#What is this PR for? See Issue #4

Overview or reasons

Please see Issue #4

Tasks

• added a case for the EdDSA algorithm.

Result

• I have tested this with a custom authenticator (i.e. one that works on local servers / non https servers) forced to use EdDSA, and confirmed that it works for EdDSA keys.

Hi, I would like to know if there are any updates regarding the MDS implementation, will this repo comply to the latest MDS v3.0a any time soon?

https://fidoalliance.org/metadata/

What is this PR for?

Resolved https://github.com/line/line-fido2-server/issues/11

Overview or reasons

• Official termination of MDS v2 support (until October 2022)
• https://fidoalliance.org/metadata/
• https://fidoalliance.org/legacy-mds2-information
• https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html#metadata-blob-payload-entry-dictionary

Tasks

• Modify MdsFetchTask to support v3.
• Delete common class libraries for messages (common-1.3-SNAPSHOT.jar) and move associated classes.
• Add a column to the METADATA table. (biometricStatusReports)
• Refactor Mds-related code. (Added helper, util, exception handling classes)
• Add test code.

How to test

• You can perform unit tests using the MdsV3MetadataHelperTest class.

What is this PR for?

Resolves #23 by logging debug logs at an appropriate logging level to make server less busy for logging during high traffic rate.

Overview or reasons

It appears that current logs in the FIDO server are mainly for debugging purpose, but they are logged in info level.

As a result, even if info level is configured in logback, they are always logged. When traffic rate is high, the server becomes busy for logging.

On the other hand, some logs passes parameters with manual string construction instead of {} placeholder, so the impact is even larger. (See https://www.slf4j.org/faq.html#logging_performance for details)

Tasks

• Align all debugging logs to be debug level: log.info -> log.debug
• Use {} placeholders in log message whenever possible
• Pass objects directly as message parameters instead of manual string construction like toString or String.format. This can avoid redundant computation when the log is not required for the configured log level.
• Prepare Base64url encoded strings for logging and share it in multiple debug logs to avoid redundant encoding.
  • Note that the encoding is still performed no matter what log level is. Since changing log level should have significant improvement, this PR keeps this change minimal.

Result

• The logs are only logged when logback is configured to debug level.

When a message is entered into the controller, The controller calls the following logic to verify the message.

ReqMsgVerifier.validateRegOptionRequest(regOptionRequest);

We expect this logic to be improved with Spring Boot Bean Validation.

Hello, It's taken some time for me to find docs to parameters of request and responses to FIDO 2 server (such as "authenticatorAttachment"). I think a good idea is to add description from https://www.w3.org/TR/webauthn/ to swagger and REST docs

I created a basic contributing guide. But if you need to add more information, such as environment settings, or commit message rules, please feel free to add it. For example, https://armeria.dev/community/developer-guide

What is this PR for?

Resolved https://github.com/line/line-fido2-server/issues/27

Tasks

• TPM Public area for ECC key algorithm parsing issue has been fixed, and related code has been refactored.

References

• https://w3c.github.io/webauthn/#sctn-tpm-attestation
• https://www.trustedcomputinggroup.org/wp-content/uploads/TPM-Rev-2.0-Part-2-Structures-01.38.pdf - 12.2.5.1 , 12.2.5.2

What is this PR for?

Resolved https://github.com/line/line-fido2-server/issues/26

Overview or reasons

• Modified wrong settings related to h2 console.

What is this PR for?

Resolved #28

Overview or reasons

• Added Webauthn official links to Swagger and Spring REST Docs to improve development convenience.

When parsing the unique field from pubArea during an attestation verification, unique is a TPM2B_PUBLIC_KEY_RSA only if the TPMI_ALG_PUBLIC is TPM_ALG_RSA. If TPMI_ALG_PUBLIC is TPM_ALG_ECC, unique is a TPMS_ECC_POINT. See TPM Rev 2.0 part 2, structures, section 12.2.3.2.

