feat(jans-fido2): expose effective attestation-mode status endpoint - #14643
feat(jans-fido2): expose effective attestation-mode status endpoint#14643imran-ishaq wants to merge 5 commits into
Conversation
Add GET /jans-fido2/restv1/trust/attestation/config, a read-only view of the attestation policy the server is applying: effective mode, whether unattested authenticators are still accepted, enterprise attestation, whether the metadata service is disabled, and whether the Apple WebAuthn root CA was loaded. unattestedAuthenticatorsAllowed is derived as mode != enforced, not mode == disabled: AttestationCertificateService.isAttestationEnforced() applies the stricter MDS trust rules only for enforced, so the default monitor mode still accepts an authenticator that fails attestation. The configured mode is reported verbatim alongside a flag for whether it is recognised, since an unrecognised value silently leaves the server lenient. Mirrored through the Config API fido2 plugin for the Admin UI. Also strips trailing tab characters on two pre-existing lines of jansFido2Swagger.yaml that made the spec unparseable by strict YAML loaders. Signed-off-by: imran <imranishaq7071@gmail.com>
…do2-plugin The plugin imports io.jans.configapi.util.ApiAccessConstants and ApiConstants directly but relied on them arriving transitively through jans-config-api-server. Declare the dependency it actually uses. Signed-off-by: imran <imranishaq7071@gmail.com>
Adds a Trust Diagnostics page covering the attestation-mode endpoint, the three attestation modes, and the fact that only "enforced" rejects a failing attestation - the default "monitor" mode does not. Signed-off-by: imran <imranishaq7071@gmail.com>
|
Warning Review limit reached
Next review available in: 15 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThe PR adds read-only FIDO2 attestation trust status endpoints, a shared response model, trust-state calculation, Apple root CA reporting, OpenAPI definitions, tests, an example configuration, and diagnostics documentation. ChangesFIDO2 trust status
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related issues
Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
GitHub Actions
Inactive
GitHub Actions
Inactive
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
mo-auto
added
area-documentation
|
|
|
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 6
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/janssen-server/fido/trust-diagnostics.md`:
- Around line 35-45: Convert the top-level JSON example in the trust diagnostics
documentation from fenced code-block syntax to the configured indented
code-block style, preserving the example content and indentation so MD046
passes.
- Around line 59-63: Revise the enforcement statement in the important note to
explicitly scope rejection behavior to registrations with failed attestation
validation. Clarify that only `enforced` rejects failed attestation validation,
while `disabled` and `monitor` remain lenient for those failures; avoid wording
that implies other validation checks cannot reject registrations.
In `@jans-config-api/plugins/docs/fido2-plugin-swagger.yaml`:
- Around line 1286-1303: Replace the generic JsonNode response schema for
get-fido2-trust-attestation-config with a concrete attestation configuration
model or schema matching Fido2TrustResource.getAttestationConfig(), including
the enabledFidoAlgorithms and hints array fields; update the response example to
use the structured object shape instead of an empty string.
- Line 112: Replace the empty-string response examples in the OpenAPI
generator/source asset with schema-compatible object or array examples, or omit
them where appropriate. Apply this consistently at all listed sites in
jans-config-api/plugins/docs/fido2-plugin-swagger.yaml (112-112, 164-164,
216-216, 289-289, 348-348, 414-414, 486-486, 521-521, 591-591, 626-626, 676-676,
726-726, and 786-786), ensuring each example matches its response schema and the
source used to regenerate the asset is corrected.
In
`@jans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2TrustResource.java`:
- Around line 70-75: Update Fido2TrustResource.getAttestationConfig() to bind
the inbound Authorization header and pass its value unchanged to
Fido2TrustService.getAttestationConfig instead of passing null; preserve the
existing response and error-handling flow.
