Skip to content

Commit 16e0acb

Browse files
emlunemlun
committed
Release 2.0.0
This release removes deprecated APIs and changes some defaults to better align with the L2 version of the WebAuthn spec. It also adds a new major feature: optional integration with the FIDO Metadata Service for retrieving authenticator metadata and attestation trust roots. See below for details. `webauthn-server-core`: Breaking changes: - Deleted deprecated `icon` field in `RelyingPartyIdentity` and `UserIdentity`, and its associated methods. - Deleted deprecated `AuthenticatorSelectionCriteria` methods `builder().requireResidentKey(boolean)` and `isRequireResidentKey()`. - `RelyingParty` parameter `allowUnrequestedExtensions` removed. The library will now always accept unrequested extensions. - Class `ClientAssertionExtensionOutputs` now silently ignores unknown extensions instead of rejecting them. - `webauthn-server-core-minimal` module deleted. - `webauthn-server-core` no longer depends on BouncyCastle and will no longer attempt to automatically fall back to it. Therefore, EdDSA keys are no longer supported by default in JDK 14 and earlier. The library will log warnings if configured for algorithms with no JCA provider available, in which case the dependent project may need to add additional dependencies and configure JCA providers externally. - Enum value `AttestationType.ECDAA` removed without replacement. - Deleted methods `RegistrationResult.getWarnings()` and `AssertionResult.getWarnings()` since they are now always empty. - Framework for attestation metadata has been fully overhauled. See the `webauthn-server-attestation` module documentation for the new ways to work with attestation metadata: - Deleted method `RegistrationResult.getAttestationMetadata()`. - Interface `MetadataService` replaced with `AttestationTrustSource`, and optional `RelyingParty` setting `.metadataService(MetadataService)` replaced with `.attestationTrustSource(AttestationTrustSource)`. - Deleted types `Attestation` and `Transport`. - Deleted method `AuthenticatorTransport.fromU2fTransport`. - `RelyingParty.finishRegistration()` now uses a JCA `CertPathValidator` to validate attestation certificate paths, if an attestation trust source has been configured. This requires a compatible JCA provider, but should already be available in most environments. - Classes in package `com.yubico.fido.metadata` moved to `com.yubico.webauthn.extension.uvm` to avoid name clash with `webauthn-server-attestation` module in JPMS. - Changed return type of `PublicKeyCredentialRequestOptions.getUserVerification()`, `AuthenticatorSelectionCriteria.getUserVerification()` and `AuthenticatorSelectionCriteria.getResidentKey()` to `Optional`, and changed defaults for `userVerification` and `residentKey` to empty. This means we won't inadvertently suppress warnings that browsers might issue in the browser console if for example `userVerification` is not set explicitly. New features: - Method `getAaguid()` added to `RegistrationResult`. - Method `getAttestationTrustPath()` added to `RegistrationResult`. - Setting `.clock(Clock)` added to `RelyingParty`. It is used for attestation path validation if an `attestationTrustSource` is configured. `webauthn-server-attestation`: Breaking changes: - Types `AttestationResolver`, `CompositeAttestationResolver`, `CompositeTrustResolver`, `DeviceMatcher`, `ExtensionMatcher`, `FingerprintMatcher`, `MetadataObject`, `SimpleAttestationResolver`, `SimpleTrustResolver`, `StandardMetadataService` and `TrustResolver` deleted in favour of a new attestation metadata framework. Some of the functionality is retained as the new `YubicoJsonMetadataService` class in the `webauthn-server-demo` subproject in the library sources, but no longer exposed in either library module. - Library no longer contains a `/metadata.json` resource. New features: - New types `FidoMetadataService` and `FidoMetadataDownloader` which integrate with the FIDO Metadata Service for retrieving authenticator metadata and attestation trust roots.
2 parents e95b7f6 + 012c356 commit 16e0acb