Relevant code is at https://github.com/line/line-fido2-server/blob/7ad6e867b3faaab133ef950c16da37cda8a9d9e9/server/src/main/java/com/linecorp/line/auth/fido/fido2/server/attestation/tpm/TpmParser.java#L152.

Hi there, I cloned your repo successfully and tried to run it using "docker-compose up", but I get the following error: "failed to solve: failed to load cache key: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed". I am logged in hub.docker.com, but to no avail.

Full error message:

[+] Running 0/3
 ⠿ build Warning                                                                                                                                            2.2s
 ⠿ rp Warning                                                                                                                                               2.2s
 ⠿ fido2 Warning                                                                                                                                            2.2s
[+] Building 5.8s (13/20)                                                                                                                                        
 => [rp:latest internal] load build definition from Dockerfile                                                                                              0.0s
 => => transferring dockerfile: 248B                                                                                                                        0.0s
 => [fido2:latest internal] load build definition from Dockerfile                                                                                           0.0s
 => => transferring dockerfile: 32B                                                                                                                         0.0s
 => [build-image:latest internal] load build definition from Dockerfile                                                                                     0.0s
 => => transferring dockerfile: 158B                                                                                                                        0.0s
 => [rp:latest internal] load .dockerignore                                                                                                                 0.0s
 => => transferring context: 2B                                                                                                                             0.0s
 => [fido2:latest internal] load .dockerignore                                                                                                              0.0s
 => => transferring context: 2B                                                                                                                             0.0s
 => [build-image:latest internal] load .dockerignore                                                                                                        0.0s
 => => transferring context: 2B                                                                                                                             0.0s
 => [rp:latest internal] load metadata for docker.io/library/openjdk:8-jdk-alpine                                                                           3.3s
 => [fido2:latest internal] load metadata for docker.io/library/openjdk:8-jdk-slim                                                                          3.1s
 => [auth] library/openjdk:pull token for registry-1.docker.io                                                                                              0.0s
 => ERROR [fido2:latest] FROM docker.io/library/build-image:latest                                                                                          2.3s
 => => resolve docker.io/library/build-image:latest                                                                                                         2.2s
 => CANCELED [fido2:latest stage-0 1/2] FROM docker.io/library/openjdk:8-jdk-slim@sha256:19578a1e13b7a1e4cab9b227fb7b5d80e14665cf4024c6407d72ba89842a97ed   2.2s
 => => resolve docker.io/library/openjdk:8-jdk-slim@sha256:19578a1e13b7a1e4cab9b227fb7b5d80e14665cf4024c6407d72ba89842a97ed                                 0.0s
 => => sha256:19578a1e13b7a1e4cab9b227fb7b5d80e14665cf4024c6407d72ba89842a97ed 549B / 549B                                                                  0.0s
 => => sha256:ecb89bb055c1ee4db9da38713b953f6daafefe575c77c6439eabbb85e3168402 1.16kB / 1.16kB                                                              0.0s
 => => sha256:80e75f92be33ca2bd4b933633dafc72aa82a34792f9b769063a474e97e163b8b 7.51kB / 7.51kB                                                              0.0s
 => => sha256:1efc276f4ff952c055dea726cfc96ec6a4fdb8b62d9eed816bd2b788f2860ad7 23.07MB / 31.37MB                                                            2.3s
 => => sha256:a2f2f93da48276873890ac821b3c991d53a7e864791aaf82c39b7863c908b93b 1.58MB / 1.58MB                                                              0.4s
 => => sha256:1a2de4cc94315f2ba5015e6781672aa8e0b1456a4d488694bb5f016d8f59fa70 210B / 210B                                                                  0.4s
 => => sha256:9013b84ebbe7aec8b587e257266770d2ac6ec3fce4c27415e74fbaf5928b4549 7.34MB / 106.19MB                                                            2.3s
 => CANCELED [build-image:latest stage-0 1/2] FROM docker.io/library/openjdk:8-jdk-alpine@sha256:94792824df2df33402f201713f932b58cb9de94a0cd524164a0f22833  2.4s
 => => resolve docker.io/library/openjdk:8-jdk-alpine@sha256:94792824df2df33402f201713f932b58cb9de94a0cd524164a0f2283343547b3                               0.0s
 => => sha256:a3562aa0b991a80cfe8172847c8be6dbf6e46340b759c2b782f8b8be45342717 3.40kB / 3.40kB                                                              0.0s
 => => sha256:94792824df2df33402f201713f932b58cb9de94a0cd524164a0f2283343547b3 1.64kB / 1.64kB                                                              0.0s
 => => sha256:44b3cea369c947527e266275cee85c71a81f20fc5076f6ebb5a13f19015dce71 947B / 947B                                                                  0.0s
 => => sha256:e7c96db7181be991f19a9fb6975cdbbd73c65f4a2681348e63a141a2192a5f10 2.76MB / 2.76MB                                                              1.0s
 => => extracting sha256:e7c96db7181be991f19a9fb6975cdbbd73c65f4a2681348e63a141a2192a5f10                                                                   0.9s
 => => sha256:f910a506b6cb1dbec766725d70356f695ae2bf2bea6224dbe8c7c6ad4f3664a2 238B / 238B                                                                  1.4s
 => => sha256:c2274a1a0e2786ee9101b08f76111f9ab8019e368dce1e325d3c284a0ca33397 3.42MB / 70.73MB                                                             2.4s
 => => extracting sha256:f910a506b6cb1dbec766725d70356f695ae2bf2bea6224dbe8c7c6ad4f3664a2                                                                   0.0s
 => [build-image:latest internal] load build context                                                                                                        2.1s
 => => transferring context: 31.77MB                                                                                                                        2.1s
 => [auth] library/build-image:pull token for registry-1.docker.io                                                                                          0.0s
------
 > [fido2:latest] FROM docker.io/library/build-image:latest:
------
failed to solve: failed to load cache key: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failed```

