feat: reflect Authenicator Name with Passkeys

[imran-ishaq]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #9556

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request focuses on improving the security and transparency of the FIDO2 authentication process in the Jans FIDO2 server application, including the addition of new functionality to extract and store the name of the authenticator used during the registration process, as well as enhancements to the attestation certificate verification and signature validation processes.

Expand for full summary

Summary:

The code changes in this pull request focus on improving the security and transparency of the FIDO2 authentication process in the Jans FIDO2 server application. The changes include the addition of new functionality to extract and store the name of the authenticator used during the registration process, as well as enhancements to the attestation certificate verification and signature validation processes.

The key security-related changes are:

1. Authenticator Name Extraction: The addition of the authenticatorName field to the CredAndCounterData object provides more detailed information about the registered authenticators, which can be useful for security monitoring and auditing purposes.

2. Attestation Certificate Verification: The code ensures that the attestation certificates are properly validated, including checking the certificate chain, trust anchors, and the signature on the attestation data. This helps to mitigate the risk of forged or compromised attestation certificates.

3. Signature Verification: The code thoroughly verifies the signatures on the attestation statements, using either the verified attestation certificates or the extracted public keys. This is a crucial step to ensure the integrity of the registered credentials.

4. Handling of Unsupported Attestation Methods: The code correctly handles cases where unsupported attestation methods, such as ECDAA, are encountered, and throws appropriate errors. This helps maintain the security of the FIDO2 implementation by rejecting potentially insecure or unsupported attestation methods.

5. Test Coverage: The changes include updates to the test suite, which ensure that the various scenarios and edge cases related to attestation processing are thoroughly tested. This helps to improve the overall robustness and security of the FIDO2 implementation.

Overall, the changes in this pull request demonstrate a strong focus on application security and the integrity of the FIDO2 authentication process. The improvements to authenticator identification, certificate verification, and signature validation are positive steps towards enhancing the security and transparency of the Jans FIDO2 server application.

Files Changed:

1. CredAndCounterData.java: Adds a new field called authenticatorName to store the name of the authenticator used for the FIDO2 authentication process.
2. AppleAttestationProcessor.java: Updates the process method to set the authenticatorName property of the CredAndCounterData object.
3. AttestationService.java: Adds a new method to set the authenticatorName property in the AttestationOrAssertionResponse object.
4. AttestationCertificateService.java: Introduces new methods to fetch metadata information about the authenticator, including its name.
5. U2FSuperGluuAttestationProcessor.java: Sets the authenticatorName property of the CredAndCounterData object.
6. TPMProcessor.java: Sets the authenticatorName property of the CredAndCounterData object.
7. PackedAttestationProcessor.java: Performs thorough validation of the attestation certificates and signatures.
8. U2FAttestationProcessor.java: Sets the authenticatorName property of the CredAndCounterData object.
9. PackedAttestationProcessorTest.java: Tests various scenarios related to the handling of attestation certificates and signatures.
10. U2FAttestationProcessorTest.java: Updates the test suite for the U2FAttestationProcessor class.

Code Analysis

We ran 9 analyzers against 10 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Authn/Authz Analyzer	2 findings

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.