Package io.jans.fido2.service.mds

Class TocService

java.lang.Object
io.jans.fido2.service.mds.TocService
@ApplicationScoped public class TocService extends Object
TOC is parsed and Hashmap containing JSON object of individual Authenticators is created.

  • Constructor Details

    • TocService

      public TocService()

  • Method Details

    • init

      @Asynchronous public void init(@Observes @ApplicationInitialized(jakarta.enterprise.context.ApplicationScoped.class) Object init)
      Loads the MDS TOC at server startup.

      Runs asynchronously (via the Asynchronous interceptor, which the container applies when it dispatches this observer) so the potentially slow download — including the retry loop when the TOC blob is missing — never blocks application initialization. The FIDO2 server keeps starting up while the TOC is fetched in the background; requests that need it before it's ready are already handled defensively (see getAuthenticatorsMetadata(String)). We retry the download a few times only when the TOC blob is missing, because without it the server can't validate attestations.

    • refreshTOCEntries

      public void refreshTOCEntries()

    • fetchMetadata

      public void fetchMetadata()

    • fetchMetadata

      public void fetchMetadata(boolean retryWhenTocMissing)
      Fetches the MDS TOC blob, falling back to the copy cached in jansDocument when no fresh one could be published.
      Parameters:
      retryWhenTocMissing - when true (server startup) and the MDS TOC blob is missing from the DB, the download is retried a few times before giving up. A missing TOC blob prevents the FIDO2 server from validating attestations, so it's worth a few extra attempts to recover from a transient outage of the FIDO Alliance metadata service. When the TOC is merely stale (present but past its nextUpdate) a single attempt is made, matching the behaviour of the daily MDS3UpdateTimer.

    • getAuthenticatorsMetadata

      public com.fasterxml.jackson.databind.JsonNode getAuthenticatorsMetadata(String aaguid)

    • getDigester

      public MessageDigest getDigester()

    • getTocEntryCount

      public int getTocEntryCount()
      Number of authenticator metadata entries currently loaded in memory. Zero means attestation has no metadata to validate against — a common cause of a previously valid authenticator suddenly being rejected.

    • getLoadedTocNextUpdate

      public LocalDate getLoadedTocNextUpdate()
      The nextUpdate declared by the TOC blob currently loaded in memory, or null when no blob has been parsed since startup.

      Unlike getNextUpdateDate() this reads the in-memory value rather than the document store, so it neither performs I/O nor throws DocumentException — which is what makes it usable from a health endpoint.

    • getLastSuccessfulRefresh

      public OffsetDateTime getLastSuccessfulRefresh()
      When metadata was last downloaded and parsed successfully, in UTC, or null when no refresh has succeeded since startup.

    • getLastRefreshError

      public String getLastRefreshError()
      Why the most recent refresh failed, or null when the last refresh succeeded.

    • downloadMdsFromServer

      public boolean downloadMdsFromServer(URL metadataUrl)

    • saveNextUpdateDateOfTheMDS

      public boolean saveNextUpdateDateOfTheMDS()

    • getNextUpdateDate

      public LocalDate getNextUpdateDate()