I tried to test it as below

I used my mobile device(Galaxy21) as a authenticator

and I found out following error in rpserver log.

Could not resolve parameter [1] in public com.linecorp.line.auth.fido.fido2.rpserver.model.transport.AdapterServerResponse com.linecorp.line.auth.fido.fido2.rpserver.controller.AdapterController.sendRegistrationResponse(java.lang.String,com.linecorp.line.auth.fido.fido2.rpserver.model.AdapterRegServerPublicKeyCredential,javax.servlet.http.HttpServletRequest): JSON parse error: Cannot construct instance of `com.linecorp.line.auth.fido.fido2.common.AuthenticatorTransport`, problem: No value present; nested exception is com.fasterxml.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `com.linecorp.line.auth.fido.fido2.common.AuthenticatorTransport`, problem: No value present

the problem was the missing option "hybrid".

after I added it, everything was fine.

Some of the Aaguid doesn't come correctly. For eg: Mac Touch using Safari gives the Aaguid as "00000000-0000-0000-0000-000000000000" whereas with Chrome comes as "adce0002-35bc-c60a-648b-0b25f1f05503"

Same issues with YubiKey

The current User Handle (a.k.a user ID) is a hash of the user name. https://github.com/line/line-fido2-server/blob/22d5aa954efe4e1a383c9eea3b2dc109e700f973/rpserver/src/main/java/com/linecorp/line/auth/fido/fido2/rpserver/controller/CredentialController.java#L147

The documentation appears to recommend it with salted hash or random, so should we change that?

This includes hash values of personally identifying information, unless the hash function is salted with salt values private to the Relying Party, since hashing does not prevent probing for guessable input values. It is RECOMMENDED to let the user handle be 64 random bytes, and store this value in the user’s account.

https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-user-handle-privacy

In the case of the server app(FIDO2 Server), the API Guide of Spring RestDocs has already been completed.

However, it does not exist for rpserver yet. The API Guide can be configured by referring to the following.

references

• Official Spring RestDocs Guide
• https://github.com/line/line-fido2-server/pull/10

Configuration

• Api-guide.adoc
• Tests
  • Dummy data for tests
• Build settings
• Api-guide.html

How to open

• Readme