@Test void test() { RegistrationObject registrationObject = TestDataUtil.createRegistrationObjectWithPackedAttestation(); target.validate(registrationObject); }
@Override public void validate(RegistrationObject registrationObject) { AAGUID aaguid = registrationObject.getAttestationObject().getAuthenticatorData().getAttestedCredentialData().getAaguid(); AttestationStatement attestationStatement = registrationObject.getAttestationObject().getAttestationStatement(); Set<MetadataItem> metadataItems = metadataItemsResolver.resolve(aaguid); List<AttestationType> attestationTypes = metadataItems.stream() .flatMap(item -> item.getMetadataStatement().getAttestationTypes().stream()).collect(Collectors.toList()); boolean isSurrogate = !attestationTypes.isEmpty() && attestationTypes.stream().allMatch(type -> type.equals(AttestationType.BASIC_SURROGATE)); if (isSurrogate && attestationStatement instanceof CertificateBaseAttestationStatement) { CertificateBaseAttestationStatement certificateBaseAttestationStatement = (CertificateBaseAttestationStatement) attestationStatement; if (certificateBaseAttestationStatement.getX5c() != null) { throw new BadAttestationStatementException("Although AAGUID is registered for surrogate attestation in metadata, x5c contains certificates."); } } for (MetadataItem metadataItem : metadataItems) { doAdditionalValidationForFidoMdsMetadataItem(metadataItem); } }
FidoMdsMetadataValidator implements CustomRegistrationValidator { @Override public void validate(RegistrationObject registrationObject) { AAGUID aaguid = registrationObject.getAttestationObject().getAuthenticatorData().getAttestedCredentialData().getAaguid(); AttestationStatement attestationStatement = registrationObject.getAttestationObject().getAttestationStatement(); Set<MetadataItem> metadataItems = metadataItemsResolver.resolve(aaguid); List<AttestationType> attestationTypes = metadataItems.stream() .flatMap(item -> item.getMetadataStatement().getAttestationTypes().stream()).collect(Collectors.toList()); boolean isSurrogate = !attestationTypes.isEmpty() && attestationTypes.stream().allMatch(type -> type.equals(AttestationType.BASIC_SURROGATE)); if (isSurrogate && attestationStatement instanceof CertificateBaseAttestationStatement) { CertificateBaseAttestationStatement certificateBaseAttestationStatement = (CertificateBaseAttestationStatement) attestationStatement; if (certificateBaseAttestationStatement.getX5c() != null) { throw new BadAttestationStatementException("Although AAGUID is registered for surrogate attestation in metadata, x5c contains certificates."); } } for (MetadataItem metadataItem : metadataItems) { doAdditionalValidationForFidoMdsMetadataItem(metadataItem); } } }
FidoMdsMetadataValidator implements CustomRegistrationValidator { @Override public void validate(RegistrationObject registrationObject) { AAGUID aaguid = registrationObject.getAttestationObject().getAuthenticatorData().getAttestedCredentialData().getAaguid(); AttestationStatement attestationStatement = registrationObject.getAttestationObject().getAttestationStatement(); Set<MetadataItem> metadataItems = metadataItemsResolver.resolve(aaguid); List<AttestationType> attestationTypes = metadataItems.stream() .flatMap(item -> item.getMetadataStatement().getAttestationTypes().stream()).collect(Collectors.toList()); boolean isSurrogate = !attestationTypes.isEmpty() && attestationTypes.stream().allMatch(type -> type.equals(AttestationType.BASIC_SURROGATE)); if (isSurrogate && attestationStatement instanceof CertificateBaseAttestationStatement) { CertificateBaseAttestationStatement certificateBaseAttestationStatement = (CertificateBaseAttestationStatement) attestationStatement; if (certificateBaseAttestationStatement.getX5c() != null) { throw new BadAttestationStatementException("Although AAGUID is registered for surrogate attestation in metadata, x5c contains certificates."); } } for (MetadataItem metadataItem : metadataItems) { doAdditionalValidationForFidoMdsMetadataItem(metadataItem); } } FidoMdsMetadataValidator(MetadataItemsResolver metadataItemsResolver);  FidoMdsMetadataValidator(ObjectConverter objectConverter, String fidoMetadataServiceEndpoint);  FidoMdsMetadataValidator(String fidoMetadataServiceEndpoint); }
FidoMdsMetadataValidator implements CustomRegistrationValidator { @Override public void validate(RegistrationObject registrationObject) { AAGUID aaguid = registrationObject.getAttestationObject().getAuthenticatorData().getAttestedCredentialData().getAaguid(); AttestationStatement attestationStatement = registrationObject.getAttestationObject().getAttestationStatement(); Set<MetadataItem> metadataItems = metadataItemsResolver.resolve(aaguid); List<AttestationType> attestationTypes = metadataItems.stream() .flatMap(item -> item.getMetadataStatement().getAttestationTypes().stream()).collect(Collectors.toList()); boolean isSurrogate = !attestationTypes.isEmpty() && attestationTypes.stream().allMatch(type -> type.equals(AttestationType.BASIC_SURROGATE)); if (isSurrogate && attestationStatement instanceof CertificateBaseAttestationStatement) { CertificateBaseAttestationStatement certificateBaseAttestationStatement = (CertificateBaseAttestationStatement) attestationStatement; if (certificateBaseAttestationStatement.getX5c() != null) { throw new BadAttestationStatementException("Although AAGUID is registered for surrogate attestation in metadata, x5c contains certificates."); } } for (MetadataItem metadataItem : metadataItems) { doAdditionalValidationForFidoMdsMetadataItem(metadataItem); } } FidoMdsMetadataValidator(MetadataItemsResolver metadataItemsResolver);  FidoMdsMetadataValidator(ObjectConverter objectConverter, String fidoMetadataServiceEndpoint);  FidoMdsMetadataValidator(String fidoMetadataServiceEndpoint); @Override void validate(RegistrationObject registrationObject); }
FidoMdsMetadataValidator implements CustomRegistrationValidator { @Override public void validate(RegistrationObject registrationObject) { AAGUID aaguid = registrationObject.getAttestationObject().getAuthenticatorData().getAttestedCredentialData().getAaguid(); AttestationStatement attestationStatement = registrationObject.getAttestationObject().getAttestationStatement(); Set<MetadataItem> metadataItems = metadataItemsResolver.resolve(aaguid); List<AttestationType> attestationTypes = metadataItems.stream() .flatMap(item -> item.getMetadataStatement().getAttestationTypes().stream()).collect(Collectors.toList()); boolean isSurrogate = !attestationTypes.isEmpty() && attestationTypes.stream().allMatch(type -> type.equals(AttestationType.BASIC_SURROGATE)); if (isSurrogate && attestationStatement instanceof CertificateBaseAttestationStatement) { CertificateBaseAttestationStatement certificateBaseAttestationStatement = (CertificateBaseAttestationStatement) attestationStatement; if (certificateBaseAttestationStatement.getX5c() != null) { throw new BadAttestationStatementException("Although AAGUID is registered for surrogate attestation in metadata, x5c contains certificates."); } } for (MetadataItem metadataItem : metadataItems) { doAdditionalValidationForFidoMdsMetadataItem(metadataItem); } } FidoMdsMetadataValidator(MetadataItemsResolver metadataItemsResolver);  FidoMdsMetadataValidator(ObjectConverter objectConverter, String fidoMetadataServiceEndpoint);  FidoMdsMetadataValidator(String fidoMetadataServiceEndpoint); @Override void validate(RegistrationObject registrationObject);  }