feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10080

moabu · 2024-11-07T08:24:32Z

This PR completely revamps jans-fido2, to enable support for passkeys, and bring the server up to spec.

So far changes:

Added support for ED25519, RS384, RS512, ES384, ES512 feat: Minimum support ES256, RS1, RS256, ED25519 #9086
Refactoring of the assertions and attestation requests/responses to Jackson ObjectMapper feat: refactor Assertion/Attestation to Jackson ObjectMapper #9023
Removed legacy Android Safetynet and Keystore attestations ProjectPasskeys: Remove Android Safetynet and KeyStore #8901

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

I confirm that there is no impact on the docs due to the code changes in this PR.

Closes #10079,

Prev. PR #9120

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 Co-authored-by: snyk-bot <[email protected]>

Bumps commons-text from 1.9 to 1.10.0. --- updated-dependencies: - dependency-name: org.apache.commons:commons-text dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3037311

…erabilities (#972) The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1009963 - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1058913 - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1085989 - https://snyk.io/vuln/SNYK-JAVA-ORGJBOSSRESTEASY-1303102 Co-authored-by: pujavs <[email protected]>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-2945452 Co-authored-by: pujavs <[email protected]>

Bumps [postgresql](https://github.com/pgjdbc/pgjdbc) from 42.5.0 to 42.5.1. - [Release notes](https://github.com/pgjdbc/pgjdbc/releases) - [Changelog](https://github.com/pgjdbc/pgjdbc/blob/master/CHANGELOG.md) - [Commits](pgjdbc/pgjdbc@REL42.5.0...REL42.5.1) --- updated-dependencies: - dependency-name: org.postgresql:postgresql dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168084 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168085 Co-authored-by: snyk-bot <[email protected]>

Signed-off-by: Mustafa Baser <[email protected]>

Signed-off-by: shekhar16 <[email protected]>

dryrunsecurity · 2024-11-07T12:27:34Z

DryRun Security Summary

The pull request focuses on improving the configuration and documentation of the FIDO2 (Fast IDentity Online) implementation across various components of the Janssen Project application, including renaming configuration properties, enhancing logging and monitoring capabilities, updating Relying Party (RP) and FIDO2 metadata service configurations, improving the FIDO2 authentication flow, and enhancing the Swagger documentation for the FIDO2 API endpoints.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on improving the configuration and documentation of the FIDO2 (Fast IDentity Online) implementation across various components of the Janssen Project application. The changes include:

Renaming of configuration properties to align with the FIDO2 standard terminology, such as changing "requestedCredentialTypes" to "enabledFidoAlgorithms" and "requestedParties" to "rp" (Relying Party).
Improvements to the logging and monitoring capabilities, including the addition of properties for configuring logging levels and layouts.
Updates to the Relying Party (RP) configuration, including changes to the structure and naming of the RP-related properties.
Modifications to the FIDO2 metadata service configuration, such as the introduction of the "attestationMode" property.
Enhancements to the FIDO2 authentication flow, including changes to the WebAuthn API implementation and the handling of assertion and attestation requests.
Improvements to the Swagger documentation for the FIDO2 API endpoints.

From an application security perspective, these changes appear to be focused on improving the overall security and reliability of the FIDO2 implementation. The renaming of configuration properties, the addition of logging and monitoring capabilities, and the updates to the RP and metadata service configurations are all positive steps towards enhancing the security posture of the application.

