All Classes and Interfaces
Class
Description
Fires the sweep for assertion ceremonies that lapsed without ever being completed.
Resolves the timing the abandonment sweep depends on.
Relabels assertion ceremonies that lapsed without ever being completed.
Attestation processor for fmt = "android-key" (Android Keystore attestation).
FIDO2 server initializer
For Apple's anonymous attestation fmt="apple"
serves request for /assertion endpoint exposed by FIDO2 sever
Core offering by the FIDO2 server, assertion is invoked upon authentication
Exports the native app association files of one configured relying party, to be deployed by the admin on
the RP-ID host's
/.well-known/ path: GET /rp/{rpConfigId}/association/assetlinks.json and
GET /rp/{rpConfigId}/association/apple-app-site-association.Produces the
assetlinks.json and apple-app-site-association files of a configured relying
party, for the admin to deploy on the RP-ID host.serves request for /attestation endpoint exposed by FIDO2 sever
Exception Class for Attestation related exceptions.
Interface class for AttestationFormatProcessor
The attestationObject contains base64url encoded buffer of CBOR encoded
attestation object.
Core offering by the FIDO2 server, attestation is invoked upon enrollment
A statement returned by the Attestation API.
Recovers the trust diagnostic, if any, from the exception that failed a registration.
Centralizes how attestation-trust failures are handled per attestation mode.
authData structure from https://www.w3.org/TR/webauthn/#authenticator-data
Every authentication is persisted under Person Entry
This enumeration describes the status of an authenticator model as identified by its AAID and potentially some additional information (such as a specific attestation key).
authData � a raw buffer struct containing user info.
Utility methods for base64 encoding / decoding
Says whether a resolved address is one the readiness fetcher must never connect to.
A holding class for certificate
Utiltiy class for Certificate related operations
Challenge generator class
One readiness check: a stable id, a status and a short reason.
Outcome of one readiness check.
The endpoint at which the requester can obtain FIDO2 metadata
configuration
Maps bean-validation failures (e.g. a missing/null request body annotated with
@NotNull)
to the FIDO2 conformance failure envelope.Compares a deployed
assetlinks.json / apple-app-site-association with what the RP
configuration says it should contain.Utility classes for COSE key structure.
Operations with custom scripts
Conversions to/from JSON format and to/from CBOR format
Utility class for extracting device information from HTTP requests
for FIDO2 metrics collection
Provides search operations with user U2F devices
Method to calculate digests
The one definition of what a relying party's association files should contain, built from its
RequestedParty.Service for FIDO2 analytics and reporting
Cluster node service for FIDO2 metrics aggregation
Extends the centralized ClusterNodeService from jans-core-service
RuntimeException Class for Fido2CompromisedDevice
Extends RuntimeException
Fido2 RP resteasy exception handler
Scheduler service for FIDO2 metrics aggregation
Job for daily aggregation
Uses distributed locking to ensure only one node performs aggregation
Job for data cleanup
Job for hourly aggregation
This job is designed to work in cluster environments where nodes can be added/removed
All statistics are persisted to the database, not kept in memory
Uses distributed locking to ensure only one node performs aggregation
Job for monthly aggregation
Uses distributed locking to ensure only one node performs aggregation
Job for weekly aggregation
Uses distributed locking to ensure only one node performs aggregation
REST API controller for FIDO2/Passkey metrics
Provides endpoints to fetch metrics data for dashboards and analytics tools
SECURITY NOTE: Authentication and authorization for these endpoints should be enforced
at the infrastructure level (API gateway, OAuth interceptor, or reverse proxy).
Service for managing FIDO2 metrics data operations
Missing attestation certificate Exception
A
Fido2RuntimeException that also carries why a ceremony failed, for failure modes
that are not attestation-trust related (see Fido2TrustException for those).Error class for FIDO2 RP Errors
Class for Fido2RpRuntimeException
Parent class of all FIDO2 RuntimeExceptions
REST API controller exposing attestation-mode and MDS health diagnostics.
A
Fido2RuntimeException that also carries why the attestation was not trusted.Service for managing FIDO2 user-level metrics
Health check controller
Maps malformed request bodies (invalid JSON, bad base64url, unknown enum values, etc.) to the
FIDO2 conformance failure envelope instead of a container-generated error page.
The FIDO2 server has a local database of authenticator data in json format.
Delivers a batch of
LockAuditEvent to the Lock Server's /audit/log/bulk
endpoint.Buffers passkey registration/authentication audit events and flushes them to the Lock Server in
batches on a schedule, rather than one HTTP call per ceremony.
Fires the periodic flush of buffered Lock Server audit events.
Obtains an OAuth2 access token, via the client credentials grant, for posting audit events to
the Lock Server.
Logger service
Class that periodically updates the mds3 blob in the FIDO2 server
Raised when the FIDO Metadata Service answers a TOC download with HTTP 429 (Too Many Requests).
Store and retrieve metric
Recovers the native-failure diagnostic, if any, from the exception that failed a registration or
authentication ceremony.
Runs the native app readiness checks for one configured relying party:
POST /rp/{rpConfigId}/readiness.The structured answer of the native app readiness endpoint.
One check as it appears in the response:
status is pass, warn or fail.Runs the native app readiness checks for one configured relying party: feature gate, lookup, RP ID
validation, per-RP result cache, rate limits, then the reachability and content checks.
The requested relying party is not configured.
A rate limit refused the request;
NativeReadinessService.RateLimited.retryAfterSeconds() says when to ask again.Attestation processor for attestations of fmt = none One of the attestation
formats called 'none'.
Obtain Organization Info
Attestation processor for attestations of fmt = packed
Provides operations with U2F RAW registration response
Provides operations with U2F RAW registration response
Decides whether a relying party's association files are reachable the way Android and iOS need them:
answered with 200 by the RP ID host itself, with a JSON content type, within the size and time limits.
Reachability checks for one association file, together with the fetch they were derived from.
Bounds how much outbound work the readiness endpoint can cause, per node.
Every registration is persisted under Person Entry
Integration with Resteasy
Decides whether a relying party ID may be used to build an outbound URL.
Why a value was rejected.
Outcome of
RpIdValidator.validate(String): either an accepted ID or a rejection reason.Resolves an assurance decision for one relying party, falling back to the global configuration.
Integration with Resteasy
TOC is parsed and Hashmap containing JSON object of individual Authenticators
is created.
Assembles the read-only attestation and MDS status reported by the trust endpoints.
Attestation processor for attestations of fmt =fido-u2f
Provides operations with users.
Configure user session to confirm Fido2 device authentication
A relying party ID that
RpIdValidator accepted: a normalized, lower-case, ASCII DNS hostname.The endpoint at which the requester can obtain FIDO2 WebAuthn Origins metadata
configuration
Fetches the two native-app association files from a relying party's domain, and nothing else.
What
WellKnownFetcher got back from a relying party's server.Why no response was obtained.