File tree

179 files changed

+13431
-5213
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

179 files changed

+13431
-5213
lines changed

‎.github/workflows/release-verify-signatures.yml

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -36,20 +36,16 @@ jobs:
3636
3737
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-attestation-${TAGNAME}.jar.asc
3838
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-core-${TAGNAME}.jar.asc
39-
wget https://github.com/${GITHUB_REPOSITORY}/releases/download/${TAGNAME}/webauthn-server-core-minimal-${TAGNAME}.jar.asc
4039
4140
gpg --no-default-keyring --keyring yubico --verify webauthn-server-attestation-${TAGNAME}.jar.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${TAGNAME}.jar
42-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.asc webauthn-server-core-bundle/build/libs/webauthn-server-core-${TAGNAME}.jar
43-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-minimal-${TAGNAME}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-minimal-${TAGNAME}.jar
41+
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.asc webauthn-server-core/build/libs/webauthn-server-core-${TAGNAME}.jar
4442
4543
- name: Verify signatures from Maven Central
4644
run: |
4745
export TAGNAME=${GITHUB_REF#refs/tags/}
4846
4947
wget -O webauthn-server-core-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-core/${TAGNAME}/webauthn-server-core-${TAGNAME}.jar.asc
50-
wget -O webauthn-server-core-minimal-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-core-minimal/${TAGNAME}/webauthn-server-core-minimal-${TAGNAME}.jar.asc
5148
wget -O webauthn-server-attestation-${TAGNAME}.jar.mavencentral.asc https://repo1.maven.org/maven2/com/yubico/webauthn-server-attestation/${TAGNAME}/webauthn-server-attestation-${TAGNAME}.jar.asc
5249
5350
gpg --no-default-keyring --keyring yubico --verify webauthn-server-attestation-${TAGNAME}.jar.mavencentral.asc webauthn-server-attestation/build/libs/webauthn-server-attestation-${TAGNAME}.jar
54-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.mavencentral.asc webauthn-server-core-bundle/build/libs/webauthn-server-core-${TAGNAME}.jar
55-
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-minimal-${TAGNAME}.jar.mavencentral.asc webauthn-server-core/build/libs/webauthn-server-core-minimal-${TAGNAME}.jar
51+
gpg --no-default-keyring --keyring yubico --verify webauthn-server-core-${TAGNAME}.jar.mavencentral.asc webauthn-server-core/build/libs/webauthn-server-core-${TAGNAME}.jar

‎NEWS

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,85 @@
1+
== Version 2.0.0 ==
2+
3+
This release removes deprecated APIs and changes some defaults to better align
4+
with the L2 version of the WebAuthn spec. It also adds a new major feature:
5+
optional integration with the FIDO Metadata Service for retrieving authenticator
6+
metadata and attestation trust roots. See below for details.
7+
8+
`webauthn-server-core`:
9+
10+
Breaking changes:
11+
12+
* Deleted deprecated `icon` field in `RelyingPartyIdentity` and `UserIdentity`,
13+
and its associated methods.
14+
* Deleted deprecated `AuthenticatorSelectionCriteria` methods
15+
`builder().requireResidentKey(boolean)` and `isRequireResidentKey()`.
16+
* `RelyingParty` parameter `allowUnrequestedExtensions` removed. The library
17+
will now always accept unrequested extensions.
18+
* Class `ClientAssertionExtensionOutputs` now silently ignores unknown
19+
extensions instead of rejecting them.
20+
* `webauthn-server-core-minimal` module deleted.
21+
* `webauthn-server-core` no longer depends on BouncyCastle and will no longer
22+
attempt to automatically fall back to it. Therefore, EdDSA keys are no longer
23+
supported by default in JDK 14 and earlier. The library will log warnings if
24+
configured for algorithms with no JCA provider available, in which case the
25+
dependent project may need to add additional dependencies and configure JCA
26+
providers externally.
27+
* Enum value `AttestationType.ECDAA` removed without replacement.
28+
* Deleted methods `RegistrationResult.getWarnings()` and
29+
`AssertionResult.getWarnings()` since they are now always empty.
30+
* Framework for attestation metadata has been fully overhauled. See the
31+
`webauthn-server-attestation` module documentation for the new ways to work
32+
with attestation metadata:
33+
** Deleted method `RegistrationResult.getAttestationMetadata()`.
34+
** Interface `MetadataService` replaced with `AttestationTrustSource`, and
35+
optional `RelyingParty` setting `.metadataService(MetadataService)` replaced
36+
with `.attestationTrustSource(AttestationTrustSource)`.
37+
** Deleted types `Attestation` and `Transport`.
38+
** Deleted method `AuthenticatorTransport.fromU2fTransport`.
39+
* `RelyingParty.finishRegistration()` now uses a JCA `CertPathValidator` to
40+
validate attestation certificate paths, if an attestation trust source has
41+
been configured. This requires a compatible JCA provider, but should already
42+
be available in most environments.
43+
* Classes in package `com.yubico.fido.metadata` moved to
44+
`com.yubico.webauthn.extension.uvm` to avoid name clash with
45+
`webauthn-server-attestation` module in JPMS.
46+
* Changed return type of
47+
`PublicKeyCredentialRequestOptions.getUserVerification()`,
48+
`AuthenticatorSelectionCriteria.getUserVerification()` and
49+
`AuthenticatorSelectionCriteria.getResidentKey()` to `Optional`, and changed
50+
defaults for `userVerification` and `residentKey` to empty. This means we
51+
won't inadvertently suppress warnings that browsers might issue in the browser
52+
console if for example `userVerification` is not set explicitly.
53+
54+
New features:
55+
56+
* Method `getAaguid()` added to `RegistrationResult`.
57+
* Method `getAttestationTrustPath()` added to `RegistrationResult`.
58+
* Setting `.clock(Clock)` added to `RelyingParty`. It is used for attestation
59+
path validation if an `attestationTrustSource` is configured.
60+
61+
62+
`webauthn-server-attestation`:
63+
64+
Breaking changes:
65+
66+
* Types `AttestationResolver`, `CompositeAttestationResolver`,
67+
`CompositeTrustResolver`, `DeviceMatcher`, `ExtensionMatcher`,
68+
`FingerprintMatcher`, `MetadataObject`, `SimpleAttestationResolver`,
69+
`SimpleTrustResolver`, `StandardMetadataService` and `TrustResolver` deleted
70+
in favour of a new attestation metadata framework. Some of the functionality
71+
is retained as the new `YubicoJsonMetadataService` class in the
72+
`webauthn-server-demo` subproject in the library sources, but no longer
73+
exposed in either library module.
74+
* Library no longer contains a `/metadata.json` resource.
75+
76+
New features:
77+
78+
* New types `FidoMetadataService` and `FidoMetadataDownloader` which integrate
79+
with the FIDO Metadata Service for retrieving authenticator metadata and
80+
attestation trust roots.
81+
82+
183
== Version 1.12.4 ==
284

