(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10078

moabu · 2024-11-07T07:52:48Z

This PR completely revamps jans-fido2, to enable support for passkeys, and bring the server up to spec.

So far changes:

Added support for ED25519, RS384, RS512, ES384, ES512 feat: Minimum support ES256, RS1, RS256, ED25519 #9086
Refactoring of the assertions and attestation requests/responses to Jackson ObjectMapper feat: refactor Assertion/Attestation to Jackson ObjectMapper #9023
Removed legacy Android Safetynet and Keystore attestations ProjectPasskeys: Remove Android Safetynet and KeyStore #8901

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

I confirm that there is no impact on the docs due to the code changes in this PR.

Closes #10079,

Prev. PR #9120

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 Co-authored-by: snyk-bot <[email protected]>

Bumps commons-text from 1.9 to 1.10.0. --- updated-dependencies: - dependency-name: org.apache.commons:commons-text dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3037311

…erabilities (#972) The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1009963 - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1058913 - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1085989 - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1303102 Co-authored-by: pujavs <[email protected]>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-2945452 Co-authored-by: pujavs <[email protected]>

Bumps [postgresql](https://github.com/pgjdbc/pgjdbc) from 42.5.0 to 42.5.1. - [Release notes](https://github.com/pgjdbc/pgjdbc/releases) - [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md) - [Commits](pgjdbc/pgjdbc@REL42.5.0...REL42.5.1) --- updated-dependencies: - dependency-name: org.postgresql:postgresql dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168084 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168085 Co-authored-by: snyk-bot <[email protected]>

* feat(jans-fido): move fidoconfig folder properties to db #9369 Signed-off-by: shekhar16 [email protected] * feat(jans-fido): added specialized exception #9369 Signed-off-by: shekhar16 [email protected] --------- Signed-off-by: shekhar16 [email protected] Co-authored-by: Yuriy Movchan <[email protected]>

Signed-off-by: Madhumita Subramaniam <[email protected]>

* feat(jans-fido2): reflect authenticator name with passkeys Signed-off-by: imran-ishaq <[email protected]> * fix(jans-fido2): handle test cases for authenticator name Signed-off-by: imran-ishaq <[email protected]> --------- Signed-off-by: imran-ishaq <[email protected]> Co-authored-by: Mohammad Abudayyeh <[email protected]>

#9624) fix(jans-fido2): remove superGluu-related endpoints from FIDO2 Swagger and ConfigurationControllerTest Signed-off-by: imran-ishaq <[email protected]> Co-authored-by: Mohammad Abudayyeh <[email protected]>

….0-M12 to 4.0.0-M16 in /jans-scim (#9010) chore(deps): bump org.apache.maven.plugins:maven-site-plugin Bumps [org.apache.maven.plugins:maven-site-plugin](https://github.com/apache/maven-site-plugin) from 4.0.0-M12 to 4.0.0-M16. - [Commits](apache/maven-site-plugin@maven-site-plugin-4.0.0-M12...maven-site-plugin-4.0.0-M16) --- updated-dependencies: - dependency-name: org.apache.maven.plugins:maven-site-plugin dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jose Gonzalez <[email protected]>

Signed-off-by: shekhar16 <[email protected]>

…tion and assertion API calls #9248 (#9974) * feat(jans-fido2): add origin parameter in Fido2ExternalAuthenticator script for attestation and assertion API calls Signed-off-by: imran-ishaq <[email protected]> * refactor(docs): add origin parameter in Fido2ExternalAuthenticator script for attestation and assertion API calls #9248 Signed-off-by: imran-ishaq <[email protected]> * fix(jans-fido2): handle origin if http or https is missing #9248 Signed-off-by: imran-ishaq <[email protected]> --------- Signed-off-by: imran-ishaq <[email protected]>

Signed-off-by: imran-ishaq <[email protected]>

Signed-off-by: Mustafa Baser <[email protected]>

Signed-off-by: shekhar16 <[email protected]>

dryrunsecurity · 2024-11-07T07:53:41Z

DryRun Security Summary

The pull request primarily focuses on improving the configuration and management of the FIDO2 functionality within the Janssen application, including renaming and reorganizing various configuration properties, updating the handling of FIDO2 metadata, attestation, and assertion processes, and enhancing the security and maintainability of the FIDO2 implementation.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on improving the configuration and management of the FIDO2 (Fast Identity Online) functionality within the Janssen application. The changes involve renaming and reorganizing various configuration properties, as well as updating the handling of FIDO2 metadata, attestation, and assertion processes.

