Getting Started

ykman fido config enable-ep-attestation

{
  "rp": {
    "name": "App that supports EA",
    "id": "my.enterprise.app.com"
  },
  "user": {/** */},
  "challenge": "5cdN-d6jIHShmRCeYjPHe5990bg9USk_Z7jfV0h7aQI",
  "pubKeyCredParams": {/** */},
  "excludeCredentials": {/** */},
  "authenticatorSelection": {/** */},
  "attestation": "enterprise",
  "extensions": {/** */}
}

import com.yubico.webauthn.RelyingParty;

private final RelyingParty rp = RelyingParty.builder()
    .identity(RelyingPartyIdentity.builder()
      .id("my.ea.app")
      .name("My app")
      .build())
    .credentialRepository(this.userStorage)
    .origins(Config.getOrigins())
    .attestationConveyancePreference(Optional.of(AttestationConveyancePreference.ENTERPRISE))
    .build();

import com.yubico.webauthn.data.UserIdentity;
import com.yubico.webauthn.data.PublicKeyCredentialCreationOptions;

public String attestationOptions() throws Exception {

    /*
     * Create a generic/random user for the example
     */
    UserIdentity userIdentity = UserIdentity.builder()
      .name("Default User")
      .displayName("Default User")
      .id(generateRandom(32))
      .build();

    /*
     * Create PublicKeyCredentialCreationOptions
     * Note, the attestation preference was set in the RP configs in the previous code example
     */
    PublicKeyCredentialCreationOptions assertionOptions = this.rp.startRegistration(
        StartRegistrationOptions.builder()
          .user(userIdentity)
          .timeout(180000)
          .build());

    /*
     * Return the JSON object to the client
     */
    return assertionOptions.toCredentialsCreateJson();
  }

import {
  create,
  parseCreationOptionsFromJSON,
} from "@github/webauthn-json/browser-ponyfill";

const invokeWebAuthn = async() => {
    // Call Java app for attestation options
    const startOptions = { method: "GET" };
    const response = await fetch("https://api.my.ea.app/v1/attestation/options", startOptions);
    const response_json = await response.json();

    // Invoke WebAuthn request with attestation options
    const attestationResult = await create(
      parseCreationOptionsFromJSON(response_json)
    );

    // Call Java app to send credential response
    // Note, the implementation for this method is the upcoming guidance
    const resultOptions = { method: "POST", body: JSON.stringify(attestationResult) }
    const response2 = await fetch(
      "https://api.my.ea.app/v1/attestation/result",
      resultOptions);
  }

/*
   * Request structure
   * {
   *   type: "public-key",
   *   id: "base64url credential ID",
   *   clientExtensionResults: {},
   *   response: {
   *      clientDataJSON: "base64url string",
   *      attestationObject: "CBOR encoded object"
   *   }
   * }
   */
  public void attestationResult(String request) throws Exception {
    // Parse the JSON request
    PublicKeyCredential<AuthenticatorAttestationResponse, ClientRegistrationExtensionOutputs>
      parsedRequest = PublicKeyCredential.parseRegistrationResponseJson(request);

    // Read the attestationObject
    AttestationObject attestationObject =
        new AttestationObject(parsedRequest.getResponse().getAttestationObject());

    // Parse the attestation statement for the x5c cert
    ObjectNode attestationStatement = attestationObject.getAttestationStatement();
    JsonNode x5cNode = attestationStatement.get("x5c");
    // Encode the x5c value to a String array (this is how the entry is represented)
    String[] x5cArray = mapper.readValue(x5cNode.toString(), String[].class);

    // Assume the first entry (it's the only entry)
    String firstX5c = x5cArray[0];
    byte[] bytes = ByteArray.fromBase64(firstX5c).getBytes();
    X509Certificate cert = X509CertUtils.parse(bytes);

    System.out.println("\nPrinting entire cert for analysis");
    System.out.println(cert.toString());

    /*
     * Options for reading the serial number:
     * 1) Read and parse the serial number from the cert subject name
     * 2) Read the serial number from the cert extension (1.3.6.1.4.1.45724.1.1.2)
     * 3) Optional, read both and compare to ensure that they're similar
     */

    // 1) Read serial from cert subject name
    String subjectName = cert.getSubjectX500Principal().getName();
    System.out.println("\nValue from cert subject name:");
    System.out.println(subjectName);

    // 2) Read the serial from the cert extension
    byte[] extensionValuBytes = cert.getExtensionValue("1.3.6.1.4.1.45724.1.1.2");
    // Convert extension value to int
    if (extensionValuBytes == null) {
      String errorMessage = "Serial number extension not present";
      System.out.println("\n" + errorMessage + "\nEnterprise Attestation not found");
      throw new NullPointerException(errorMessage);
    }
    int extensionValueInts = new BigInteger(1, extensionValuBytes).intValue();
    String serialNumber = String.valueOf(extensionValueInts);
    System.out.println("\nValue from cert extension value:");
    System.out.println(serialNumber);

    // 3) Compare both values to see if they match
    boolean doesEqual = subjectName.contains(serialNumber);
    System.out.println("\nDo serial numbers match: " + doesEqual);

    AttestationResponse response = new AttestationResponse(serialNumber);
    return mapper.writeValueAsString(response);
  }

CN=Yubico Fido EE (Serial\=19600953),OU=Enterprise Attestation,O=Yubico AB,C=SE