385
Deprecated features:

‎README

Lines changed: 43 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,19 @@ for a server to support Web Authentication. This includes registering
1414
authenticators and authenticating registered authenticators.
1515

1616

17+
[WARNING]
18+
.*Psychic signatures in Java*
19+
==========
20+
In April 2022, link:https://neilmadden.blog/2022/04/19/psychic-signatures-in-java/[CVE-2022-21449]
21+
was disclosed in Oracle's OpenJDK (and other JVMs derived from it) which can impact applications using java-webauthn-server.
22+
The impact is that for the most common type of WebAuthn credential, invalid signatures are accepted as valid,
23+
allowing authentication bypass for users with such a credential.
24+
Please read link:https://openjdk.java.net/groups/vulnerability/advisories/2022-04-19[Oracle's advisory]
25+
and make sure you are not using one of the impacted OpenJDK versions.
26+
If you are, we urge you to upgrade your Java deployment to a version that is safe.
27+
==========
28+
29+
1730
toc::[]
1831

1932

@@ -25,17 +38,22 @@ Maven:
2538
<dependency>
2639
<groupId>com.yubico</groupId>
2740
<artifactId>webauthn-server-core</artifactId>
28-
<version>1.12.4</version>
41+
<version>2.0.0</version>
2942
<scope>compile</scope>
3043
</dependency>
3144
----------
3245

3346
Gradle:
3447

3548
----------
36-
compile 'com.yubico:webauthn-server-core:1.12.4'
49+
compile 'com.yubico:webauthn-server-core:2.0.0'
3750
----------
3851

52+
NOTE: You may need additional dependencies with JCA providers to support some signature algorithms.
53+
In particular, OpenJDK 14 and earlier does not include providers for the EdDSA family of algorithms.
54+
The library will log warnings if you try to configure it for algorithms with no JCA provider available.
55+
56+
3957
=== Semantic versioning
4058

4159
This library uses link:https://semver.org/[semantic versioning].
@@ -50,16 +68,11 @@ Breaking changes to these will NOT be reflected in version numbers.
5068

5169
=== Additional modules
5270

53-
In addition to the main `webauthn-server-core` module, there are also:
54-
55-
- `webauthn-server-attestation`: A simple implementation of the
56-
link:https://developers.yubico.com/java-webauthn-server/JavaDoc/webauthn-server-core-minimal/latest/com/yubico/webauthn/attestation/MetadataService.html[`MetadataService`]
57-
interface, which by default comes preloaded with attestation metadata for Yubico devices.
71+
In addition to the main `webauthn-server-core` module, there is also:
5872

