Skip to content

Commit d8c38db

Browse files
golbigolbi
committed
UY-1353 Updated yubico lib to the latest version;
fixed jackson cbor dependency version; dropped unused attestation code (which btw was hard to be updated)
1 parent 2c01ce5 commit d8c38db

File tree

5 files changed

+50
-162
lines changed

5 files changed

+50
-162
lines changed

‎fido/src/main/java/io/imunity/fido/credential/FidoCredentialInfo.java‎

Lines changed: 14 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -4,29 +4,24 @@
44
*/
55
package io.imunity.fido.credential;
66

7-
import com.fasterxml.jackson.annotation.JsonIgnore;
8-
import com.fasterxml.jackson.core.JsonProcessingException;
9-
import com.fasterxml.jackson.core.type.TypeReference;
10-
import com.yubico.webauthn.RegisteredCredential;
11-
import com.yubico.webauthn.attestation.Attestation;
12-
import com.yubico.webauthn.attestation.Transport;
13-
import com.yubico.webauthn.data.ByteArray;
14-
import org.apache.logging.log4j.LogManager;
15-
import org.apache.logging.log4j.Logger;
16-
import pl.edu.icm.unity.Constants;
7+
import static java.util.Objects.isNull;
178

189
import java.io.IOException;
1910
import java.util.Collections;
20-
import java.util.HashMap;
21-
import java.util.HashSet;
2211
import java.util.List;
23-
import java.util.Map;
2412
import java.util.Objects;
2513
import java.util.Optional;
26-
import java.util.Set;
2714

28-
import static java.util.Objects.isNull;
29-
import static java.util.Objects.nonNull;
15+
import org.apache.logging.log4j.LogManager;
16+
import org.apache.logging.log4j.Logger;
17+
18+
import com.fasterxml.jackson.annotation.JsonIgnore;
19+
import com.fasterxml.jackson.core.JsonProcessingException;
20+
import com.fasterxml.jackson.core.type.TypeReference;
21+
import com.yubico.webauthn.RegisteredCredential;
22+
import com.yubico.webauthn.data.ByteArray;
23+
24+
import pl.edu.icm.unity.Constants;
3025

3126
/**
3227
* Holds information about Fido 2 credential details - represents single public key information.
@@ -74,22 +69,6 @@ private FidoCredentialInfo()
7469
*/
7570
private String aaguid;
7671

77-
// Attestation properties
78-
/**
79-
* Indicates if attestation key was confirmed as trusted during registration.
80-
*/
81-
private boolean attestationTrusted;
82-
/**
83-
* Metadata and authenticator properties
84-
*/
85-
private String metadataIdentifier;
86-
private Map<String, String> vendorProperties;
87-
private Map<String, String> deviceProperties;
88-
/**
89-
* What transport of data is supported by Authenticator.
90-
*/
91-
private Set<Transport> transports;
92-
9372
// Mutable fields
9473
/**
9574
* Number of times private key was used to sign challenge - stored also on Authenticator
@@ -134,36 +113,11 @@ public String getAaguid()
134113
return aaguid;
135114
}
136115

137-
public boolean isAttestationTrusted()
138-
{
139-
return attestationTrusted;
140-
}
141-
142116
public String getAttestationFormat()
143117
{
144118
return attestationFormat;
145119
}
146120

