Package com.yubico.fido.metadata

Class FidoMetadataService

  • All Implemented Interfaces:
    AttestationTrustSource
    public final class FidoMetadataService
extends java.lang.Object
implements AttestationTrustSource
    Utility for filtering and querying Fido Metadata Service BLOB entries.

    This class implements AttestationTrustSource, so it can be configured as the attestationTrustSource setting in RelyingParty. This implementation always sets enableRevocationChecking(false), because the FIDO MDS has its own revocation procedures and not all attestation certificates provide CRLs; and always sets policyTreeValidator to accept any policy tree, because a Windows Hello attestation certificate is known to include a critical certificate policies extension.

    The metadata service may be configured with two stages of filters to select trusted authenticators. The first stage is the prefilter setting, which is executed once when the FidoMetadataService instance is constructed. The second stage is the filter setting, which is executed whenever metadata or trust roots are to be looked up for a given authenticator. Any metadata entry that satisfies both filters will be considered trusted.

    Use the builder to configure settings, then use the findEntries(List, AAGUID) method or its overloads to retrieve metadata entries.

    • Method Detail

      • findEntries

        public java.util.Set<MetadataBLOBPayloadEntry> findEntries​(@NonNull
                                                           @NonNull java.util.List<java.security.cert.X509Certificate> attestationCertificateChain,
                                                           @NonNull
                                                           @NonNull java.util.Optional<AAGUID> aaguid)
        Look up metadata entries matching a given attestation certificate chain or AAGUID.
        Parameters:
        attestationCertificateChain - an attestation certificate chain, presumably from a WebAuthn attestation statement.
        aaguid - the AAGUID of the authenticator to look up, if available.
        Returns:
        All metadata entries which satisfy ALL of the following:
        • It satisfies the prefilter.
        • It satisfies AT LEAST ONE of the following:
        • It satisfies the filter together with attestationCertificateChain and _aaguid.
        In the above, _aaguid is the first of the following that is present and not zero, or empty otherwise:
        • The aaguid argument.
        • The value of the X.509 extension with OID 1.3.6.1.4.1.45724.1.1.4 (id-fido-gen-ce-aaguid), if any, in the first certificate in attestationCertificateChain, if any.
        See Also:
        findEntries(List), findEntries(List, AAGUID)

      • findEntries

        public java.util.Set<MetadataBLOBPayloadEntry> findEntries​(@NonNull
                                                           @NonNull java.util.List<java.security.cert.X509Certificate> attestationCertificateChain)
        Alias of findEntries(attestationCertificateChain, Optional.empty()).
        See Also:
        findEntries(List, Optional)

      • findEntries

        public java.util.Set<MetadataBLOBPayloadEntry> findEntries​(@NonNull
                                                           @NonNull java.util.List<java.security.cert.X509Certificate> attestationCertificateChain,
                                                           @NonNull
                                                           @NonNull AAGUID aaguid)
        Alias of findEntries(attestationCertificateChain, Optional.of(aaguid)).
        See Also:
        findEntries(List, Optional)

      • findEntries

        public java.util.Set<MetadataBLOBPayloadEntry> findEntries​(@NonNull
                                                           @NonNull RegistrationResult registrationResult)
        Find metadata entries matching the credential represented by registrationResult.

        This is an alias of: 

         registrationResult.getAttestationTrustPath()
   .map(atp -> this.findEntries(atp, new AAGUID(registrationResult.getAaguid())))
   .orElseGet(Collections::emptySet)
        See Also:
        findEntries(List, Optional)

      • findEntries

        public java.util.Set<MetadataBLOBPayloadEntry> findEntries​(@NonNull
                                                           @NonNull java.util.function.Predicate<MetadataBLOBPayloadEntry> filter)
        Retrieve metadata entries matching the given filter.

        Note: The result MAY include fewer results than the number of times the filter returned true, because of possible duplication in the underlying data store.

        Parameters:
        filter - a Predicate which returns true for metadata entries to include in the result.
        Returns:
        All metadata entries which satisfy the prefilter AND for which the filter returns true.
        See Also:
        findEntries(List, Optional)