59-
- `webauthn-server-core-minimal`: Alternative distribution of `webauthn-server-core`,
60-
not dependent on BouncyCastle.
61-
Using it means you may have to add your own JCA providers to support some signature algorithms.
62-
In particular, OpenJDK 14 and earlier does not include providers for the EdDSA family of algorithms.
73+
- `webauthn-server-attestation`: Integration with the https://fidoalliance.org/metadata/[FIDO Metadata Service]
74+
for retrieving and selecting trust roots to use for verifying
75+
https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-attestation[attestation statements].
6376

6477

6578
== Features
@@ -70,9 +83,8 @@ In addition to the main `webauthn-server-core` module, there are also:
7083
https://www.w3.org/TR/webauthn/#sctn-rp-operations[validation logic] on the
7184
response from the client
7285
- No mutable state or side effects - everything (except builders) is thread safe
73-
- Optionally integrates with a "metadata service" to verify
86+
- Optionally integrates with an "attestation trust source" to verify
7487
https://www.w3.org/TR/webauthn/#sctn-attestation[authenticator attestations]
75-
and annotate responses with additional authenticator metadata
7688
- Reproducible builds: release signatures match fresh builds from source. See
7789
link:#reproducible-builds[Reproducible builds] below.
7890

@@ -93,6 +105,11 @@ link:https://developers.yubico.com/java-webauthn-server/JavaDoc/webauthn-server-
93105
for in-depth API documentation.
94106

95107

108+
== Migrating from version `1.x`
109+
110+
See link:doc/Migrating_from_v1.adoc[the migration guide].
111+
112+
96113
== Getting started
97114

98115
Using this library comes in two parts: the server side and the client side.
@@ -557,6 +574,19 @@ credentials.
557574
. Finally, the application reports success and resumes its business logic.
558575

559576

577+
== Using attestation
578+
579+
WebAuthn supports
580+
link:https://www.w3.org/TR/2021/REC-webauthn-2-20210408/#sctn-attestation[authenticator attestation],
581+
which provides a way for the web service
582+
to request cryptographic proof of what authenticator the user is using.
583+
Most services do not need this, and it is disabled by default.
584+
585+
The link:webauthn-server-attestation[`webauthn-server-attestation` module]
586+
provides optional additional features for working with attestation.
587+
See the module documentation for more details.
588+
589+
560590
== Building
561591

562592
Use the included

‎build.gradle

Lines changed: 4 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ buildscript {
44
}
55
dependencies {
66
classpath 'com.cinnober.gradle:semver-git:2.5.0'
7-
classpath 'com.diffplug.spotless:spotless-plugin-gradle:6.3.0'
7+
classpath 'com.diffplug.spotless:spotless-plugin-gradle:6.5.1'
88
classpath 'io.github.cosmicsilence:gradle-scalafix:0.1.13'
99
}
1010
}
@@ -40,7 +40,7 @@ if (publishEnabled) {
4040
}
4141

4242
wrapper {
43-
gradleVersion = '7.2'
43+
gradleVersion = '7.3'
4444
}
4545

4646
dependencies {
@@ -49,6 +49,7 @@ dependencies {
4949
api('com.fasterxml.jackson.core:jackson-databind:[2.13.2.1,3)')
5050
api('com.fasterxml.jackson.dataformat:jackson-dataformat-cbor:[2.13.2,3)')
5151
api('com.fasterxml.jackson.datatype:jackson-datatype-jdk8:[2.13.2,3)')
52+
api('com.fasterxml.jackson.datatype:jackson-datatype-jsr310:[2.13.2,3)')
5253
api('com.fasterxml.jackson:jackson-bom') {
5354
version {
5455
strictly '[2.13.2.1,3)'
@@ -72,6 +73,7 @@ dependencies {
7273
api('org.scalacheck:scalacheck_2.13:[1.14.0,2)')
7374
api('org.scalatest:scalatest_2.13:[3.0.8,3.1)')
7475
api('org.slf4j:slf4j-api:[1.7.25,2)')
76+
api('uk.org.lidalia:slf4j-test:[1.1.0,2)')
7577
}
7678
}
7779

@@ -217,17 +219,6 @@ subprojects { project ->
217219
archiveClassifier = 'javadoc'
218220
from javadoc
219221
}
220-
221-
// TODO: Revert this if statement in the next major release
222-
if (project.projectDir.name != "webauthn-server-core-bundle") {
223-
rootProject.tasks.assembleJavadoc {
224-
dependsOn javadoc
225-
inputs.dir javadoc.destinationDir
226-
from(javadoc.destinationDir) {
227-
into project.projectDir.name
228-
}
229-
}
230-
}
231222
}
232223

233224
if (project.hasProperty('publishMe') && project.publishMe) {

0 commit comments

Comments
 (0)