Merge pull request #4 from elukewalker/scion/java-webauthn-v2

v0.0.2.0 fix: code review fixes and dependency cleanup for java-webauthn-server 2.x migration

Author: elukewalker

2_Credential_Repository/README.md

@@ -50,7 +50,7 @@ Windows 10 example of multiple credentials on a security key. The top choice is
 
 
 ### Dependency configuration
-Open the ```pom.xml``` and add the webauthn-server-core and webauthn-server-attestation dependencies. The workshop is known to work with version 2.9.0 of the java-webauthn-server.
+Open the ```pom.xml``` and add the webauthn-server-core dependency and supporting libraries. The workshop is known to work with version 2.9.0 of the java-webauthn-server.
 ```xml
 <dependency>
     <groupId>ch.qos.logback</groupId>
@@ -64,13 +64,6 @@ Open the ```pom.xml``` and add the webauthn-server-core and webauthn-server-atte
     <version>2.9.0</version>
     <scope>compile</scope>
 </dependency>
-<dependency>
-    <groupId>com.yubico</groupId>
-    <artifactId>webauthn-server-attestation</artifactId>
-    <!--Check for the latest version at Maven Central-->
-    <version>2.9.0</version>
-    <scope>compile</scope>
-</dependency>
 <dependency>
     <groupId>org.bouncycastle</groupId>
     <artifactId>bcprov-jdk15on</artifactId>

2_Credential_Repository/complete/pom.xml

@@ -15,7 +15,7 @@
 	<description>Demo project for Spring Boot</description>
 
 	<properties>
-		<java.version>1.8</java.version>
+		<java.version>17</java.version>
 		<maven.compiler.release>17</maven.compiler.release>
 	</properties>
 
@@ -66,13 +66,6 @@
 			<version>2.9.0</version>
 			<scope>compile</scope>
 		</dependency>
-		<dependency>
-			<groupId>com.yubico</groupId>
-			<artifactId>webauthn-server-attestation</artifactId>
-			<!--Check for the latest version at Maven Central-->
-			<version>2.9.0</version>
-			<scope>compile</scope>
-		</dependency>
 		<!-- BouncyCastle for EdDSA support on Java 8 -->
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
@@ -83,7 +76,7 @@
 		<dependency>
 			<groupId>com.google.guava</groupId>
 			<artifactId>guava</artifactId>
-			<version>31.1-jre</version>
+			<version>32.1.3-jre</version>
 		</dependency>
 	</dependencies>
 
@@ -147,7 +140,7 @@
 					<region>${REGION}</region> <!--e.g. centralus -->
 
 					<!-- Java Runtime Stack for Web App on Linux-->
-					<linuxRuntime>jre8</linuxRuntime>
+					<linuxRuntime>java17-java17</linuxRuntime>
 				</configuration>
 			</plugin>
 			<plugin>

2_Credential_Repository/complete/src/main/java/com/example/demo/WebAuthnServer.java

@@ -24,8 +24,16 @@
 
 package com.example.demo;
 
+import com.example.demo.data.AssertionRequestWrapper;
+import com.example.demo.data.AssertionResponse;
+import com.example.demo.data.CredentialRegistration;
+import com.example.demo.data.RegistrationRequest;
+import com.example.demo.data.RegistrationResponse;
+import com.example.demo.data.U2fRegistrationResponse;
+import com.example.demo.data.U2fRegistrationResult;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.datatype.jdk8.Jdk8Module;
 import com.google.common.cache.Cache;
 import com.google.common.cache.CacheBuilder;
 import com.yubico.util.Either;
@@ -38,8 +46,6 @@
 import com.yubico.webauthn.StartAssertionOptions;
 import com.yubico.webauthn.StartRegistrationOptions;
 import com.yubico.webauthn.U2fVerifier;
-// Attestation framework overhauled in v2.x - old imports removed
-// RelyingParty now handles attestation validation internally
 import com.yubico.webauthn.data.AttestationConveyancePreference;
 import com.yubico.webauthn.data.AuthenticatorSelectionCriteria;
 import com.yubico.webauthn.data.ByteArray;
@@ -51,17 +57,9 @@