147-
public String getMetadataIdentifier()
148-
{
149-
return metadataIdentifier;
150-
}
151-
152-
public Map<String, String> getVendorProperties()
153-
{
154-
return vendorProperties;
155-
}
156-
157-
public Map<String, String> getDeviceProperties()
158-
{
159-
return deviceProperties;
160-
}
161-
162-
public Set<Transport> getTransports()
163-
{
164-
return transports;
165-
}
166-
167121
public long getSignatureCount()
168122
{
169123
return signatureCount;
@@ -242,24 +196,21 @@ public boolean equals(Object o)
242196
return registrationTimestamp == that.registrationTimestamp &&
243197
userPresent == that.userPresent &&
244198
userVerified == that.userVerified &&
245-
attestationTrusted == that.attestationTrusted &&
246199
signatureCount == that.signatureCount &&
247200
Objects.equals(credentialId, that.credentialId) &&
248201
Objects.equals(publicKeyCose, that.publicKeyCose) &&
249202
Objects.equals(attestationFormat, that.attestationFormat) &&
250203
Objects.equals(aaguid, that.aaguid) &&
251-
Objects.equals(metadataIdentifier, that.metadataIdentifier) &&
252-
Objects.equals(vendorProperties, that.vendorProperties) &&
253-
Objects.equals(deviceProperties, that.deviceProperties) &&
254-
Objects.equals(transports, that.transports) &&
255204
Objects.equals(description, that.description) &&
256205
Objects.equals(userHandle, that.userHandle);
257206
}
258207

259208
@Override
260209
public int hashCode()
261210
{
262-
return Objects.hash(registrationTimestamp, credentialId, publicKeyCose, userPresent, userVerified, attestationFormat, aaguid, attestationTrusted, metadataIdentifier, vendorProperties, deviceProperties, transports, signatureCount, description, userHandle);
211+
return Objects.hash(registrationTimestamp, credentialId, publicKeyCose, userPresent, userVerified,
212+
attestationFormat, aaguid,
213+
signatureCount, description, userHandle);
263214
}
264215

265216
public static FidoCredentialInfoBuilder builder()
@@ -285,12 +236,6 @@ public static final class FidoCredentialInfoBuilder
285236
private String aaguid;
286237
private String description;
287238

288-
private boolean attestationTrusted;
289-
private String metadataIdentifier;
290-
private Map<String, String> vendorProperties;
291-
private Map<String, String> deviceProperties;
292-
private Set<Transport> transports;
293-
294239
private String userHandle;
295240

296241
private FidoCredentialInfoBuilder()
@@ -308,11 +253,6 @@ private FidoCredentialInfoBuilder(FidoCredentialInfo credentialInfo)
308253
this.attestationFormat = credentialInfo.attestationFormat;
309254
this.aaguid = credentialInfo.aaguid;
310255
this.description = credentialInfo.description;
311-
this.attestationTrusted = credentialInfo.attestationTrusted;
312-
this.metadataIdentifier = credentialInfo.metadataIdentifier;
313-
this.vendorProperties = credentialInfo.vendorProperties;
314-
this.deviceProperties = credentialInfo.deviceProperties;
315-
this.transports = credentialInfo.transports;
316256
this.userHandle = credentialInfo.userHandle;;
317257
}
318258

@@ -345,53 +285,6 @@ public FidoCredentialInfoBuilder registrationTime(long registrationTime)
345285
return this;
346286
}
347287

348-
349-
public FidoCredentialInfoBuilder attestationTrusted(boolean attestationTrusted)
350-
{
351-
this.attestationTrusted = attestationTrusted;
352-
return this;
353-
}
354-
355-
public FidoCredentialInfoBuilder metadataIdentifier(String metadataIdentifier)
356-
{
357-
this.metadataIdentifier = metadataIdentifier;
358-
return this;
359-
}
360-
361-
public FidoCredentialInfoBuilder vendorProperties(Map<String, String> vendorProperties)
362-
{
363-
if (nonNull(vendorProperties) && !vendorProperties.isEmpty())
364-
this.vendorProperties = new HashMap<>(vendorProperties);
365-
return this;
366-
}
367-
368-
public FidoCredentialInfoBuilder deviceProperties(Map<String, String> deviceProperties)
369-
{
370-
if (nonNull(deviceProperties) && !deviceProperties.isEmpty())
371-
this.deviceProperties = new HashMap<>(deviceProperties);
372-
return this;
373-
}
374-
375-
public FidoCredentialInfoBuilder transports(Set<Transport> transports)
376-
{
377-
if (nonNull(transports) && !transports.isEmpty())
378-
this.transports = new HashSet<>(transports);
379-
return this;
380-
}
381-
382-
public FidoCredentialInfoBuilder attestationMetadata(Attestation attestationMetadata)
383-
{
384-
if (nonNull(attestationMetadata))
385-
{
386-
this.attestationTrusted = attestationMetadata.isTrusted();
387-
this.metadataIdentifier = attestationMetadata.getMetadataIdentifier().orElse(null);
388-
this.vendorProperties = attestationMetadata.getVendorProperties().orElse(null);
389-
this.deviceProperties = attestationMetadata.getDeviceProperties().orElse(null);
390-
this.transports = attestationMetadata.getTransports().orElse(null);
391-
}
392-
return this;
393-
}
394-
395288
public FidoCredentialInfoBuilder userPresent(final boolean userPresent)
396289
{
397290
this.userPresent = userPresent;
@@ -447,12 +340,6 @@ public FidoCredentialInfo build()
447340
info.aaguid = null; // for NONE attestation aaguid is always reset to 0s
448341
}
449342

