Upgrade java-webauthn-server to 2.9.0 and modernize dependencies

.gitignore

@@ -0,0 +1,15 @@
+# gstack agent artifacts
+.gstack/
+
+# Maven
+target/
+
+# IDE
+.idea/
+*.iml
+.classpath
+.project
+.settings/
+
+# macOS
+.DS_Store

2_Credential_Repository/README.md

@@ -50,25 +50,29 @@ Windows 10 example of multiple credentials on a security key. The top choice is
 
 
 ### Dependency configuration
-Open the ```pom.xml``` and add the webauthn-server-core and webauthn-server-attestation dependencies. The workshop is known to work with version 1.2.0 of the java-webauthn-server.
+Open the ```pom.xml``` and add the webauthn-server-core dependency and supporting libraries. The workshop is known to work with version 2.9.0 of the java-webauthn-server.
 ```xml
 <dependency>
     <groupId>ch.qos.logback</groupId>
     <artifactId>logback-classic</artifactId>
-    <version>1.2.3</version>
+    <version>1.2.13</version>
 </dependency>
 <dependency>
     <groupId>com.yubico</groupId>
     <artifactId>webauthn-server-core</artifactId>
     <!--Check for the latest version at Maven Central-->
-    <version>1.2.0</version>
+    <version>2.9.0</version>
     <scope>compile</scope>
 </dependency>
 <dependency>
-    <groupId>com.yubico</groupId>
-    <artifactId>webauthn-server-attestation</artifactId>
-    <!--Check for the latest version at Maven Central-->
-    <version>1.2.0</version>
+    <groupId>org.bouncycastle</groupId>
+    <artifactId>bcprov-jdk15on</artifactId>
+    <version>1.70</version>
+</dependency>
+<dependency>
+    <groupId>com.google.guava</groupId>
+    <artifactId>guava</artifactId>
+    <version>32.1.3-jre</version>
     <scope>compile</scope>
 </dependency>
 ```

2_Credential_Repository/complete/pom.xml

@@ -5,7 +5,7 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-		<version>2.1.4.RELEASE</version>
+		<version>2.7.18</version>
 		<relativePath/> <!-- lookup parent from repository -->
 	</parent>
 	<groupId>com.example</groupId>
@@ -15,7 +15,8 @@
 	<description>Demo project for Spring Boot</description>
 
 	<properties>
-		<java.version>1.8</java.version>
+		<java.version>17</java.version>
+		<maven.compiler.release>17</maven.compiler.release>
 	</properties>
 
 	<dependencies>
@@ -35,6 +36,7 @@
 		<dependency>
 			<groupId>org.projectlombok</groupId>
 			<artifactId>lombok</artifactId>
+			<version>1.18.46</version>
 			<optional>true</optional>
 		</dependency>
 		<dependency>
@@ -55,26 +57,44 @@
 		<dependency>
 			<groupId>ch.qos.logback</groupId>
 			<artifactId>logback-classic</artifactId>
-			<version>1.2.3</version>
+			<version>1.2.13</version>
 		</dependency>
 		<dependency>
 			<groupId>com.yubico</groupId>
 			<artifactId>webauthn-server-core</artifactId>
 			<!--Check for the latest version at Maven Central-->
-			<version>1.2.0</version>
+			<version>2.9.0</version>
 			<scope>compile</scope>
 		</dependency>
+		<!-- BouncyCastle for EdDSA support on Java 8 -->
 		<dependency>
-			<groupId>com.yubico</groupId>
-			<artifactId>webauthn-server-attestation</artifactId>
-			<!--Check for the latest version at Maven Central-->
-			<version>1.2.0</version>
-			<scope>compile</scope>
+			<groupId>org.bouncycastle</groupId>
+			<artifactId>bcprov-jdk15on</artifactId>
+			<version>1.70</version>
+		</dependency>
+		<!-- Guava for caching -->
+		<dependency>
+			<groupId>com.google.guava</groupId>
+			<artifactId>guava</artifactId>
+			<version>32.1.3-jre</version>
 		</dependency>
 	</dependencies>
 
