Examples with MDSException com.webauthn4j.metadata.exception.MDSException used on opensource projects

Example 1 with MDSException

use of com.webauthn4j.metadata.exception.MDSException in project webauthn4j by webauthn4j.

the class FidoMdsMetadataItemsProvider method fetchMetadataStatement.

MetadataStatement fetchMetadataStatement(String uri, byte[] expectedHash) {
    String uriWithToken = appendToken(uri, token);
    String metadataStatementBase64url = httpClient.fetch(uriWithToken);
    String metadataStatementStr = new String(Base64UrlUtil.decode(metadataStatementBase64url));
    byte[] hash = MessageDigestUtil.createSHA256().digest(metadataStatementBase64url.getBytes(StandardCharsets.UTF_8));
    // As hash is known data to statement provider, there is no risk of timing attack and it is OK to use `Arrays.equals` instead of `MessageDigest.isEqual` here.
    if (!Arrays.equals(hash, expectedHash)) {
        throw new MDSException("Hash of metadataStatement doesn't match");
    }
    MetadataStatement metadataStatement = jsonConverter.readValue(metadataStatementStr, MetadataStatement.class);
    metadataStatementValidator.validate(metadataStatement);
    return metadataStatement;
}

Example 2 with MDSException

use of com.webauthn4j.metadata.exception.MDSException in project webauthn4j by webauthn4j.

the class FidoMDS3MetadataBLOBProvider method validateCertPath.

private void validateCertPath(@NonNull MetadataBLOB metadataBLOB) {
    CertPath certPath = metadataBLOB.getHeader().getX5c();
    CertPathValidator certPathValidator = CertificateUtil.createCertPathValidator();
    PKIXParameters certPathParameters = CertificateUtil.createPKIXParameters(trustAnchors);
    certPathParameters.setRevocationEnabled(revocationCheckEnabled);
    if (revocationCheckEnabled) {
        PKIXRevocationChecker pkixRevocationChecker = (PKIXRevocationChecker) certPathValidator.getRevocationChecker();
        pkixRevocationChecker.setOptions(EnumSet.of(PKIXRevocationChecker.Option.PREFER_CRLS));
        certPathParameters.addCertPathChecker(pkixRevocationChecker);
    }
    try {
        certPathValidator.validate(certPath, certPathParameters);
    } catch (InvalidAlgorithmParameterException e) {
        throw new MDSException("invalid algorithm parameter", e);
    } catch (CertPathValidatorException e) {
        throw new MDSException("invalid cert path", e);
    }
}

Example 3 with MDSException

use of com.webauthn4j.metadata.exception.MDSException in project webauthn4j by webauthn4j.

the class FidoMDS3MetadataBLOBProvider method doProvide.

@Override
@NonNull
protected MetadataBLOB doProvide() {
    String responseBody = httpClient.fetch(blobEndpoint);
    MetadataBLOB metadataBLOB = metadataBLOBFactory.parse(responseBody);
    if (!metadataBLOB.isValidSignature()) {
        throw new MDSException("MetadataBLOB signature is invalid");
    }
    validateCertPath(metadataBLOB);
    return metadataBLOB;
}

Example 4 with MDSException

use of com.webauthn4j.metadata.exception.MDSException in project webauthn4j by webauthn4j.

the class FidoMdsMetadataItemsProvider method validateCertPath.

private void validateCertPath(JWS<MetadataTOCPayload> jws) {
    Set<TrustAnchor> trustAnchors = Collections.singleton(trustAnchor);
    CertPath certPath = jws.getHeader().getX5c();
    CertPathValidator certPathValidator = CertificateUtil.createCertPathValidator();
    PKIXParameters certPathParameters = CertificateUtil.createPKIXParameters(trustAnchors);
    PKIXRevocationChecker pkixRevocationChecker = (PKIXRevocationChecker) certPathValidator.getRevocationChecker();
    pkixRevocationChecker.setOptions(EnumSet.of(PKIXRevocationChecker.Option.PREFER_CRLS));
    certPathParameters.addCertPathChecker(pkixRevocationChecker);
    try {
        certPathValidator.validate(certPath, certPathParameters);
    } catch (InvalidAlgorithmParameterException e) {
        throw new MDSException("invalid algorithm parameter", e);
    } catch (CertPathValidatorException e) {
        throw new MDSException("invalid cert path", e);
    }
}

Example 5 with MDSException

use of com.webauthn4j.metadata.exception.MDSException in project webauthn4j by webauthn4j.

the class SimpleHttpClient method fetch.

@Override
@NonNull
public String fetch(@NonNull String url) {
    try {
        URL fetchUrl = new URL(url);
        HttpURLConnection urlConnection = (HttpURLConnection) fetchUrl.openConnection();
        urlConnection.setRequestMethod("GET");
        urlConnection.connect();
        int status = urlConnection.getResponseCode();
        if (status == HttpURLConnection.HTTP_OK) {
            InputStream inputStream = urlConnection.getInputStream();
            BufferedInputStream bis = new BufferedInputStream(inputStream);
            ByteArrayOutputStream buf = new ByteArrayOutputStream();
            int result = bis.read();
            while (result != -1) {
                buf.write((byte) result);
                result = bis.read();
            }
            bis.close();
            return buf.toString("UTF-8");
        }
        throw new MDSException("failed to fetch " + url);
    } catch (IOException e) {
        throw new MDSException("failed to fetch " + url, e);
    }
}