450-
info.attestationTrusted = this.attestationTrusted;
451-
info.metadataIdentifier = this.metadataIdentifier;
452-
info.vendorProperties = this.vendorProperties;
453-
info.deviceProperties = this.deviceProperties;
454-
info.transports = this.transports;
455-
456343
info.description = this.description;
457344

458345
return info;

‎fido/src/main/java/io/imunity/fido/service/FidoCredentialRegistrationVerificator.java‎

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,14 @@
88
import com.yubico.webauthn.FinishRegistrationOptions;
99
import com.yubico.webauthn.RegistrationResult;
1010
import com.yubico.webauthn.StartRegistrationOptions;
11-
import com.yubico.webauthn.attestation.Attestation;
1211
import com.yubico.webauthn.data.AttestedCredentialData;
1312
import com.yubico.webauthn.data.AuthenticatorAttestationResponse;
1413
import com.yubico.webauthn.data.AuthenticatorSelectionCriteria;
1514
import com.yubico.webauthn.data.ByteArray;
1615
import com.yubico.webauthn.data.ClientRegistrationExtensionOutputs;
1716
import com.yubico.webauthn.data.PublicKeyCredential;
1817
import com.yubico.webauthn.data.PublicKeyCredentialCreationOptions;
18+
import com.yubico.webauthn.data.ResidentKeyRequirement;
1919
import com.yubico.webauthn.data.UserIdentity;
2020
import com.yubico.webauthn.data.UserVerificationRequirement;
2121
import com.yubico.webauthn.exception.RegistrationFailedException;
@@ -61,19 +61,18 @@ class FidoCredentialRegistrationVerificator implements FidoRegistration
6161
private AdvertisedAddressProvider addressProvider;
6262

6363
@Autowired
64-
public FidoCredentialRegistrationVerificator(final MessageSource msg, final FidoEntityHelper entityHelper,
65-
final UnityFidoRegistrationStorage.UnityFidoRegistrationStorageCache fidoStorage,
66-
final AdvertisedAddressProvider addressProvider)
64+
public FidoCredentialRegistrationVerificator(MessageSource msg, FidoEntityHelper entityHelper,
65+
UnityFidoRegistrationStorage.UnityFidoRegistrationStorageCache fidoStorage,
66+
AdvertisedAddressProvider addressProvider)
6767
{
6868
this.msg = msg;
6969
this.entityHelper = entityHelper;
7070
this.fidoStorage = fidoStorage;
7171
this.addressProvider = addressProvider;
7272
}
7373

