GluuFederation / fido2

Fido2 server
MIT License
2 stars 4 forks source link

fix: Parsing of certain authenticators fails #28

Closed maduvena closed 2 years ago

maduvena commented 2 years ago
  1. The check should be made for the MetaDatastatement which is nested inside the Metadata entry JSON
  2. Also, As per https://medium.com/webauthnworks/webauthn-fido2-whats-new-in-mds3-migrating-from-mds2-to-mds3-a271d82cb774, remove validation check for assertionScheme
  3. https://github.com/GluuFederation/fido2/blob/41489cc0d1611121070a13b98018114cc8050f47/server/src/main/java/org/gluu/fido2/service/verifier/CommonVerifiers.java#L449
  4. logs

19-05 09:29:09.955 DEBUG [qtp6519275-19] [org.gluu.fido2.service.operation.AttestationService] (AttestationService.java:171) - Attestation verify {"type":"public-key","id":"ALyF1UoiHuXfxA0fdVoYNLEp9b713p39kF9fXir8Alr9SNpy0KzlsxbeNTn665MWRZWtAilTNPWigfZEo7MsJc-hB-6s0COcfOFtDuQ_70Pv8Z7IBvDnxE1zYtPufFti","response":{"attestationObject":"o2NmbXRmcGFja2VkZ2F0dFN0bXSjY2FsZyZjc2lnWEcwRQIgR7mEQ6oY4iB1kZchzvyByUI1cw6s-lNetWn7Vqco8Z8CIQDe-QNAHtGfyojjwkPcIBkoQivlcYJvUQVFOLD576kHhmN4NWOCWQI_MIICOzCCAeGgAwIBAgIQHfK1WlHcS2iFo9meaX_tFTAKBggqhkjOPQQDAjBJMQswCQYDVQQGEwJVUzEdMBsGA1UECgwURmVpdGlhbiBUZWNobm9sb2dpZXMxGzAZBgNVBAMMEkZlaXRpYW4gRklETyBDQSAwNjAgFw0xODA2MjEwMDAwMDBaGA8yMDMzMDYyMDIzNTk1OVowaDELMAkGA1UEBhMCVVMxHTAbBgNVBAoMFEZlaXRpYW4gVGVjaG5vbG9naWVzMSIwIAYDVQQLDBlBdXRoZW50aWNhdG9yIEF0dGVzdGF0aW9uMRYwFAYDVQQDDA1GVCBGSURPMiAwNTIwMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEUN9SD82hZbskyXBaa4IAK9SWLAjxpm-olCj8XKfOiIh9HPUoj03-_LWjLB4Wigajo-Wyu4FRIROZueta8l_t_6OBiTCBhjAdBgNVHQ4EFgQU_F006aSXpjEsgdoAjCaUMGN_qBQwHwYDVR0jBBgwFoAUMq6NxFzFzYJ1MCOF_rfCakMSTkAwDAYDVR0TAQH_BAIwADATBgsrBgEEAYLlHAIBAQQEAwIFIDAhBgsrBgEEAYLlHAEBBAQSBBCDO3Ia_19NALsuvdo-wB4pMAoGCCqGSM49BAMCA0gAMEUCICPllX7S2ujFDtxxpcxSy6EDAN2FAaqLNNxTEFxEEjcaAiEAizPXZVC1qw9jWCSeaECn3xO1zn0mLvXFt6hiCbeMx8ZZAf4wggH6MIIBoKADAgECAhAYFStBt0OubbQVmcOxfYILMAoGCCqGSM49BAMCMEsxCzAJBgNVBAYTAlVTMR0wGwYDVQQKDBRGZWl0aWFuIFRlY2hub2xvZ2llczEdMBsGA1UEAwwURmVpdGlhbiBGSURPIFJvb3QgQ0EwIBcNMTgwNTIwMDAwMDAwWhgPMjAzODA1MTkyMzU5NTlaMEkxCzAJBgNVBAYTAlVTMR0wGwYDVQQKDBRGZWl0aWFuIFRlY2hub2xvZ2llczEbMBkGA1UEAwwSRmVpdGlhbiBGSURPIENBIDA2MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE7hryoKa56JtamlCnaRJWJVMy6oitg80IIjtbkw5LaeqIAAxu1JlqAnU9VWCeS3SNlOXaYahuqrbJrLzXxdpIfKNmMGQwHQYDVR0OBBYEFDKujcRcxc2CdTAjhf63wmpDEk5AMB8GA1UdIwQYMBaAFEu9hyYRrRyJzwRYvnDSCIxrFiO3MBIGA1UdEwEB_wQIMAYBAf8CAQAwDgYDVR0PAQH_BAQDAgEGMAoGCCqGSM49BAMCA0gAMEUCICPHr9cK