 import com.yubico.webauthn.exception.RegistrationFailedException;
 import com.yubico.webauthn.extension.appid.AppId;
 import com.yubico.webauthn.extension.appid.InvalidAppIdException;
-import com.example.demo.data.AssertionRequestWrapper;
-import com.example.demo.data.AssertionResponse;
-import com.example.demo.data.CredentialRegistration;
-import com.example.demo.data.RegistrationRequest;
-import com.example.demo.data.RegistrationResponse;
-import com.example.demo.data.U2fRegistrationResponse;
-import com.example.demo.data.U2fRegistrationResult;
+import java.io.ByteArrayInputStream;
 import java.io.IOException;
-import java.io.InputStream;
 import java.security.SecureRandom;
-import java.security.cert.CertificateEncodingException;
 import java.security.cert.CertificateException;
 import java.security.cert.CertificateFactory;
 import java.security.cert.X509Certificate;
@@ -93,12 +91,8 @@ public class WebAuthnServer {
     private final RegistrationStorage userStorage;
     private final Cache<AssertionRequestWrapper, AuthenticatedAction> authenticatedActions = newCache();
 
-    // Attestation framework overhauled in v2.x
-    // Old MetadataService and TrustResolver setup removed
-    // RelyingParty now handles attestation validation internally via AttestationTrustSource
-
     private final Clock clock = Clock.systemDefaultZone();
-    private final ObjectMapper jsonMapper = new ObjectMapper();
+    private final ObjectMapper jsonMapper;
 
     private final RelyingParty rp;
 
@@ -111,14 +105,14 @@ public WebAuthnServer(RegistrationStorage userStorage, Cache<ByteArray, Registra
         this.registerRequestStorage = registerRequestStorage;
         this.assertRequestStorage = assertRequestStorage;
 
+        this.jsonMapper = new ObjectMapper();
+        this.jsonMapper.registerModule(new Jdk8Module());
+
         rp = RelyingParty.builder()
             .identity(rpIdentity)
             .credentialRepository(this.userStorage)
             .origins(origins)
             .attestationConveyancePreference(Optional.of(AttestationConveyancePreference.DIRECT))
-            // metadataService replaced with attestationTrustSource in v2.x
-            // For workshop purposes, using default (no custom trust roots)
-            // allowUnrequestedExtensions removed in v2.x - now always enabled
             .allowUntrustedAttestation(true)
             .validateSignatureCounter(true)
             .appId(appId)
@@ -131,10 +125,6 @@ private static ByteArray generateRandom(int length) {
         return new ByteArray(bytes);
     }
 
-    // Attestation metadata methods removed in v2.x migration
-    // Custom attestation trust sources can be configured via RelyingParty.builder().attestationTrustSource()
-    // For workshop purposes, using default trust configuration
-
     private static <K, V> Cache<K, V> newCache() {
         return CacheBuilder.newBuilder()
             .maximumSize(100)
@@ -268,7 +258,7 @@ public AttestationCertInfo(ByteArray certDer) {
             X509Certificate cert = null;
             try {
                 CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
-                cert = (X509Certificate) certFactory.generateCertificate(new java.io.ByteArrayInputStream(certDer.getBytes()));
+                cert = (X509Certificate) certFactory.generateCertificate(new ByteArrayInputStream(certDer.getBytes()));
             } catch (CertificateException e) {
                 logger.error("Failed to parse attestation certificate");
             }

2_Credential_Repository/complete/src/main/java/com/example/demo/data/CredentialRegistration.java

@@ -27,7 +27,6 @@
