webauthn-server-attestation integration

[ionelMihai]

Hello,

I'm trying to integrate webauthn-server-attestation module in our app and i have some issue related to certificates validation.
I'm getting the following exception :
java.security.cert.CertPathValidatorException: Could not determine revocation status at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135) ~[?:1.8.0_342] at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:220) ~[?:1.8.0_342] at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140) ~[?:1.8.0_342] at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79) ~[?:1.8.0_342] at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292) ~[?:1.8.0_342] at com.yubico.fido.metadata.FidoMetadataDownloader.verifyBlob(FidoMetadataDownloader.java:1097) ~[webauthn-server-attestation-2.4.1.jar:2.4.1] at com.yubico.fido.metadata.FidoMetadataDownloader.parseAndVerifyBlob(FidoMetadataDownloader.java:1018) ~[webauthn-server-attestation-2.4.1.jar:2.4.1] at com.yubico.fido.metadata.FidoMetadataDownloader.refreshBlobInternal(FidoMetadataDownloader.java:807) ~[webauthn-server-attestation-2.4.1.jar:2.4.1] at com.yubico.fido.metadata.FidoMetadataDownloader.refreshBlob(FidoMetadataDownloader.java:795) ~[webauthn-server-attestation-2.4.1.jar:2.4.1] at com.adobe.hs.ims.adaptiveauth.passkey.PasskeyFIDOMetadataServiceProvider.<clinit>(PasskeyFIDOMetadataServiceProvider.java:33) ~[classes/:?]

Here is the code i use for initialising the FidoMetadataService

    FidoMetadataDownloader downloader = FidoMetadataDownloader.builder()
                    .expectLegalHeader("Retrieval and use of this BLOB indicates acceptance of the appropriate agreement located at https://fidoalliance.org/metadata/metadata-legal-terms/")
                    .useDefaultTrustRoot()
                    .useTrustRootCacheFile(new File(Resources.getResource("fido_cert.cer").getFile()))
                    .useDefaultBlob()
                    .useBlobCacheFile(new File(Resources.getResource(LOCAL_METADATA_FILE_NAME).getFile()))
                    .build();

    try {
        INSTANCE = FidoMetadataService.builder()
                .useBlob(downloader.refreshBlob())
                .build();
    } catch (Exception e) {
        LOGGER.error("Failed to initialize FidoMetadataService", e);
    }

I'm not sure if it's related to the library or if i'm doing something wrong. The exception is thrown both when validating the local blob and also when validating the downloaded one.

[emlun]

Hi! This looks like the same problem as in issue #271. Does the solution there work for you?

[ionelMihai]

It worked. Thank you.

Now i'm getting
com.fasterxml.jackson.databind.exc.InvalidFormatException: Cannot deserialize value of type com.yubico.fido.metadata.CtapPinUvAuthProtocolVersion from number 2: index value outside legal index range [0..1]
But i will dig more on that as it's definitely not related.

[ionelMihai]

I've found the answer for that too #214