feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys

docker-jans-fido2/scripts/upgrade.py

@@ -30,7 +30,7 @@ def _transform_fido2_dynamic_config(conf):
         ("metadataUrlsProvider", ""),
         ("errorReasonEnabled", False),
         ("skipDownloadMdsEnabled", False),
-        ("skipValidateMdsInAttestationEnabled", False),
+        ("attestationMode", "monitor"),
         ("sessionIdPersistInCache", False),
         ("assertionOptionsGenerateEndpointEnabled", True),
     ]:

docs/janssen-server/config-guide/fido2-config/janssen-fido2-configuration.md

@@ -91,24 +91,24 @@ It will return the result as below:
     "mdsCertsFolder": "/etc/jans/conf/fido2/mds/cert",
     "mdsTocsFolder": "/etc/jans/conf/fido2/mds/toc",
     "checkU2fAttestations": false,
-    "userAutoEnrollment": false,
+    "debugUserAutoEnrollment": false,
     "unfinishedRequestExpiration": 180,
     "authenticationHistoryExpiration": 1296000,
     "serverMetadataFolder": "/etc/jans/conf/fido2/server_metadata",
-    "requestedCredentialTypes": [
+    "enabledFidoAlgorithms": [
       "RS256",
       "ES256"
     ],
-    "requestedParties": [
+    "rp": [
       {
-        "name": "https://jans-project.lxd",
-        "domains": [
+        "id": "https://jans-project.lxd",
+        "origins": [
           "jans-project.lxd"
         ]
       }
     ],
-    "skipDownloadMdsEnabled": false,
-    "skipValidateMdsInAttestationEnabled": false,
+    "disableMetadataService": false,
+    "attestationMode": "monitor",
     "assertionOptionsGenerateEndpointEnabled": true
   }
 }

docs/janssen-server/fido/config.md

@@ -25,21 +25,21 @@ tags:
 
 #### Fido2Configuration structure
 
-| Field named                             | Example                                                                          | Description                                                                                             |
-|-----------------------------------------|----------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
-| authenticatorCertsFolder                | /etc/jans/conf/fido2/authenticator_cert                                          | Authenticators certificates fodler.                                                                     |
-| mdsCertsFolder                          | /etc/jans/conf/fido2/mds/cert                                                    | MDS TOC root certificates folder.                                                                       |
-| mdsTocsFolder                           | /etc/jans/conf/fido2/mds/toc                                                     | MDS TOC files folder.                                                                                   |
-| serverMetadataFolder                    | /etc/jans/conf/fido2/server_metadata                                             | Authenticators metadata in json format. Example: virtual devices.                                       |
-| metadataUrlsProvider                    | https://mds3.fido.tools                                                          | String value to provide source of URLs with external metadata.                                          |
-| requestedCredentialTypes                | ["RS256","ES256"]                                                                |                                                                                                         |
-| requestedParties                        | [{"name":"https://my-jans-server.jans.io","domains":["my-jans-server.jans.io"]}] | Requested party name.                                                                                   |
-| userAutoEnrollment                      | false                                                                            | Allow to enroll users on enrollment/authentication requests. (Useful while running tests)               |
-| unfinishedRequestExpiration             | 180                                                                              | Expiration time in seconds for pending enrollment/authentication requests                               |
-| authenticationHistoryExpiration         | 1296000                                                                          | Expiration time in seconds for approved authentication requests.                                        |
-| skipDownloadMdsEnabled                  | false                                                                            | Boolean value indicating whether the MDS download should be omitted                                     |
-| skipValidateMdsInAttestationEnabled     | false                                                                            | Boolean value indicating whether MDS validation should be omitted during attestation                    |
-| assertionOptionsGenerateEndpointEnabled | false                                                                            | Boolean value indicating whether the assertion custom endpoint (used especially in passkey) is enabled. |
+| Field named                             | Example                                                                        | Description                                                                                             |
+|-----------------------------------------|--------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------|
+| authenticatorCertsFolder                | /etc/jans/conf/fido2/authenticator_cert                                        | Authenticators certificates fodler.                                                                     |
+| mdsCertsFolder                          | /etc/jans/conf/fido2/mds/cert                                                  | MDS TOC root certificates folder.                                                                       |
+| mdsTocsFolder                           | /etc/jans/conf/fido2/mds/toc                                                   | MDS TOC files folder.                                                                                   |
+| serverMetadataFolder                    | /etc/jans/conf/fido2/server_metadata                                           | Authenticators metadata in json format. Example: virtual devices.                                       |
+| metadataUrlsProvider                    | https://mds3.fido.tools                                                        | String value to provide source of URLs with external metadata.                                          |
+| enabledFidoAlgorithms                   | ["RS256","ES256"]                                                              |                                                                                                         |
+| rp                                      | [{"id":"https://my-jans-server.jans.io","origins":["my-jans-server.jans.io"]}] | Requested party id.                                                                                     |
+| debugUserAutoEnrollment                 | false                                                                          | Allow to enroll users on enrollment/authentication requests. (Useful while running tests)               |
+| unfinishedRequestExpiration             | 180                                                                            | Expiration time in seconds for pending enrollment/authentication requests                               |
+| authenticationHistoryExpiration         | 1296000                                                                        | Expiration time in seconds for approved authentication requests.                                        |
+| disableMetadataService                  | false                                                                          | Boolean value indicating whether the MDS download should be omitted                                     |
+| attestationMode                         | "monitor"                                                                      | Enum value indicating whether MDS validation should be omitted during attestation                       |
+| assertionOptionsGenerateEndpointEnabled | false                                                                          | Boolean value indicating whether the assertion custom endpoint (used especially in passkey) is enabled. |
 