 import com.fasterxml.jackson.annotation.JsonIgnore;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.yubico.webauthn.RegisteredCredential;
-// Attestation import removed in v2.x - attestation validation now internal to RelyingParty
 import com.yubico.webauthn.data.UserIdentity;
 import java.time.Instant;
 import java.util.Optional;
@@ -49,9 +48,6 @@ public class CredentialRegistration {
     Instant registrationTime;
     RegisteredCredential credential;
 
-    // attestationMetadata field removed in v2.x migration
-    // Attestation trust status available via RegistrationResult.isAttestationTrusted()
-
     @JsonProperty("registrationTime")
     public String getRegistrationTimestamp() {
         return registrationTime.toString();

2_Credential_Repository/complete/src/main/java/com/example/demo/data/U2fRegistrationResult.java

@@ -1,6 +1,5 @@
 package com.example.demo.data;
 
-// Attestation import removed in v2.x - attestation validation now internal to RelyingParty
 import com.yubico.webauthn.data.ByteArray;
 import com.yubico.webauthn.data.PublicKeyCredentialDescriptor;
 import lombok.Builder;
@@ -19,6 +18,4 @@ public class U2fRegistrationResult {
     @NonNull
     ByteArray publicKeyCose;
 
-    // warnings field removed in v2.x - warnings now logged via SLF4J
-    // attestationMetadata field removed in v2.x migration
 }

2_Credential_Repository/complete/src/main/java/com/yubico/webauthn/U2fVerifier.java

@@ -24,16 +24,17 @@
 
 package com.yubico.webauthn;
 
+import com.example.demo.data.RegistrationRequest;
+import com.example.demo.data.U2fRegistrationResponse;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.yubico.webauthn.data.ByteArray;
 import com.yubico.webauthn.data.exception.Base64UrlException;
 import com.yubico.webauthn.extension.appid.AppId;
-import com.example.demo.data.RegistrationRequest;
-import com.example.demo.data.U2fRegistrationResponse;
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.security.NoSuchAlgorithmException;
 import java.security.cert.CertificateException;
@@ -47,7 +48,7 @@ public class U2fVerifier {
     private static ByteArray sha256(String data) {
         try {
             MessageDigest digest = MessageDigest.getInstance("SHA-256");
-            return new ByteArray(digest.digest(data.getBytes(java.nio.charset.StandardCharsets.UTF_8)));
+            return new ByteArray(digest.digest(data.getBytes(StandardCharsets.UTF_8)));
         } catch (NoSuchAlgorithmException e) {
             throw new RuntimeException("SHA-256 algorithm not available", e);
         }

3_Registration/complete/pom.xml

@@ -15,7 +15,7 @@
 	<description>Demo project for Spring Boot</description>
 
 	<properties>
-		<java.version>1.8</java.version>
+		<java.version>17</java.version>
 		<maven.compiler.release>17</maven.compiler.release>
 	</properties>
 
@@ -61,13 +61,6 @@
 			<version>2.9.0</version>
 			<scope>compile</scope>
 		</dependency>
-		<dependency>
-			<groupId>com.yubico</groupId>
-			<artifactId>webauthn-server-attestation</artifactId>
-			<!--Check for the latest version at Maven Central-->
-			<version>2.9.0</version>
-			<scope>compile</scope>
-		</dependency>
 		<!-- BouncyCastle for EdDSA support on Java 8 -->
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
@@ -78,7 +71,7 @@
 		<dependency>
 			<groupId>com.google.guava</groupId>
 			<artifactId>guava</artifactId>
-			<version>31.1-jre</version>
+			<version>32.1.3-jre</version>
 		</dependency>
 	</dependencies>
 
@@ -142,7 +135,7 @@
 					<region>${REGION}</region> <!--e.g. centralus -->
 
 					<!-- Java Runtime Stack for Web App on Linux-->
-					<linuxRuntime>jre8</linuxRuntime>
