Class FidoMetadataService

java.lang.Object
com.yubico.fido.metadata.FidoMetadataService
All Implemented Interfaces:
com.yubico.webauthn.attestation.AttestationTrustSource

public final class FidoMetadataService extends Object implements com.yubico.webauthn.attestation.AttestationTrustSource
Utility for filtering and querying Fido Metadata Service BLOB entries.

This class implements AttestationTrustSource, so it can be configured as the attestationTrustSource setting in RelyingParty. This implementation always sets enableRevocationChecking(false), because the FIDO MDS has its own revocation procedures and not all attestation certificates provide CRLs; and always sets policyTreeValidator to accept any policy tree, because a Windows Hello attestation certificate is known to include a critical certificate policies extension.

The metadata service may be configured with two stages of filters to select trusted authenticators. The first stage is the prefilter setting, which is executed once when the FidoMetadataService instance is constructed. The second stage is the filter setting, which is executed whenever metadata or trust roots are to be looked up for a given authenticator. Any metadata entry that satisfies both filters will be considered trusted.

Use the builder to configure settings, then use the findEntries(List, AAGUID) method or its overloads to retrieve metadata entries.