Files Changed:

docs/janssen-server/config-guide/fido2-config/janssen-fido2-configuration.md: Changes to the FIDO2 configuration, including updates to the property names and structure.
docs/janssen-server/fido/logs.md: Changes to the logging configuration for the FIDO2 server.
docker-jans-fido2/scripts/upgrade.py: Updates to the FIDO2 configuration transformation and persistence handling during the upgrade process.
docs/janssen-server/fido/config.md: Changes to the FIDO2 configuration, including updates to the property names and structure.
docs/janssen-server/fido/vendor-metadata.md: Changes to the FIDO2 metadata service configuration, including the introduction of the "attestationMode" property.
jans-auth-server/server/src/main/webapp/auth/fido2/js/webauthn.js: Enhancements to the WebAuthn API implementation for FIDO2 authentication.
docs/script-catalog/person_authentication/fido2-external-authenticator/Fido2ExternalAuthenticator.py: Changes to the FIDO2 external authenticator implementation.
docs/janssen-server/reference/json/properties/fido2-properties.md: Updates to the FIDO2 configuration properties documentation.
jans-auth-server/server/src/main/webapp/auth/fido2/passkeys.xhtml: Changes to the FIDO2 authentication flow and error handling.
jans-auth-server/server/src/main/webapp/auth/fido2/login.xhtml: Improvements to the FIDO2 login page and authentication process.
jans-casa/app/src/main/java/io/jans/casa/plugins/authnmethod/service/Fido2Service.java: Updates to the FIDO2 registration and verification process.
jans-cli-tui/cli_tui/plugins/020_fido/main.py: Changes to the FIDO2 configuration management in the command-line user interface.
jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/dynamiconf.json: Updates to the FIDO2 plugin configuration in the Jans Config API.
jans-config-api/plugins/docs/fido2-plugin-swagger.yaml: Changes to the FIDO2 plugin Swagger documentation in the Jans Config API.
jans-config-api/plugins/fido2-plugin/src/test/resources/feature/fido2/fido2.json: Updates to the FIDO2 plugin configuration in the Jans Config API.
jans-fido2/client/pom.xml: Minor change to the `jans-fido2-model

Code Analysis

We ran 9 analyzers against 30 files and 2 analyzers had findings. 7 analyzers had no findings.

Analyzer	Findings
Sensitive Files Analyzer	1 finding
Authn/Authz Analyzer	5 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

…y, publicKeyAlgorithm, publicKeyId, transport to the newly created cred object.

#10101 property name changed and not reflected in the template Signed-off-by: Madhumita Subramaniam <[email protected]>

sonarcloud · 2024-11-11T18:15:06Z

Quality Gate passed for 'jans-cli'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

sonarcloud · 2024-11-14T15:37:05Z

Quality Gate passed for 'agama parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T15:42:35Z

Quality Gate passed for 'jans-config-api-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T15:42:57Z

Quality Gate passed for 'jans-core'

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T15:47:36Z

Quality Gate passed for 'jans-linux-setup'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T15:48:08Z

Quality Gate passed for 'Jans-Keycloak-Link'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T15:49:09Z

Quality Gate passed for 'keycloak-integration-parent'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T15:57:24Z

Quality Gate passed for 'jans-pycloudlib'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

sonarcloud · 2024-11-14T16:00:34Z

Quality Gate passed for 'SCIM API'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

mo-auto and others added 30 commits November 7, 2024 10:22

chore(main): release jans-orm 1.0.1-SNAPSHOT (#1713)

4150f0a

chore(main): release jans-fido2 1.0.1-SNAPSHOT (#1712)

ab2ac13

chore(main): release jans-auth-server 1.0.1-SNAPSHOT (#1711)

87fe721

chore(main): release jans-core 1.0.1-SNAPSHOT (#1710)

49f9b70

chore(main): release jans-scim 1.0.1-SNAPSHOT (#1709)

b6c07c7

chore(main): release jans-notify 1.0.1-SNAPSHOT (#1708)

827deb3

chore(main): release agama 1.0.1-SNAPSHOT (#1707)

f6909d3

fix: jans-auth-server/pom.xml to reduce vulnerabilities (#2466)

965e768

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152

fix: jans-eleven/pom.xml to reduce vulnerabilities (#2471)

5f354d4

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 Co-authored-by: snyk-bot <[email protected]>

fix: jans-eleven/pom.xml to reduce vulnerabilities (#2676)

4cba244

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3033152 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3037311

fix: jans-config-api/pom.xml to reduce vulnerabilities (#1746)

