Examples with DeviceRegistration org.xdi.oxauth.model.fido.u2f.DeviceRegistration used on opensource projects

Example 6 with DeviceRegistration

use of org.xdi.oxauth.model.fido.u2f.DeviceRegistration in project oxAuth by GluuFederation.

the class DeviceRegistrationService method attachUserDeviceRegistration.

public boolean attachUserDeviceRegistration(String userInum, String oneStepDeviceId) {
    String oneStepDeviceDn = getDnForOneStepU2fDevice(oneStepDeviceId);
    // Load temporary stored device registration
    DeviceRegistration deviceRegistration = ldapEntryManager.find(DeviceRegistration.class, oneStepDeviceDn);
    if (deviceRegistration == null) {
        return false;
    }
    // Remove temporary stored device registration
    removeUserDeviceRegistration(deviceRegistration);
    // Attach user device registration to user
    String deviceDn = getDnForU2fDevice(userInum, deviceRegistration.getId());
    deviceRegistration.setDn(deviceDn);
    addUserDeviceRegistration(userInum, deviceRegistration);
    return true;
}

Example 7 with DeviceRegistration

use of org.xdi.oxauth.model.fido.u2f.DeviceRegistration in project oxAuth by GluuFederation.

the class RegistrationService method finishRegistration.

public DeviceRegistrationResult finishRegistration(RegisterRequestMessage requestMessage, RegisterResponse response, String userInum, Set<String> facets) throws BadInputException {
    RegisterRequest request = requestMessage.getRegisterRequest();
    String appId = request.getAppId();
    ClientData clientData = response.getClientData();
    clientDataValidationService.checkContent(clientData, RawRegistrationService.SUPPORTED_REGISTER_TYPES, request.getChallenge(), facets);
    RawRegisterResponse rawRegisterResponse = rawRegistrationService.parseRawRegisterResponse(response.getRegistrationData());
    rawRegistrationService.checkSignature(appId, clientData, rawRegisterResponse);
    Date now = new GregorianCalendar(TimeZone.getTimeZone("UTC")).getTime();
    DeviceRegistration deviceRegistration = rawRegistrationService.createDevice(rawRegisterResponse);
    deviceRegistration.setStatus(DeviceRegistrationStatus.ACTIVE);
    deviceRegistration.setApplication(appId);
    deviceRegistration.setCreationDate(now);
    int keyHandleHashCode = deviceRegistrationService.getKeyHandleHashCode(rawRegisterResponse.getKeyHandle());
    deviceRegistration.setKeyHandleHashCode(keyHandleHashCode);
    final String deviceRegistrationId = String.valueOf(System.currentTimeMillis());
    deviceRegistration.setId(deviceRegistrationId);
    String responseDeviceData = response.getDeviceData();
    if (StringHelper.isNotEmpty(responseDeviceData)) {
        try {
            String responseDeviceDataDecoded = new String(Base64Util.base64urldecode(responseDeviceData));
            DeviceData deviceData = ServerUtil.jsonMapperWithWrapRoot().readValue(responseDeviceDataDecoded, DeviceData.class);
            deviceRegistration.setDeviceData(deviceData);
        } catch (Exception ex) {
            throw new BadInputException(String.format("Device data is invalid: %s", responseDeviceData), ex);
        }
    }
    boolean approved = StringHelper.equals(RawRegistrationService.REGISTER_FINISH_TYPE, response.getClientData().getTyp());
    if (!approved) {
        log.debug("Registratio request with keyHandle '{}' was canceled", rawRegisterResponse.getKeyHandle());
        return new DeviceRegistrationResult(deviceRegistration, DeviceRegistrationResult.Status.CANCELED);
    }
    boolean twoStep = StringHelper.isNotEmpty(userInum);
    if (twoStep) {
        deviceRegistration.setDn(deviceRegistrationService.getDnForU2fDevice(userInum, deviceRegistrationId));
        // Check if there is device registration with keyHandle in LDAP already
        List<DeviceRegistration> foundDeviceRegistrations = deviceRegistrationService.findDeviceRegistrationsByKeyHandle(appId, deviceRegistration.getKeyHandle(), "oxId");
        if (foundDeviceRegistrations.size() != 0) {
            throw new BadInputException(String.format("KeyHandle %s was compromised", deviceRegistration.getKeyHandle()));
        }
        deviceRegistrationService.addUserDeviceRegistration(userInum, deviceRegistration);
    } else {
        deviceRegistration.setDn(deviceRegistrationService.getDnForOneStepU2fDevice(deviceRegistrationId));
        deviceRegistrationService.addOneStepDeviceRegistration(deviceRegistration);
    }
    return new DeviceRegistrationResult(deviceRegistration, DeviceRegistrationResult.Status.APPROVED);
}