3fZlCkqjRx4DeSoGdK82acgNRZkZcp2mQ2AjAiEAxRCXOskjdrsod5MONN2Hc7U7Tzj31CiKuaYW4y8XDYBoYXV0aERhdGFY5LZf-uscYsyV2wyjuvGu0gtGTyr4OXYv6C_tV8BjPwQlRQAAYKmDO3Ia_19NALsuvdo-wB4pAGAAvIXVSiIe5d_EDR91Whg0sSn1vvXenf2QX19eKvwCWv1I2nLQrOWzFt41OfrrkxZFla0CKVM09aKB9kSjsywlz6EH7qzQI5x84W0O5D_vQ-_xnsgG8OfETXNi0-58W2KlAQIDJiABIVggBZTDAmVKGbf-oA0x9WIReQRUyo-rt6EH-BFG7-vsvi8iWCACSpE4kLBfCgFEE4qqEzgiAUj68TjlELt6kE7nxS1qSQ","clientDataJSON":"eyJ0eXBlIjoid2ViYXV0aG4uY3JlYXRlIiwiY2hhbGxlbmdlIjoicVdiSkJ5Z3lnQnZSdllzbHBuVHQ3ZUNfNjZzUUgwb3hzcFV5VV9weDNuTSIsIm9yaWdpbiI6Imh0dHBzOi8vbWFkaHUtZ2x1dSIsImNyb3NzT3JpZ2luIjpmYWxzZX0"},"clientExtensionResults":{}} 19-05 09:29:10.033 INFO [qtp6519275-19] [org.gluu.fido2.service.mds.AttestationCertificateService] (AttestationCertificateService.java:100) - No metadata for authenticator 833b721aff5f4d00bb2ebdda3ec01e29. Attempting to contact MDS 19-05 09:29:10.034 DEBUG [qtp6519275-19] [org.gluu.fido2.service.mds.MdsService] (MdsService.java:107) - Authenticator AAGUID 833b721a-ff5f-4d00-bb2e-bdda3ec01e29 status FIDO_CERTIFIEDL1 effective date 2019-05-27 19-05 09:29:10.035 WARN [qtp6519275-19] [org.gluu.fido2.service.mds.AttestationCertificateService] (AttestationCertificateService.java:107) - Failed to get metadata from Fido2 meta-data server 19-05 09:29:10.037 ERROR [qtp6519275-19] [org.gluu.fido2.service.mds.AttestationCertificateService] (AttestationCertificateService.java:120) - Failed to get trusted certificates 19-05 09:29:10.040 ERROR [qtp6519275-19] [org.gluu.fido2.service.exception.Fido2ExceptionHandler] (Fido2ExceptionHandler.java:33) - Handled Fido2 RP exception org.gluu.fido2.exception.Fido2RuntimeException: Packed full attestation but no certificates in metadata for authenticator 833b721aff5f4d00bb2ebdda3ec01e29 at org.gluu.fido2.service.processor.attestation.PackedAttestationProcessor.process(PackedAttestationProcessor.java:90) ~[classes/:?] at org.gluu.fido2.service.processor.attestation.PackedAttestationProcessor$Proxy$$$WeldClientProxy.process(Unknown Source) ~[classes/:?] at org.gluu.fido2.service.verifier.AttestationVerifier.verifyAuthenticatorAttestationResponse(AttestationVerifier.java:94) ~[classes/:?] at org.gluu.fido2.service.verifier.AttestationVerifier$Proxy$$$WeldClientProxy.verifyAuthenticatorAttestationResponse(Unknown Source) ~[classes/:?] at org.gluu.fido2.service.operation.AttestationService.verify(AttestationService.java:197) ~[classes/:?] at org.gluu.fido2.service.operation.AttestationService$Proxy$$$_WeldClientProxy.verify(Unknown Source) ~[classes/:?]