 ### Configuring the FIDO2 server:
 #### 1. Read Configuration parameters:
@@ -74,22 +74,22 @@ Response:
     "mdsCertsFolder": "/etc/jans/conf/fido2/mds/cert",
     "mdsTocsFolder": "/etc/jans/conf/fido2/mds/toc",
     "checkU2fAttestations": false,
-    "userAutoEnrollment": false,
+    "debugUserAutoEnrollment": false,
     "unfinishedRequestExpiration": 180,
     "authenticationHistoryExpiration": 1296000,
     "serverMetadataFolder": "/etc/jans/conf/fido2/server_metadata",
     "metadataUrlsProvider": "",
-    "skipDownloadMdsEnabled": false,
-    "skipValidateMdsInAttestationEnabled": false,
+    "disableMetadataService": false,
+    "attestationMode": "monitor",
     "assertionOptionsGenerateEndpointEnabled":true,
-    "requestedCredentialTypes": [
+    "enabledFidoAlgorithms": [
       "RS256",
       "ES256"
     ],
-    "requestedParties": [
+    "rp": [
       {
-        "name": "https://my.jans.server",
-        "domains": [
+        "id": "https://my.jans.server",
+        "origins": [
           "my.jans.server"
         ]
       }

docs/janssen-server/fido/logs.md

@@ -41,19 +41,19 @@ Response:
       "mdsCertsFolder":"/etc/jans/conf/fido2/mds/cert",
       "mdsTocsFolder":"/etc/jans/conf/fido2/mds/toc",
       "serverMetadataFolder":"/etc/jans/conf/fido2/server_metadata",
-      "requestedCredentialTypes":[
+      "enabledFidoAlgorithms":[
          "RS256",
          "ES256"
       ],
-      "requestedParties":[
+      "rp":[
          {
-            "name":"https://my-jans-server.jans.io",
-            "domains":[
+            "id":"https://my-jans-server.jans.io",
+            "origins":[
                "my-jans-server.jans.io"
             ]
          }
       ],
-      "userAutoEnrollment":false,
+      "debugUserAutoEnrollment":false,
       "unfinishedRequestExpiration":180,
       "authenticationHistoryExpiration":1296000
    }

docs/janssen-server/fido/vendor-metadata.md

@@ -231,15 +231,15 @@ Janssen's FIDO2 server -
 ### 3. Skip metadata validation
 
 Metadata validation is recommended but not mandatory as per FIDO2 specifications.
-In FIDO2 we can disable this validation by setting the `skipValidateMdsInAttestationEnabled` parameter (default is
-false).
+In FIDO2 we can disable this validation by setting the `attestionMode` parameter (default is
+monitor).
 