From an application security perspective, the changes seem to be a positive step towards enhancing the security and maintainability of the FIDO2 implementation. The renaming of properties to be more descriptive, the separation of debug/development-only features, and the improvements to the handling of sensitive data and cryptographic operations are all important security considerations.

However, it's crucial to ensure that the implementation of the FIDO2 functionality, including the usage of the updated configuration properties and the processing of FIDO2 data, is thoroughly reviewed and tested to mitigate potential security vulnerabilities. Proper input validation, secure data handling, and adherence to FIDO2 best practices should be a priority.

Files Changed:

docs/janssen-server/config-guide/fido2-config/janssen-fido2-configuration.md: The changes involve renaming configuration properties, such as userAutoEnrollment to debugUserAutoEnrollment, requestedCredentialTypes to enabledFidoAlgorithms, and requestedParties to rp (Relying Party). These changes improve the clarity and consistency of the FIDO2 configuration.
docs/janssen-server/fido/config.md: Similar to the changes in the previous file, this document also includes the renaming of configuration properties and the addition of new settings related to FIDO2 metadata service handling and attestation mode.
docs/janssen-server/fido/logs.md: The changes in this file focus on the logging configuration for the FIDO2 server, including the renaming of properties and the addition of settings for controlling the logging level and layout.
docker-jans-fido2/scripts/upgrade.py: This file includes updates to the FIDO2 dynamic and static configuration, as well as the error configuration, to ensure that the application is properly upgraded and configured for FIDO2 functionality.
docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py: The changes in this file involve improvements to the FIDO2 authentication and registration flow, including the handling of platform authenticators and the addition of more detailed logging.
docs/janssen-server/reference/json/properties/fido2-properties.md: This document provides an overview of the various FIDO2 configuration properties, including the changes to the credential types, algorithms, metadata management, and logging settings.
docs/janssen-server/fido/vendor-metadata.md: The changes in this file discuss the configuration options related to the FIDO2 metadata service, including the ability to use a local metadata service or the FIDO Alliance Metadata Service (MDS3).
jans-auth-server/server/src/main/webapp/auth/fido2/passkeys.xhtml: The changes in this file focus on the FIDO2 attestation and assertion handling in the Jans Auth Server, including the addition of error handling and the removal of a potentially sensitive alert() function call.
jans-casa/app/src/main/java/io/jans/casa/plugins/authnmethod/service/Fido2Service.java: The changes in this file improve the FIDO2 device registration and verification process, including the use of structured data types and proper error handling.
jans-config-api/plugins/docs/fido2-plugin-swagger.yaml: The changes in this file update the Swagger documentation for the FIDO2 plugin in the Jans Config API, reflecting the renaming of configuration properties.

Overall, the code changes in this pull request appear to be focused on improving the security, maintainability, and configurability of the FIDO2 functionality within the Janssen application. As an application security engineer, it's important to review these changes thoroughly and ensure that the implementation adheres to best practices for secure FIDO2 integration.

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding
Authn/Authz Analyzer	4 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

mo-auto · 2024-11-07T07:53:42Z

Error: Hi @moabu, You did not reference an open issue in your PR. I attempted to create an issue for you.
Please update that issues' title and body and make sure I correctly referenced it in the above PRs body.

sonarcloud · 2024-11-07T08:00:55Z

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-11-07T08:02:00Z

Quality Gate passed for 'jans-core'

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-11-07T08:02:22Z

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-11-07T08:02:38Z

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

mo-auto and others added 30 commits November 7, 2024 10:22

chore(main): release jans-orm 1.0.1-SNAPSHOT (#1713)

4150f0a

chore(main): release jans-fido2 1.0.1-SNAPSHOT (#1712)

ab2ac13

chore(main): release jans-auth-server 1.0.1-SNAPSHOT (#1711)

87fe721

chore(main): release jans-core 1.0.1-SNAPSHOT (#1710)

49f9b70

chore(main): release jans-scim 1.0.1-SNAPSHOT (#1709)

b6c07c7

chore(main): release jans-notify 1.0.1-SNAPSHOT (#1708)

827deb3

chore(main): release agama 1.0.1-SNAPSHOT (#1707)

f6909d3

fix: jans-auth-server/pom.xml to reduce vulnerabilities (#2466)

965e768

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152

fix: jans-eleven/pom.xml to reduce vulnerabilities (#2471)

