+
+    /* Process auth_data: hash if crypto enabled, copy if disabled */
+    rc = wh_Auth_BaseHashPin(auth_data, auth_data_len, authCheck);
+    if (rc != WH_ERROR_OK) {
+        return NULL;
+    }
+#ifndef WOLFHSM_CFG_NO_CRYPTO
+    authCheck_len = WC_SHA256_DIGEST_SIZE;
+#else
+    authCheck_len = auth_data_len;
+#endif /* WOLFHSM_CFG_NO_CRYPTO */
+
+    found_user = wh_Auth_BaseFindUser(username);
+    if (found_user != NULL && found_user->method == WH_AUTH_METHOD_PIN &&
+        found_user->credentials_len == authCheck_len &&
+        wh_Utils_ConstantCompare(found_user->credentials, authCheck,
+        authCheck_len) == 0) {
+        return found_user;
+    }
+    return NULL;


wh_Auth_BaseCheckPin() leaves the derived credential material (authCheck) on the stack after returning. Since this buffer contains a PIN hash / PIN copy (when NO_CRYPTO), consider zeroizing authCheck (and any temporary hashes) with wh_Utils_ForceZero() before returning to reduce credential lifetime in memory.

Copilot · 2026-04-13T16:59:55Z

src/wh_auth.c

+/* Pick up compile-time configuration */
+#include "wolfhsm/wh_settings.h"
+
+#include <stdint.h>
+#include <stddef.h>
+#include <string.h>
+
+#include "wolfhsm/wh_common.h"
+#include "wolfhsm/wh_error.h"
+
+#include "wolfhsm/wh_auth.h"
+#include "wolfhsm/wh_message_auth.h"
+


Auth sources (e.g., this file) are compiled unconditionally, while other optional subsystems (e.g., certificate manager: src/wh_message_cert.c) are fully gated by feature macros. If WOLFHSM_CFG_ENABLE_AUTHENTICATION is intended to exclude auth code from non-auth builds (as docs state), consider wrapping these implementations in #ifdef WOLFHSM_CFG_ENABLE_AUTHENTICATION and providing minimal stubs (returning WH_AUTH_NOT_ENABLED) when disabled.

JacobBarthelmeh self-assigned this Jan 16, 2026

JacobBarthelmeh requested a review from Copilot January 16, 2026 18:48

Copilot started reviewing on behalf of JacobBarthelmeh January 16, 2026 18:49 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot January 16, 2026 21:50

Copilot started reviewing on behalf of JacobBarthelmeh January 16, 2026 21:50 View session

Copilot AI reviewed Jan 16, 2026

View reviewed changes

port/posix/posix_auth.c Outdated Show resolved Hide resolved

src/wh_message_auth.c Show resolved Hide resolved

port/posix/posix_auth.c Outdated Show resolved Hide resolved

JacobBarthelmeh force-pushed the auth_manager branch 2 times, most recently from 6b32384 to 1bd722a Compare January 19, 2026 22:06

JacobBarthelmeh requested a review from Copilot January 19, 2026 22:17

Copilot started reviewing on behalf of JacobBarthelmeh January 19, 2026 22:18 View session

Copilot AI reviewed Jan 19, 2026

View reviewed changes

JacobBarthelmeh requested a review from Copilot January 20, 2026 17:27

JacobBarthelmeh marked this pull request as ready for review January 20, 2026 17:30

JacobBarthelmeh assigned bigbrett, wolfSSL-Bot and billphipps and unassigned JacobBarthelmeh Jan 20, 2026

Copilot started reviewing on behalf of JacobBarthelmeh January 20, 2026 17:37 View session

Copilot AI reviewed Jan 20, 2026

View reviewed changes

examples/demo/client/wh_demo_client_auth.c Outdated Show resolved Hide resolved

examples/demo/client/wh_demo_client_auth.c Outdated Show resolved Hide resolved

bigbrett assigned JacobBarthelmeh Jan 22, 2026

JacobBarthelmeh force-pushed the auth_manager branch from 04bd058 to 4d0af48 Compare January 22, 2026 17:38

JacobBarthelmeh requested a review from Copilot January 22, 2026 20:33

Copilot started reviewing on behalf of JacobBarthelmeh January 22, 2026 20:34 View session

Copilot AI reviewed Jan 22, 2026

View reviewed changes

JacobBarthelmeh unassigned bigbrett, wolfSSL-Bot and billphipps Jan 22, 2026

JacobBarthelmeh added 26 commits April 13, 2026 10:48

update action permissions and method in message layer

2c136a9

fix for bitmask of permissions and remove permissions return from login

be00dc0

add auth login as admin during SHE tests

b6a9ff5

update posix client auth demo for new login function signature

46fb2fb

touch up of comments and demo

9a2e44e

Fix typo and remove redundent return value check

9e9fc47

account for no WOLFHSM_CFG_ENABLE_SERVER build with test case

918f5f8

addressing some feedback about sanity checks and null string terminators

dfd87e0

update login comments and add defensive memset's

186996c

add hashing of example pin, use of WH_ERROR_OK, update comment

879d608

make the authentication feature off by default and enabled by definin…

f5d1a76

…g WOLFHSM_CFG_ENABLE_AUTHENTICATION

add server simple response back of auth not enabled

d22ad58

add WH_TEST_SKIP and authentication skipping when server does not sup…

07c88c1

…port auth

move most of authentication logic into wolfHSM rather than in port, t…

a5405f3

…ouch up for test cases

fix for scan-build warning

39c2103

spelling fix, additional sanity checks

6301993

add flag to avoid gcc coverage bug 68080

4a6d222

use boolean array for group permissions, fix permissions bitmask, rem…

31b7a90

…ove unused enum

add locks around user login / modify sections of code for thread safety

0050bdd

move base implementation from port/posix to src/wh_auth_base.c and ad…

4e6697a

…d test that authorization callback override is being called when set

git-clang-format, add additional sanity checks, add lock for auth check

ab3bfca

add admin boolean to permissions, aditional delete user test case, un…

724cafe

…ique max credentials, add force zero to utils

add a WH_MESSAGE_GROUP_MAX and use it to get the number of groups

05adbf0

add constant compare utils function, permissions helper macros, fixes…

4fd04bf

… to auth translation layer, admin user add restriction, duplicate user name restriction

add authentication documentation

93e2219

sanity checks on input and adjust return value

bebc912

JacobBarthelmeh force-pushed the auth_manager branch from 0c79e67 to bebc912 Compare April 13, 2026 16:48

Copilot AI review requested due to automatic review settings April 13, 2026 16:48

Copilot started reviewing on behalf of JacobBarthelmeh April 13, 2026 16:52 View session

Copilot AI reviewed Apr 13, 2026

View reviewed changes

Conversation

JacobBarthelmeh commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

bigbrett commented Jan 22, 2026

Uh oh!

JacobBarthelmeh commented Jan 22, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 13, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

JacobBarthelmeh commented Jan 16, 2026 •

edited

Loading