 It should look something like this:
 
 ```
 "fido2Configuration": {
   ...,
-  "skipValidateMdsInAttestationEnabled": true,
+  "attestationMode": "disabled",
   ...
 }
 ```

docs/janssen-server/reference/json/properties/fido2-properties.md

@@ -8,36 +8,36 @@ tags:
 
 # Fido2 Configuration Properties
 
-| Property Name | Description |  | 
-|-----|-----|-----|
-| authenticationHistoryExpiration | Expiration time in seconds for approved authentication requests | [Details](#authenticationhistoryexpiration) |
-| authenticatorCertsFolder | Authenticators certificates folder | [Details](#authenticatorcertsfolder) |
-| baseEndpoint | The base URL for Fido2 endpoints | [Details](#baseendpoint) |
-| checkU2fAttestations | Boolean value indicating if U2f attestation needs to be checked | [Details](#checku2fattestations) |
-| cleanServiceBatchChunkSize | Each clean up iteration fetches chunk of expired data per base dn and removes it from storage | [Details](#cleanservicebatchchunksize) |
-| cleanServiceInterval | Time interval for the Clean Service in seconds | [Details](#cleanserviceinterval) |
-| disableJdkLogger | Boolean value specifying whether to enable JDK Loggers | [Details](#disablejdklogger) |
-| externalLoggerConfiguration | Path to external Fido2 logging configuration | [Details](#externalloggerconfiguration) |
-| issuer | URL using the https scheme for Issuer identifier | [Details](#issuer) |
-| loggingLayout | Logging layout used for Fido2 | [Details](#logginglayout) |
-| loggingLevel | Logging level for Fido2 logger | [Details](#logginglevel) |
-| mdsAccessToken | MDS access token | [Details](#mdsaccesstoken) |
-| mdsCertsFolder | MDS TOC root certificates folder | [Details](#mdscertsfolder) |
-| mdsTocsFolder | MDS TOC files folder | [Details](#mdstocsfolder) |
-| metadataUrlsProvider | String value to provide source of URLs with external metadata | [Details](#metadataurlsprovider) |
-| metricReporterEnabled | Boolean value specifying whether metric reporter is enabled | [Details](#metricreporterenabled) |
-| metricReporterInterval | The interval for metric reporter in seconds | [Details](#metricreporterinterval) |
-| metricReporterKeepDataDays | The days to keep report data | [Details](#metricreporterkeepdatadays) |
-| oldU2fMigrationEnabled | Boolean value to enable disable old oxAuth U2F enrollments migration | [Details](#oldu2fmigrationenabled) |
-| personCustomObjectClassList | Custom object class list for dynamic person enrolment | [Details](#personcustomobjectclasslist) |
-| requestedCredentialTypes | List of Requested Credential Types | [Details](#requestedcredentialtypes) |
-| requestedParties | Authenticators metadata in json format | [Details](#requestedparties) |
-| serverMetadataFolder | Authenticators metadata in json format | [Details](#servermetadatafolder) |
-| sessionIdPersistInCache | Boolean value specifying whether to persist session_id in cache | [Details](#sessionidpersistincache) |
-| superGluuEnabled | Boolean value to enable disable Super Gluu extension | [Details](#supergluuenabled) |
-| unfinishedRequestExpiration | Expiration time in seconds for pending enrollment/authentication requests | [Details](#unfinishedrequestexpiration) |
-| useLocalCache | Boolean value to indicate if Local Cache is to be used | [Details](#uselocalcache) |
-| userAutoEnrollment | Allow to enroll users on enrollment/authentication requests | [Details](#userautoenrollment) |
+| Property Name                   | Description                                                                                   |                                             | 
+|---------------------------------|-----------------------------------------------------------------------------------------------|---------------------------------------------|
+| authenticationHistoryExpiration | Expiration time in seconds for approved authentication requests                               | [Details](#authenticationhistoryexpiration) |
+| authenticatorCertsFolder        | Authenticators certificates folder                                                            | [Details](#authenticatorcertsfolder)        |
+| baseEndpoint                    | The base URL for Fido2 endpoints                                                              | [Details](#baseendpoint)                    |
+| checkU2fAttestations            | Boolean value indicating if U2f attestation needs to be checked                               | [Details](#checku2fattestations)            |
+| cleanServiceBatchChunkSize      | Each clean up iteration fetches chunk of expired data per base dn and removes it from storage | [Details](#cleanservicebatchchunksize)      |