74-
public SimpleEntry<String, String> getRegistrationOptions(final String credentialName, final String credentialConfiguration,
75-
final Long entityId, final String username,
76-
final boolean useResidentKey) throws FidoException
74+
public SimpleEntry<String, String> getRegistrationOptions(String credentialName, String credentialConfiguration,
75+
Long entityId, String username, boolean useResidentKey) throws FidoException
7776
{
7877
Optional<Identities> resolvedUsername = entityHelper.resolveUsername(entityId, username);
7978
if (!resolvedUsername.isPresent() && (isNull(username) || username.isEmpty()))
@@ -84,7 +83,10 @@ public SimpleEntry<String, String> getRegistrationOptions(final String credentia
8483
String displayName = resolvedUsername.map(entityHelper::getDisplayName).orElse(username);
8584

8685
FidoCredential fidoCredential = FidoCredential.deserialize(credentialConfiguration);
87-
PublicKeyCredentialCreationOptions registrationRequest = getRelyingParty(addressProvider.get().getHost(), fidoStorage.getInstance(credentialName), fidoCredential)
86+
ResidentKeyRequirement residentKeyRequirement = fidoCredential.isLoginLessAllowed() && useResidentKey ?
87+
ResidentKeyRequirement.PREFERRED : ResidentKeyRequirement.DISCOURAGED;
88+
PublicKeyCredentialCreationOptions registrationRequest = getRelyingParty(addressProvider.get().getHost(),
89+
fidoStorage.getInstance(credentialName), fidoCredential)
8890
.startRegistration(StartRegistrationOptions.builder()
8991
.user(UserIdentity.builder()
9092
.name(registrationUsername)
@@ -93,7 +95,7 @@ public SimpleEntry<String, String> getRegistrationOptions(final String credentia
9395
.build())
9496
.authenticatorSelection(AuthenticatorSelectionCriteria.builder()
9597
.userVerification(UserVerificationRequirement.valueOf(fidoCredential.getUserVerification()))
96-
.requireResidentKey(fidoCredential.isLoginLessAllowed() && useResidentKey)
98+
.residentKey(residentKeyRequirement)
9799
.build())
98100
.build());
99101

@@ -110,8 +112,8 @@ public SimpleEntry<String, String> getRegistrationOptions(final String credentia
110112
return new SimpleEntry<>(reqId, json);
111113
}
112114

113-
public FidoCredentialInfo createFidoCredentials(final String credentialName, final String credentialConfiguration,
114-
final String reqId, final String responseJson) throws FidoException
115+
public FidoCredentialInfo createFidoCredentials(String credentialName, String credentialConfiguration,
116+
String reqId, String responseJson) throws FidoException
115117
{
116118
log.debug("Fido finalize registration for reqId: {}", reqId);
117119
try
@@ -122,7 +124,9 @@ public FidoCredentialInfo createFidoCredentials(final String credentialName, fin
122124

123125
PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs> pkc =
124126
PublicKeyCredential.parseRegistrationResponseJson(responseJson);
125-
RegistrationResult result = getRelyingParty(addressProvider.get().getHost(), fidoStorage.getInstance(credentialName), FidoCredential.deserialize(credentialConfiguration))
127+
RegistrationResult result = getRelyingParty(addressProvider.get().getHost(),
128+
fidoStorage.getInstance(credentialName),
129+
FidoCredential.deserialize(credentialConfiguration))
126130
.finishRegistration(FinishRegistrationOptions.builder()
127131
.request(registrationRequest)
128132
.response(pkc)
@@ -135,11 +139,11 @@ public FidoCredentialInfo createFidoCredentials(final String credentialName, fin
135139
}
136140
}
137141

