feat(jans-fido2): expose FIDO Metadata Service (MDS) health endpoint - #14644
feat(jans-fido2): expose FIDO Metadata Service (MDS) health endpoint#14644imran-ishaq wants to merge 5 commits into
Conversation
Add GET /jans-fido2/restv1/trust/attestation/config, a read-only view of the attestation policy the server is applying: effective mode, whether unattested authenticators are still accepted, enterprise attestation, whether the metadata service is disabled, and whether the Apple WebAuthn root CA was loaded. unattestedAuthenticatorsAllowed is derived as mode != enforced, not mode == disabled: AttestationCertificateService.isAttestationEnforced() applies the stricter MDS trust rules only for enforced, so the default monitor mode still accepts an authenticator that fails attestation. The configured mode is reported verbatim alongside a flag for whether it is recognised, since an unrecognised value silently leaves the server lenient. Mirrored through the Config API fido2 plugin for the Admin UI. Also strips trailing tab characters on two pre-existing lines of jansFido2Swagger.yaml that made the spec unparseable by strict YAML loaders. Signed-off-by: imran <imranishaq7071@gmail.com>
…do2-plugin The plugin imports io.jans.configapi.util.ApiAccessConstants and ApiConstants directly but relied on them arriving transitively through jans-config-api-server. Declare the dependency it actually uses. Signed-off-by: imran <imranishaq7071@gmail.com>
Adds a Trust Diagnostics page covering the attestation-mode endpoint, the three attestation modes, and the fact that only "enforced" rejects a failing attestation - the default "monitor" mode does not. Signed-off-by: imran <imranishaq7071@gmail.com>
Add GET /jans-fido2/restv1/trust/mds/health, reporting blob validity, loaded TOC entry count, the outcome of the last refresh, and the configured metadata servers. A stale or failed MDS load is a common cause of a previously valid authenticator being rejected, and was previously visible only in the server log. TocService now retains the last successful refresh timestamp and the last refresh error, which were caught and logged then discarded, and exposes the loaded entry count and the in-memory blob nextUpdate. The existing getNextUpdateDate() reads the document store and throws on failure, so it is not used on the request path. DOWN returns 503 so the endpoint can be wired to a monitor; UP and DISABLED return 200, since a deliberately switched-off metadata service is a configuration choice rather than an outage. MetadataServer.rootCert is reported as a presence boolean only; the certificate is never returned. Mirrored through the Config API fido2 plugin for the Admin UI. Signed-off-by: imran <imranishaq7071@gmail.com>
Extends the Trust Diagnostics page with the MDS health endpoint, the UP/DISABLED/DOWN status semantics, and the stale-metadata troubleshooting path. Signed-off-by: imran <imranishaq7071@gmail.com>
|
Important Review skippedDraft detected. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
GitHub Actions
Inactive
GitHub Actions
Inactive
mo-auto
added
area-documentation
|
|
|
|
|
|
3 participants
Prepare
Description
Target issue
closes ##14639
Part of #14602, deliverable (b). Stacked on #14643 , which adds the attestation-mode endpoint and the trust endpoint scaffolding — please merge that first. Rejection diagnostics (#) follow separately.
Implementation Details
GET /jans-fido2/restv1/trust/mds/health, mirrored in the Config API fido2plugin.
This is the only part of #14602 that needs new state.
TocServicegainslastSuccessfulRefreshandlastRefreshError, recorded at the four failure sites that previously only logged: unsetmdsCertsFolder, TOC parse failure, malformed metadata-server URL, and download/store failure. Existing throw behaviour is untouched — the recording is purely additive. Both fields arevolatile, since refreshes run on the CDI startup observer while readers arrive on request threads.parseTOCs()swallows its own failures and returns an empty map, so "success" cannot be keyed off an exception.refreshTOCEntries()clears the error first and treats the refresh as successful only if nothing recorded one.Disabled is not broken. With
disableMetadataServicetrue, both fields stay null and the endpoint reportsDISABLEDwith HTTP 200, so a deployment intentionally running without MDS does not trigger alerts.DOWNreturns 503 so the endpoint can be wired to a monitor directly. Tests pin both.blobExpireduses the same rulefetchMetadata()uses to decide a re-download is due: absent, today, or past.getLoadedTocNextUpdate()reads the in-memory value rather than the existinggetNextUpdateDate(), which hits the document store and throwsDocumentExceptionon failure — not suitable on a health request path.MetadataServer.rootCertis reported as arootCertConfiguredboolean; the certificate never leaves the server, and there is a test asserting it does not appear in the response.Test and Document the changes