+| cleanServiceInterval            | Time interval for the Clean Service in seconds                                                | [Details](#cleanserviceinterval)            |
+| disableJdkLogger                | Boolean value specifying whether to enable JDK Loggers                                        | [Details](#disablejdklogger)                |
+| externalLoggerConfiguration     | Path to external Fido2 logging configuration                                                  | [Details](#externalloggerconfiguration)     |
+| issuer                          | URL using the https scheme for Issuer identifier                                              | [Details](#issuer)                          |
+| loggingLayout                   | Logging layout used for Fido2                                                                 | [Details](#logginglayout)                   |
+| loggingLevel                    | Logging level for Fido2 logger                                                                | [Details](#logginglevel)                    |
+| mdsAccessToken                  | MDS access token                                                                              | [Details](#mdsaccesstoken)                  |
+| mdsCertsFolder                  | MDS TOC root certificates folder                                                              | [Details](#mdscertsfolder)                  |
+| mdsTocsFolder                   | MDS TOC files folder                                                                          | [Details](#mdstocsfolder)                   |
+| metadataUrlsProvider            | String value to provide source of URLs with external metadata                                 | [Details](#metadataurlsprovider)            |
+| metricReporterEnabled           | Boolean value specifying whether metric reporter is enabled                                   | [Details](#metricreporterenabled)           |
+| metricReporterInterval          | The interval for metric reporter in seconds                                                   | [Details](#metricreporterinterval)          |
+| metricReporterKeepDataDays      | The days to keep report data                                                                  | [Details](#metricreporterkeepdatadays)      |
+| oldU2fMigrationEnabled          | Boolean value to enable disable old oxAuth U2F enrollments migration                          | [Details](#oldu2fmigrationenabled)          |
+| personCustomObjectClassList     | Custom object class list for dynamic person enrolment                                         | [Details](#personcustomobjectclasslist)     |
+| enabledFidoAlgorithms           | List of Requested Credential Types                                                            | [Details](#enabledFidoAlgorithms)           |
+| rp                              | Requested Parties Authenticators metadata in json format                                      | [Details](#rp)                              |
+| serverMetadataFolder            | Authenticators metadata in json format                                                        | [Details](#servermetadatafolder)            |
+| sessionIdPersistInCache         | Boolean value specifying whether to persist session_id in cache                               | [Details](#sessionidpersistincache)         |
+| superGluuEnabled                | Boolean value to enable disable Super Gluu extension                                          | [Details](#supergluuenabled)                |
+| unfinishedRequestExpiration     | Expiration time in seconds for pending enrollment/authentication requests                     | [Details](#unfinishedrequestexpiration)     |
+| useLocalCache                   | Boolean value to indicate if Local Cache is to be used                                        | [Details](#uselocalcache)                   |
+| debugUserAutoEnrollment         | Allow to enroll users on enrollment/authentication requests                                   | [Details](#userautoenrollment)              |
 
 
 ### authenticationHistoryExpiration
@@ -220,7 +220,7 @@ tags:
 - Default value: None
 
 
-### requestedCredentialTypes
+### enabledFidoAlgorithms
 
 - Description: List of Requested Credential Types
 
@@ -229,9 +229,9 @@ tags:
 - Default value: None
 
 
-### requestedParties
+### rp
 
-- Description: Authenticators metadata in json format
+- Description: Requested Parties Authenticators metadata in json format
 
 - Required: No
 
@@ -282,7 +282,7 @@ tags:
 - Default value: None
 
 
-### userAutoEnrollment
+### debugUserAutoEnrollment
 
 - Description: Allow to enroll users on enrollment/authentication requests