138-
private FidoCredentialInfo createFidoCredentialInfo(PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs> pkc,
139-
PublicKeyCredentialCreationOptions registrationRequest, RegistrationResult result)
142+
private FidoCredentialInfo createFidoCredentialInfo(PublicKeyCredential<AuthenticatorAttestationResponse,
143+
ClientRegistrationExtensionOutputs> pkc,
144+
PublicKeyCredentialCreationOptions registrationRequest,
145+
RegistrationResult result)
140146
{
141-
Optional<Attestation> attestationMetadata = result.getAttestationMetadata();
142-
143147
return FidoCredentialInfo.builder()
144148
.registrationTime(System.currentTimeMillis())
145149
.credentialId(result.getKeyId().getId())
@@ -148,8 +152,8 @@ private FidoCredentialInfo createFidoCredentialInfo(PublicKeyCredential<Authenti
148152
.userPresent(pkc.getResponse().getParsedAuthenticatorData().getFlags().UP)
149153
.userVerified(pkc.getResponse().getParsedAuthenticatorData().getFlags().UV)
150154
.attestationFormat(pkc.getResponse().getAttestation().getFormat())
151-
.aaguid(pkc.getResponse().getParsedAuthenticatorData().getAttestedCredentialData().map(AttestedCredentialData::getAaguid).map(ByteArray::getHex).orElse(null))
152-
.attestationMetadata(attestationMetadata.orElse(null))
155+
.aaguid(pkc.getResponse().getParsedAuthenticatorData().getAttestedCredentialData()
156+
.map(AttestedCredentialData::getAaguid).map(ByteArray::getHex).orElse(null))
153157
.userHandle(new FidoUserHandle(registrationRequest.getUser().getId().getBytes()).asString())
154158
.build();
155159
}

‎fido/src/main/java/io/imunity/fido/service/FidoCredentialVerificator.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -285,10 +285,10 @@ static RelyingParty getRelyingParty(String hostName, UnityFidoRegistrationStorag
285285
.name(credentialConfiguration.getHostName())
286286
.build())
287287
.credentialRepository(storage)
288-
.attestationConveyancePreference(AttestationConveyancePreference.valueOf(credentialConfiguration.getAttestationConveyance()))
288+
.attestationConveyancePreference(AttestationConveyancePreference.valueOf(
289+
credentialConfiguration.getAttestationConveyance()))
289290
.allowUntrustedAttestation(true)
290291
.allowOriginPort(true)
291-
.allowUnrequestedExtensions(true)
292292
.build();
293293
}
294294

‎fido/src/test/java/io/imunity/fido/credential/FidoCredentialInfoTest.java‎

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,17 @@
44
*/
55
package io.imunity.fido.credential;
66

7-
import com.google.common.collect.ImmutableMap;
8-
import com.yubico.webauthn.attestation.Transport;
9-
import com.yubico.webauthn.data.ByteArray;
10-
import com.yubico.webauthn.data.exception.HexException;
11-
import org.junit.Test;
7+
import static org.junit.Assert.assertEquals;
8+
import static org.junit.Assert.assertNotEquals;
129

13-
import java.util.Arrays;
1410
import java.util.Collections;
15-
import java.util.HashSet;
1611
import java.util.List;
1712
import java.util.Random;
1813

19-
import static org.junit.Assert.assertEquals;
20-
import static org.junit.Assert.assertNotEquals;
14+
import org.junit.Test;
15+
16+
import com.yubico.webauthn.data.ByteArray;
17+
import com.yubico.webauthn.data.exception.HexException;
2118

2219
/**
2320
* Test for {@link FidoCredentialInfo} class
@@ -110,11 +107,6 @@ private FidoCredentialInfo generateCredential() throws HexException
110107
.userVerified(random.nextBoolean())
111108
.attestationFormat("android")
112109
.aaguid("123456789012345678" + random.nextInt(1000))
113-
.attestationTrusted(random.nextBoolean())
114-
.metadataIdentifier("metadataIdentyfier" + random.nextInt(1000))
115-
.vendorProperties(ImmutableMap.of("k1", "v1" + random.nextInt(1000)))
116-
.deviceProperties(ImmutableMap.of("k2", "v2" + random.nextInt(1000)))
117-
.transports(new HashSet<>(Arrays.asList(Transport.USB)))
118110
.signatureCount(random.nextInt(1000))
119111
.description("Description " + random.nextInt(1000))
120112
.userHandle("a1bec3d4e5f" + random.nextInt(1000))

0 commit comments

Comments
 (0)