In `@jans-fido2/docs/jansFido2Swagger.yaml`:
- Around line 1408-1416: Remove the enum constraint from the attestationMode
schema property. Update its description to list disabled, monitor, and enforced
as supported values while preserving that configured values are returned
verbatim and unsupported values are indicated by attestationModeRecognized.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 04abbe6f-8c78-4b61-a604-4b72778e3353
📒 Files selected for processing (18)
docs/janssen-server/fido/trust-diagnostics.mdjans-config-api/plugins/docs/fido2-plugin-swagger.yamljans-config-api/plugins/fido2-plugin/pom.xmljans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/ApiApplication.javajans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/rest/Fido2TrustResource.javajans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/service/Fido2TrustService.javajans-config-api/plugins/fido2-plugin/src/main/java/io/jans/configapi/plugin/fido2/util/Constants.javajans-config-api/server/src/main/resources/example/fido2/trust/fido2-attestation-config.jsonjans-fido2/docs/jansFido2Swagger.yamljans-fido2/model/src/main/java/io/jans/fido2/model/trust/AttestationTrustConfig.javajans-fido2/server/src/main/java/io/jans/fido2/service/app/ResteasyInitializer.javajans-fido2/server/src/main/java/io/jans/fido2/service/mds/AttestationCertificateService.javajans-fido2/server/src/main/java/io/jans/fido2/service/trust/TrustStatusService.javajans-fido2/server/src/main/java/io/jans/fido2/ws/rs/controller/Fido2TrustController.javajans-fido2/server/src/test/java/io/jans/fido2/service/mds/AttestationCertificateServiceTest.javajans-fido2/server/src/test/java/io/jans/fido2/service/trust/TrustStatusServiceTest.javajans-fido2/server/src/test/java/io/jans/fido2/ws/rs/controller/Fido2TrustControllerTest.javamkdocs.yml
…onflict Signed-off-by: imran <imranishaq7071@gmail.com>
GitHub Actions
Error
GitHub Actions
Error
…ment note to attestation Signed-off-by: imran <imranishaq7071@gmail.com>
GitHub Actions
Inactive
|
|
3 participants
Prepare
Description
Target issue
MDS health is invisible. TocService.refreshTOCEntries() downloads and refreshes metadata unless disableMetadataService is set, but there is no surfaced last-refresh time, blob validity, loaded entry count, or load error. Failures are caught and written to the log, then discarded — nothing retains them. A stale or failed MDS load is a common cause of "a previously valid authenticator is suddenly rejected", and today the only way to diagnose it is to grep server logs.
closes #14638
Part of #14602, deliverable (a). MDS health (#) and rejection
diagnostics (#) follow in separate PRs.
Implementation Details
GET /jans-fido2/restv1/trust/attestation/config, mirrored in the Config APIfido2 plugin. Read-only — it surfaces configuration the server already holds and changes no attestation behaviour.
Two decisions worth review attention:
unattestedAuthenticatorsAllowedismode != enforced, notmode == disabled.AttestationCertificateService.isAttestationEnforced()applies the stricter MDS trust rules only forenforced;disabledandmonitorare both lenient. Sincemonitoris the default, an authenticator that fails attestation validation is still registered — surfacing that is the point of the endpoint. There is a test pinning it.The mode is reported verbatim with an
attestationModeRecognizedflag.Fido2Configuration.attestationModeis a rawString; a typo such asEnforcesilently leaves the server lenient, so the response reveals it rather than normalising it away.AttestationCertificateServicegains anisAppleRootCaPresent()accessor — the field is already populated at startup, and a missing Apple root CA is currently only a log warning. Note that #14602 groups this signal under MDS health; it is exposed here instead, since it is a property of the attestation trust anchors rather than of the metadata blob.Date fields are pre-formatted strings: the FIDO2
DataMapperServiceuses a plainObjectMapperwith no JSR-310 module registered.Two changes that are not part of the feature:
jansFido2Swagger.yamlhad trailing tab characters on two pre-existing lines that made the spec fail to parse in any strictYAML loader. Fixedhere because it is the same file as the feature additions; whitespace only.
plugins/fido2-plugin/pom.xmldeclaresjans-config-api-commonexplicitly (separate commit) — the plugin importsApiAccessConstantsandApiConstantsdirectly.Test and Document the changes
Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with
docs:to indicate documentation changes or if the below checklist is not selected.Summary by CodeRabbit