 	<build>
 		<plugins>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-compiler-plugin</artifactId>
+				<configuration>
+					<annotationProcessorPaths>
+						<path>
+							<groupId>org.projectlombok</groupId>
+							<artifactId>lombok</artifactId>
+							<version>1.18.46</version>
+						</path>
+					</annotationProcessorPaths>
+				</configuration>
+			</plugin>
 			<plugin>
 				<groupId>org.springframework.boot</groupId>
 				<artifactId>spring-boot-maven-plugin</artifactId>
@@ -83,7 +103,7 @@
 				<groupId>com.microsoft.azure</groupId>
 				<artifactId>azure-webapp-maven-plugin</artifactId>
 				<!--Check for the latest version at Maven Central-->
-				<version>1.6.0</version>
+				<version>2.13.0</version>
 				<configuration>
 					<deploymentType>jar</deploymentType>
 
@@ -120,7 +140,7 @@
 					<region>${REGION}</region> <!--e.g. centralus -->
 
 					<!-- Java Runtime Stack for Web App on Linux-->
-					<linuxRuntime>jre8</linuxRuntime>
+					<linuxRuntime>java17-java17</linuxRuntime>
 				</configuration>
 			</plugin>
 			<plugin>

2_Credential_Repository/complete/src/main/java/com/example/demo/Config.java

@@ -24,7 +24,6 @@
 
 package com.example.demo;
 
-import com.yubico.internal.util.CollectionUtil;
 import com.yubico.webauthn.data.RelyingPartyIdentity;
 import com.yubico.webauthn.extension.appid.AppId;
 import com.yubico.webauthn.extension.appid.InvalidAppIdException;
@@ -53,7 +52,7 @@ public class Config {
     private final Optional<AppId> appId;
 
     private Config(Set<String> origins, int port, RelyingPartyIdentity rpIdentity, Optional<AppId> appId) {
-        this.origins = CollectionUtil.immutableSet(origins);
+        this.origins = Collections.unmodifiableSet(new HashSet<>(origins));
         this.port = port;
         this.rpIdentity = rpIdentity;
         this.appId = appId;
@@ -140,15 +139,9 @@ private static RelyingPartyIdentity computeRpIdentity() throws MalformedURLExcep
             resultBuilder.id(id);
         }
 
-        if (icon == null) {
-            logger.debug("RP icon not given - using none.");
-        } else {
-            try {
-            resultBuilder.icon(Optional.of(new URL(icon)));
-            } catch (MalformedURLException e) {
-                logger.error("Invalid icon URL: {}", icon, e);
-                throw e;
-            }
+        // Icon field removed in WebAuthn Level 2 (java-webauthn-server 2.x)
+        if (icon != null) {
+            logger.warn("RP icon specified but ignored - icon field removed in WebAuthn Level 2. Value was: {}", icon);
         }
 
         final RelyingPartyIdentity result = resultBuilder.build();

2_Credential_Repository/complete/src/main/java/com/example/demo/InMemoryRegistrationStorage.java

@@ -26,14 +26,14 @@
 
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
-import com.yubico.internal.util.CollectionUtil;
 import com.yubico.webauthn.AssertionResult;
 import com.yubico.webauthn.CredentialRepository;
 import com.yubico.webauthn.RegisteredCredential;
 import com.yubico.webauthn.data.ByteArray;
 import com.yubico.webauthn.data.PublicKeyCredentialDescriptor;
 import com.example.demo.data.CredentialRegistration;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.NoSuchElementException;
 import java.util.Optional;
@@ -171,7 +171,7 @@ public Optional<RegisteredCredential> lookup(ByteArray credentialId, ByteArray u
 
     @Override
     public Set<RegisteredCredential> lookupAll(ByteArray credentialId) {
-        return CollectionUtil.immutableSet(
+        return Collections.unmodifiableSet(
             storage.asMap().values().stream()
                 .flatMap(Collection::stream)
                 .filter(reg -> reg.getCredential().getCredentialId().equals(credentialId))