* 1. You really don't need attestation, and so you are deliberately ignoring * it. - * + *
* 2. You forgot to set attestation flag to 'direct' when making credential. - * + *
* If you are getting attestation with fmt set to none, then no attestation * is provided, and you don't have anything to verify. Simply extract user * relevant information as specified below and save it to the database. - * - * */ @ApplicationScoped public class NoneAttestationProcessor implements AttestationFormatProcessor { @@ -52,6 +49,9 @@ public class NoneAttestationProcessor implements AttestationFormatProcessor { @Inject private Logger log; + @Inject + private Base64Service base64Service; + @Override public AttestationFormat getAttestationFormat() { return AttestationFormat.none; @@ -59,13 +59,16 @@ public AttestationFormat getAttestationFormat() { @Override public void process(JsonNode attStmt, AuthData authData, Fido2RegistrationData credential, byte[] clientDataHash, - CredAndCounterData credIdAndCounters) { + CredAndCounterData credIdAndCounters) { log.debug("None/Surrogate attestation {}", attStmt); - if (attStmt.iterator().hasNext()) { + if (!attStmt.isEmpty()) { + log.error("Problem with None/Surrogate attestation"); throw new Fido2RuntimeException("Problem with None/Surrogate attestation"); } credIdAndCounters.setAttestationType(getAttestationFormat().getFmt()); + credIdAndCounters.setCredId(base64Service.urlEncodeToString(authData.getCredId())); + credIdAndCounters.setUncompressedEcPoint(base64Service.urlEncodeToString(authData.getCosePublicKey())); } } diff --git a/jans-fido2/server/src/test/java/io/jans/fido2/service/processor/assertion/NoneAssertionFormatProcessorTest.java b/jans-fido2/server/src/test/java/io/jans/fido2/service/processor/assertion/NoneAssertionFormatProcessorTest.java new file mode 100644 index 00000000000..d017f74020a --- /dev/null +++ b/jans-fido2/server/src/test/java/io/jans/fido2/service/processor/assertion/NoneAssertionFormatProcessorTest.java @@ -0,0 +1,163 @@ +package io.jans.fido2.service.processor.assertion; + +import com.fasterxml.jackson.databind.JsonNode; +import io.jans.fido2.exception.Fido2CompromisedDevice; +import io.jans.fido2.exception.Fido2RuntimeException; +import io.jans.fido2.model.auth.AuthData; +import io.jans.fido2.service.AuthenticatorDataParser; +import io.jans.fido2.service.Base64Service; +import io.jans.fido2.service.CoseService; +import io.jans.fido2.service.DataMapperService; +import io.jans.fido2.service.verifier.AuthenticatorDataVerifier; +import io.jans.fido2.service.verifier.CommonVerifiers; +import io.jans.fido2.service.verifier.UserVerificationVerifier; +import io.jans.orm.model.fido2.Fido2AuthenticationData; +import io.jans.orm.model.fido2.Fido2RegistrationData; +import io.jans.orm.model.fido2.UserVerification; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.InjectMocks; +import org.mockito.Mock; +import org.mockito.junit.jupiter.MockitoExtension; +import org.slf4j.Logger; + +import java.io.IOException; +import java.security.PublicKey; + +import static org.junit.jupiter.api.Assertions.*; +import static org.mockito.Mockito.*; + +@ExtendWith(MockitoExtension.class) +class NoneAssertionFormatProcessorTest { + + @InjectMocks + private NoneAssertionFormatProcessor noneAssertionFormatProcessor; + + @Mock + private Logger log; + + @Mock + private CoseService coseService; + + @Mock + private CommonVerifiers commonVerifiers; + + @Mock + private AuthenticatorDataVerifier authenticatorDataVerifier; + + @Mock + private UserVerificationVerifier userVerificationVerifier; + + @Mock + private AuthenticatorDataParser authenticatorDataParser; + + @Mock + private DataMapperService dataMapperService; + + @Mock + private Base64Service base64Service; + + @Test + void getAttestationFormat_valid_none() { + String fmt = noneAssertionFormatProcessor.getAttestationFormat().getFmt(); + assertNotNull(fmt); + assertEquals(fmt, "none"); + } + + @Test + void process_validData_success() throws IOException { + String base64AuthenticatorData = "base64AuthenticatorData_test"; + String signature = "signature_test"; + String clientDataJson = "clientDataJson_test"; + Fido2RegistrationData registration = mock(Fido2RegistrationData.class); + Fido2AuthenticationData authenticationEntity = mock(Fido2AuthenticationData.class); + + when(authenticatorDataParser.parseAssertionData(any())).thenReturn(mock(AuthData.class)); + when(base64Service.urlDecode(any(String.class))).thenReturn("decode_test".getBytes()); + when(dataMapperService.cborReadTree(any())).thenReturn(mock(JsonNode.class)); + PublicKey publicKey = mock(PublicKey.class); + when(coseService.createUncompressedPointFromCOSEPublicKey(any())).thenReturn(publicKey); + when(publicKey.getEncoded()).thenReturn("test".getBytes()); + when(authenticationEntity.getUserVerificationOption()).thenReturn(UserVerification.preferred); + when(registration.getDomain()).thenReturn("domain_test"); + + noneAssertionFormatProcessor.process(base64AuthenticatorData, signature, clientDataJson, registration, authenticationEntity); + + verify(log).debug(eq("Registration: {}"), any(Fido2RegistrationData.class)); + verify(log).debug(eq("User verification option: {}"), any(UserVerification.class)); + verify(commonVerifiers).verifyRpIdHash(any(AuthData.class), any(String.class)); + verify(log).debug(eq("Uncompressed ECpoint node: {}"), any(JsonNode.class)); + verify(log).debug(eq("EC Public key hex: {}"), any(String.class)); + verify(log).debug(eq("Registration algorithm: {}, default use: -7"), any(Integer.class)); + verify(userVerificationVerifier).verifyUserVerificationOption(any(UserVerification.class), any(AuthData.class)); + verify(authenticatorDataVerifier).verifyAssertionSignature(any(AuthData.class), any(byte[].class), any(String.class), any(PublicKey.class), any(Integer.class)); + + verify(log, never()).error(eq("Error compromised device: {}"), any(String.class)); + verify(log, never()).error(eq("Error to check none assertion: {}"), any(String.class)); + verifyNoMoreInteractions(log); + } + + @Test + void process_ifVerifyCounterIsThrowException_fido2CompromisedDevice() throws Fido2CompromisedDevice { + String base64AuthenticatorData = "base64AuthenticatorData_test"; + String signature = "signature_test"; + String clientDataJson = "clientDataJson_test"; + Fido2RegistrationData registration = mock(Fido2RegistrationData.class); + Fido2AuthenticationData authenticationEntity = mock(Fido2AuthenticationData.class); + + when(authenticationEntity.getUserVerificationOption()).thenReturn(UserVerification.preferred); + when(registration.getDomain()).thenReturn("domain_test"); + when(registration.getCounter()).thenReturn(100); + + when(authenticatorDataParser.parseAssertionData(any())).thenReturn(mock(AuthData.class)); + when(base64Service.urlDecode(any(String.class))).thenReturn("decode_test".getBytes()); + doThrow(new Fido2CompromisedDevice("fido2CompromisedDevice_testError")).when(commonVerifiers).verifyCounter(any(Integer.class), any(Integer.class)); + + Fido2CompromisedDevice ex = assertThrows(Fido2CompromisedDevice.class, () -> noneAssertionFormatProcessor.process(base64AuthenticatorData, signature, clientDataJson, registration, authenticationEntity)); + assertNotNull(ex); + assertEquals(ex.getMessage(), "fido2CompromisedDevice_testError"); + + verify(log).debug(eq("Registration: {}"), any(Fido2RegistrationData.class)); + verify(log).debug(eq("User verification option: {}"), any(UserVerification.class)); + verify(commonVerifiers).verifyRpIdHash(any(AuthData.class), any(String.class)); + verify(authenticatorDataParser).parseCounter(any()); + verify(log).error(eq("Error compromised device: {}"), any(String.class)); + + verify(log, never()).debug(eq("Registration algorithm: {}, default use: -7"), any(Integer.class)); + verify(log, never()).error(eq("Error to check none assertion: {}"), any(String.class)); + verifyNoInteractions(authenticatorDataVerifier); + verifyNoMoreInteractions(log); + } + + @Test + void process_ifCborReadTreeThrowException_fido2RuntimeException() throws Fido2CompromisedDevice, IOException { + String base64AuthenticatorData = "base64AuthenticatorData_test"; + String signature = "signature_test"; + String clientDataJson = "clientDataJson_test"; + Fido2RegistrationData registration = mock(Fido2RegistrationData.class); + Fido2AuthenticationData authenticationEntity = mock(Fido2AuthenticationData.class); + + when(authenticationEntity.getUserVerificationOption()).thenReturn(UserVerification.preferred); + when(registration.getDomain()).thenReturn("domain_test"); + when(registration.getCounter()).thenReturn(100); + when(registration.getUncompressedECPoint()).thenReturn("uncompressedECPoint_test"); + + when(authenticatorDataParser.parseAssertionData(any())).thenReturn(mock(AuthData.class)); + when(base64Service.urlDecode(any(String.class))).thenReturn("decode_test".getBytes()); + when(dataMapperService.cborReadTree(any(byte[].class))).thenThrow(new