+					<linuxRuntime>java17-java17</linuxRuntime>
 				</configuration>
 			</plugin>
 			<plugin>

3_Registration/complete/src/main/java/com/example/demo/WebAuthnServer.java

@@ -59,6 +59,7 @@
 import com.example.demo.data.U2fRegistrationResponse;
 import com.example.demo.data.U2fRegistrationResult;
 import java.io.IOException;
+import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.security.SecureRandom;
 import java.security.cert.CertificateEncodingException;
@@ -108,7 +109,7 @@ public class WebAuthnServer {
     // RelyingParty now handles attestation validation internally via AttestationTrustSource
 
     private final Clock clock = Clock.systemDefaultZone();
-    private final ObjectMapper jsonMapper = new ObjectMapper();
+    private final ObjectMapper jsonMapper;
 
     private final RelyingParty rp;
 
@@ -121,6 +122,9 @@ public WebAuthnServer(RegistrationStorage userStorage, Cache<ByteArray, Registra
         this.registerRequestStorage = registerRequestStorage;
         this.assertRequestStorage = assertRequestStorage;
 
+        this.jsonMapper = new ObjectMapper();
+        this.jsonMapper.registerModule(new Jdk8Module());
+
         rp = RelyingParty.builder()
             .identity(rpIdentity)
             .credentialRepository(this.userStorage)

4_Authentication/complete/pom.xml

@@ -15,7 +15,7 @@
 	<description>Demo project for Spring Boot</description>
 
 	<properties>
-		<java.version>1.8</java.version>
+		<java.version>17</java.version>
 		<maven.compiler.release>17</maven.compiler.release>
 	</properties>
 
@@ -66,13 +66,6 @@
 			<version>2.9.0</version>
 			<scope>compile</scope>
 		</dependency>
-		<dependency>
-			<groupId>com.yubico</groupId>
-			<artifactId>webauthn-server-attestation</artifactId>
-			<!--Check for the latest version at Maven Central-->
-			<version>2.9.0</version>
-			<scope>compile</scope>
-		</dependency>
 		<!-- BouncyCastle for EdDSA support on Java 8 -->
 		<dependency>
 			<groupId>org.bouncycastle</groupId>
@@ -83,7 +76,7 @@
 		<dependency>
 			<groupId>com.google.guava</groupId>
 			<artifactId>guava</artifactId>
-			<version>31.1-jre</version>
+			<version>32.1.3-jre</version>
 		</dependency>
 	</dependencies>
 
@@ -147,7 +140,7 @@
 					<region>${REGION}</region> <!--e.g. centralus -->
 
 					<!-- Java Runtime Stack for Web App on Linux-->
-					<linuxRuntime>jre8</linuxRuntime>
+					<linuxRuntime>java17-java17</linuxRuntime>
 				</configuration>
 			</plugin>
 			<plugin>

4_Authentication/complete/src/main/java/com/example/demo/WebAuthnServer.java

@@ -59,6 +59,7 @@
 import com.example.demo.data.U2fRegistrationResponse;
 import com.example.demo.data.U2fRegistrationResult;
 import java.io.IOException;
+import java.io.ByteArrayInputStream;
 import java.io.InputStream;
 import java.security.SecureRandom;
 import java.security.cert.CertificateEncodingException;
@@ -108,7 +109,7 @@ public class WebAuthnServer {
     // RelyingParty now handles attestation validation internally via AttestationTrustSource
 
     private final Clock clock = Clock.systemDefaultZone();
-    private final ObjectMapper jsonMapper = new ObjectMapper();
+    private final ObjectMapper jsonMapper;
 
     private final RelyingParty rp;
 
@@ -121,6 +122,9 @@ public WebAuthnServer(RegistrationStorage userStorage, Cache<ByteArray, Registra
         this.registerRequestStorage = registerRequestStorage;
         this.assertRequestStorage = assertRequestStorage;
 
+        this.jsonMapper = new ObjectMapper();
+        this.jsonMapper.registerModule(new Jdk8Module());
+
         rp = RelyingParty.builder()
             .identity(rpIdentity)
             .credentialRepository(this.userStorage)