feat(jans-fido2): expose effective attestation-mode status endpoint - #14643
feat(jans-fido2): expose effective attestation-mode status endpoint#14643imran-ishaq wants to merge 3 commits into
Conversation
Add GET /jans-fido2/restv1/trust/attestation/config, a read-only view of the attestation policy the server is applying: effective mode, whether unattested authenticators are still accepted, enterprise attestation, whether the metadata service is disabled, and whether the Apple WebAuthn root CA was loaded. unattestedAuthenticatorsAllowed is derived as mode != enforced, not mode == disabled: AttestationCertificateService.isAttestationEnforced() applies the stricter MDS trust rules only for enforced, so the default monitor mode still accepts an authenticator that fails attestation. The configured mode is reported verbatim alongside a flag for whether it is recognised, since an unrecognised value silently leaves the server lenient. Mirrored through the Config API fido2 plugin for the Admin UI. Also strips trailing tab characters on two pre-existing lines of jansFido2Swagger.yaml that made the spec unparseable by strict YAML loaders. Signed-off-by: imran <imranishaq7071@gmail.com>
…do2-plugin The plugin imports io.jans.configapi.util.ApiAccessConstants and ApiConstants directly but relied on them arriving transitively through jans-config-api-server. Declare the dependency it actually uses. Signed-off-by: imran <imranishaq7071@gmail.com>
Adds a Trust Diagnostics page covering the attestation-mode endpoint, the three attestation modes, and the fact that only "enforced" rejects a failing attestation - the default "monitor" mode does not. Signed-off-by: imran <imranishaq7071@gmail.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
GitHub Actions
Inactive
GitHub Actions
Inactive
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
mo-auto
added
area-documentation
|
|
|
|
|
|
3 participants
Prepare
Description
Target issue
MDS health is invisible. TocService.refreshTOCEntries() downloads and refreshes metadata unless disableMetadataService is set, but there is no surfaced last-refresh time, blob validity, loaded entry count, or load error. Failures are caught and written to the log, then discarded — nothing retains them. A stale or failed MDS load is a common cause of "a previously valid authenticator is suddenly rejected", and today the only way to diagnose it is to grep server logs.
closes #14638
Part of #14602, deliverable (a). MDS health (#) and rejection
diagnostics (#) follow in separate PRs.
Implementation Details
GET /jans-fido2/restv1/trust/attestation/config, mirrored in the Config APIfido2 plugin. Read-only — it surfaces configuration the server already holds and changes no attestation behaviour.
Two decisions worth review attention:
unattestedAuthenticatorsAllowedismode != enforced, notmode == disabled.AttestationCertificateService.isAttestationEnforced()applies the stricter MDS trust rules only forenforced;disabledandmonitorare both lenient. Sincemonitoris the default, an authenticator that fails attestation validation is still registered — surfacing that is the point of the endpoint. There is a test pinning it.The mode is reported verbatim with an
attestationModeRecognizedflag.Fido2Configuration.attestationModeis a rawString; a typo such asEnforcesilently leaves the server lenient, so the response reveals it rather than normalising it away.AttestationCertificateServicegains anisAppleRootCaPresent()accessor — the field is already populated at startup, and a missing Apple root CA is currently only a log warning. Note that #14602 groups this signal under MDS health; it is exposed here instead, since it is a property of the attestation trust anchors rather than of the metadata blob.Date fields are pre-formatted strings: the FIDO2
DataMapperServiceuses a plainObjectMapperwith no JSR-310 module registered.Two changes that are not part of the feature:
jansFido2Swagger.yamlhad trailing tab characters on two pre-existing lines that made the spec fail to parse in any strictYAML loader. Fixedhere because it is the same file as the feature additions; whitespace only.
plugins/fido2-plugin/pom.xmldeclaresjans-config-api-commonexplicitly (separate commit) — the plugin importsApiAccessConstantsandApiConstantsdirectly.Test and Document the changes
Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with
docs:to indicate documentation changes or if the below checklist is not selected.