IOException("IOException_test")); + + Fido2RuntimeException ex = assertThrows(Fido2RuntimeException.class, () -> noneAssertionFormatProcessor.process(base64AuthenticatorData, signature, clientDataJson, registration, authenticationEntity)); + assertNotNull(ex); + assertEquals(ex.getMessage(), "IOException_test"); + + verify(log).debug(eq("Registration: {}"), any(Fido2RegistrationData.class)); + verify(log).debug(eq("User verification option: {}"), any(UserVerification.class)); + verify(commonVerifiers).verifyRpIdHash(any(AuthData.class), any(String.class)); + verify(authenticatorDataParser).parseCounter(any()); + verify(log).error(eq("Error to check none assertion: {}"), any(String.class)); + + verify(log, never()).error(eq("Error compromised device: {}"), any(String.class)); + verifyNoInteractions(coseService, authenticatorDataVerifier); + verifyNoMoreInteractions(log); + } +} diff --git a/jans-fido2/server/src/test/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessorTest.java b/jans-fido2/server/src/test/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessorTest.java new file mode 100644 index 00000000000..ea9089ff7c2 --- /dev/null +++ b/jans-fido2/server/src/test/java/io/jans/fido2/service/processor/attestation/NoneAttestationProcessorTest.java @@ -0,0 +1,77 @@ +package io.jans.fido2.service.processor.attestation; + +import com.fasterxml.jackson.databind.JsonNode; +import io.jans.fido2.exception.Fido2RuntimeException; +import io.jans.fido2.model.auth.AuthData; +import io.jans.fido2.model.auth.CredAndCounterData; +import io.jans.fido2.service.Base64Service; +import io.jans.orm.model.fido2.Fido2RegistrationData; +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.ExtendWith; +import org.mockito.InjectMocks; +import org.mockito.Mock; +import org.mockito.junit.jupiter.MockitoExtension; +import org.slf4j.Logger; + +import static org.junit.jupiter.api.Assertions.*; +import static org.mockito.Mockito.*; + +@ExtendWith(MockitoExtension.class) +class NoneAttestationProcessorTest { + + @InjectMocks + private NoneAttestationProcessor noneAttestationProcessor; + + @Mock + private Logger log; + + @Mock + private Base64Service base64Service; + + @Test + void getAttestationFormat_valid_none() { + String fmt = noneAttestationProcessor.getAttestationFormat().getFmt(); + assertNotNull(fmt); + assertEquals(fmt, "none"); + } + + @Test + void process_validData_success() { + JsonNode attStmt = mock(JsonNode.class); + AuthData authData = mock(AuthData.class); + Fido2RegistrationData credential = mock(Fido2RegistrationData.class); + byte[] clientDataHash = "clientDataHash_test".getBytes(); + CredAndCounterData credIdAndCounters = mock(CredAndCounterData.class); + + when(attStmt.isEmpty()).thenReturn(true); + when(authData.getCredId()).thenReturn("credId_test".getBytes()); + when(authData.getCosePublicKey()).thenReturn("cosePublicKey_test".getBytes()); + + noneAttestationProcessor.process(attStmt, authData, credential, clientDataHash, credIdAndCounters); + + verify(log).debug(eq("None/Surrogate attestation {}"), any(JsonNode.class)); + verify(base64Service, times(2)).urlEncodeToString(any(byte[].class)); + + verify(log, never()).error(eq("Problem with None/Surrogate attestation")); + } + + @Test + void process_ifAttStmtIsEmptyFalse_fido2RuntimeException() { + JsonNode attStmt = mock(JsonNode.class); + AuthData authData = mock(AuthData.class); + Fido2RegistrationData credential = mock(Fido2RegistrationData.class); + byte[] clientDataHash = "clientDataHash_test".getBytes(); + CredAndCounterData credIdAndCounters = mock(CredAndCounterData.class); + + when(attStmt.isEmpty()).thenReturn(false); + + Fido2RuntimeException ex = assertThrows(Fido2RuntimeException.class, () -> noneAttestationProcessor.process(attStmt, authData, credential, clientDataHash, credIdAndCounters)); + assertNotNull(ex); + assertEquals(ex.getMessage(), "Problem with None/Surrogate attestation"); + + verify(log).debug(eq("None/Surrogate attestation {}"), any(JsonNode.class)); + verify(log).error(eq("Problem with None/Surrogate attestation")); + + verifyNoInteractions(base64Service); + } +}