5f354d4

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 Co-authored-by: snyk-bot <[email protected]>

fix: jans-eleven/pom.xml to reduce vulnerabilities (#2676)

4cba244

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3037311

fix: jans-config-api/pom.xml to reduce vulnerabilities (#1746)

66a0e94

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-2945452 Co-authored-by: pujavs <[email protected]>

docs: update README.md (#2367)

b4af3b1

chore(main): release jans-core 1.0.5-SNAPSHOT (#3143)

3356819

chore(main): release jans-config-api 1.0.5-SNAPSHOT (#3142)

2a280b6

chore(main): release jans-auth-server 1.0.5-SNAPSHOT (#3141)

9e58150

chore(main): release jans-notify 1.0.5-SNAPSHOT (#3140)

d934644

chore(main): release jans-orm 1.0.5-SNAPSHOT (#3139)

8128806

chore(main): release jans-eleven 1.0.5-SNAPSHOT (#3138)

60b41ba

chore(main): release jans-fido2 1.0.5-SNAPSHOT (#3137)

2ce03fd

chore(main): release jans-bom 1.0.5-SNAPSHOT (#3136)

664f020

chore: add owner to jans-config-api (#3283)

6328593

fix: jans-eleven/pom.xml to reduce vulnerabilities (#3315)

b15b789

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168084 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168085 Co-authored-by: snyk-bot <[email protected]>

chore(main): release jans-eleven 1.0.6-SNAPSHOT (#3538)

2233fe8

chore(main): release jans-bom 1.0.6-SNAPSHOT (#3539)

16786f0

chore(main): release jans-notify 1.0.6-SNAPSHOT (#3540)

665c3e0

chore(main): release jans-config-api 1.0.6-SNAPSHOT (#3541)

6454d14

shekhar16 and others added 11 commits November 7, 2024 10:47

fix(jans-fido2): #9642

9446ac8

Signed-off-by: Madhumita Subramaniam <[email protected]>

fix(jans-fido2): remove superGluu-related endpoints from FIDO2 Swagge… (

986ad3b

#9624) fix(jans-fido2): remove superGluu-related endpoints from FIDO2 Swagger and ConfigurationControllerTest Signed-off-by: imran-ishaq <[email protected]> Co-authored-by: Mohammad Abudayyeh <[email protected]>

fix(jans-casa): fix issue caused by refactoring (#9838)

7a0945e

Signed-off-by: shekhar16 <[email protected]>

fix(jans-fido2): fix document refactoring issue (#9918)

83629a4

Signed-off-by: shekhar16 <[email protected]>

fix(docs): #9248

6ec2e60

Signed-off-by: imran-ishaq <[email protected]>

feat(jans-linux-setup): move fidoconfig folder properties to db

0d9af4a

Signed-off-by: Mustafa Baser <[email protected]>

fix(jans-fido2): fix issues due unused injects (#10035)

bb425b9

Signed-off-by: shekhar16 <[email protected]>

mo-auto mentioned this pull request Nov 7, 2024

fix: (jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys -autocreated #10079

Open

moabu mentioned this pull request Nov 7, 2024

ProjectPasskeys: fix(jans-fido2): Major FIDO2 / Passkeys upgrade #9120

Closed

moabu closed this Nov 7, 2024

moabu deleted the passkeys-project-test branch November 7, 2024 08:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10078

(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10078

moabu commented Nov 7, 2024 •

edited

Loading

dryrunsecurity bot commented Nov 7, 2024

mo-auto commented Nov 7, 2024

sonarcloud bot commented Nov 7, 2024

sonarcloud bot commented Nov 7, 2024

sonarcloud bot commented Nov 7, 2024

sonarcloud bot commented Nov 7, 2024

(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10078

(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10078

Conversation

moabu commented Nov 7, 2024 • edited Loading

dryrunsecurity bot commented Nov 7, 2024

DryRun Security Summary

Code Analysis

Riskiness

mo-auto commented Nov 7, 2024

sonarcloud bot commented Nov 7, 2024

Quality Gate passed for 'jans-cli'

sonarcloud bot commented Nov 7, 2024

Quality Gate passed for 'jans-core'

sonarcloud bot commented Nov 7, 2024

Quality Gate passed for 'jans-config-api-parent'

sonarcloud bot commented Nov 7, 2024

Quality Gate passed for 'jans-linux-setup'

moabu commented Nov 7, 2024 •

edited

Loading