66a0e94

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGECLIPSEJETTY-2945452 Co-authored-by: pujavs <[email protected]>

docs: update README.md (#2367)

b4af3b1

chore(main): release jans-core 1.0.5-SNAPSHOT (#3143)

3356819

chore(main): release jans-config-api 1.0.5-SNAPSHOT (#3142)

2a280b6

chore(main): release jans-auth-server 1.0.5-SNAPSHOT (#3141)

9e58150

chore(main): release jans-notify 1.0.5-SNAPSHOT (#3140)

d934644

chore(main): release jans-orm 1.0.5-SNAPSHOT (#3139)

8128806

chore(main): release jans-eleven 1.0.5-SNAPSHOT (#3138)

60b41ba

chore(main): release jans-fido2 1.0.5-SNAPSHOT (#3137)

2ce03fd

chore(main): release jans-bom 1.0.5-SNAPSHOT (#3136)

664f020

chore: add owner to jans-config-api (#3283)

6328593

fix: jans-eleven/pom.xml to reduce vulnerabilities (#3315)

b15b789

The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168084 - https://snyk.io/vuln/SNYK-JAVA-ORGCODEHAUSJETTISON-3168085 Co-authored-by: snyk-bot <[email protected]>

chore(main): release jans-eleven 1.0.6-SNAPSHOT (#3538)

2233fe8

chore(main): release jans-bom 1.0.6-SNAPSHOT (#3539)

16786f0

chore(main): release jans-notify 1.0.6-SNAPSHOT (#3540)

665c3e0

chore(main): release jans-config-api 1.0.6-SNAPSHOT (#3541)

6454d14

devrimyatar and others added 2 commits November 7, 2024 10:48

feat(jans-linux-setup): move fidoconfig folder properties to db

0d9af4a

Signed-off-by: Mustafa Baser <[email protected]>

fix(jans-fido2): fix issues due unused injects (#10035)

bb425b9

Signed-off-by: shekhar16 <[email protected]>

fix: fido2 build

77c94f4

maduvena and others added 3 commits November 7, 2024 20:30

fix(ProjectPasskeys) : #9981 added rawId, authenticatorData, publicKe…

ac11837

…y, publicKeyAlgorithm, publicKeyId, transport to the newly created cred object.

fix(jans-ido2): #10101 Update dynamic-conf.json

473e3da

#10101 property name changed and not reflected in the template Signed-off-by: Madhumita Subramaniam <[email protected]>

Merge branch 'main' into passkeys-project

3ec5ad8

moabu added 2 commits November 11, 2024 22:15

Merge branch 'main' into passkeys-project

0350bb2

Merge branch 'main' into passkeys-project

452836e

ossdhaval changed the title ~~(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys~~ feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys Nov 13, 2024

mo-auto added the kind-feature Issue or PR is a new feature request label Nov 13, 2024

Merge branch 'main' into passkeys-project

e020fb9

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10080

feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10080

moabu commented Nov 7, 2024

dryrunsecurity bot commented Nov 7, 2024 •

edited

Loading

sonarcloud bot commented Nov 11, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

sonarcloud bot commented Nov 14, 2024

feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10080

Are you sure you want to change the base?

feat(jans-fido2): major FIDO2 / Passkeys upgrade ProjectPasskeys #10080

Conversation

moabu commented Nov 7, 2024

dryrunsecurity bot commented Nov 7, 2024 • edited Loading

DryRun Security Summary

Code Analysis

Riskiness

sonarcloud bot commented Nov 11, 2024

Quality Gate passed for 'jans-cli'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'agama parent'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'jans-config-api-parent'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'jans-core'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'jans-linux-setup'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'Jans-Keycloak-Link'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'keycloak-integration-parent'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'jans-pycloudlib'

sonarcloud bot commented Nov 14, 2024

Quality Gate passed for 'SCIM API'

dryrunsecurity bot commented Nov 7, 2024 •

edited

Loading