Example 8 with DeviceRegistration

use of org.xdi.oxauth.model.fido.u2f.DeviceRegistration in project oxAuth by GluuFederation.

the class CleanerTimer method processU2fDeviceRegistrations.

private void processU2fDeviceRegistrations() {
    log.debug("Start U2F request clean up");
    Calendar calendar = new GregorianCalendar(TimeZone.getTimeZone("UTC"));
    calendar.add(Calendar.SECOND, -90);
    final Date expirationDate = calendar.getTime();
    BatchOperation<DeviceRegistration> deviceRegistrationBatchService = new BatchOperation<DeviceRegistration>(ldapEntryManager) {

        @Override
        protected List<DeviceRegistration> getChunkOrNull(int chunkSize) {
            return deviceRegistrationService.getExpiredDeviceRegistrations(this, expirationDate);
        }

        @Override
        protected void performAction(List<DeviceRegistration> entries) {
            for (DeviceRegistration deviceRegistration : entries) {
                try {
                    log.debug("Removing DeviceRegistration: {}, Creation date: {}", deviceRegistration.getId(), deviceRegistration.getCreationDate());
                    deviceRegistrationService.removeUserDeviceRegistration(deviceRegistration);
                } catch (Exception e) {
                    log.error("Failed to remove entry", e);
                }
            }
        }
    };
    deviceRegistrationBatchService.iterateAllByChunks(BATCH_SIZE);
    log.debug("End U2F request clean up");
}

Example 9 with DeviceRegistration

use of org.xdi.oxauth.model.fido.u2f.DeviceRegistration in project oxAuth by GluuFederation.

the class RegistrationService method builRegisterRequestMessage.

public RegisterRequestMessage builRegisterRequestMessage(String appId, String userInum) {
    if (applicationService.isValidateApplication()) {
        applicationService.checkIsValid(appId);
    }
    List<AuthenticateRequest> authenticateRequests = new ArrayList<AuthenticateRequest>();
    List<RegisterRequest> registerRequests = new ArrayList<RegisterRequest>();
    boolean twoStep = StringHelper.isNotEmpty(userInum);
    if (twoStep) {
        // In two steps we expects not empty userInum
        List<DeviceRegistration> deviceRegistrations = deviceRegistrationService.findUserDeviceRegistrations(userInum, appId);
        for (DeviceRegistration deviceRegistration : deviceRegistrations) {
            if (!deviceRegistration.isCompromised()) {
                try {
                    AuthenticateRequest authenticateRequest = u2fAuthenticationService.startAuthentication(appId, deviceRegistration);
                    authenticateRequests.add(authenticateRequest);
                } catch (DeviceCompromisedException ex) {
                    log.error("Faield to authenticate device", ex);
                }
            }
        }
    }
    RegisterRequest request = startRegistration(appId);
    registerRequests.add(request);
    return new RegisterRequestMessage(authenticateRequests, registerRequests);
}

Example 10 with DeviceRegistration

use of org.xdi.oxauth.model.fido.u2f.DeviceRegistration in project oxAuth by GluuFederation.

the class DeviceRegistrationService method getExpiredDeviceRegistrations.

public List<DeviceRegistration> getExpiredDeviceRegistrations(BatchOperation<DeviceRegistration> batchOperation, Date expirationDate) {
    final String u2fBaseDn = getDnForOneStepU2fDevice(null);
    Filter expirationFilter = Filter.createLessOrEqualFilter("creationDate", ldapEntryManager.encodeGeneralizedTime(expirationDate));
    List<DeviceRegistration> deviceRegistrations = ldapEntryManager.findEntries(u2fBaseDn, DeviceRegistration.class, expirationFilter, SearchScope.SUB, null, batchOperation, 0, CleanerTimer.BATCH_SIZE, CleanerTimer.BATCH_SIZE);
    return deviceRegistrations;
}