[java-idp-plugin-webauthn] branch main updated: Avoid signature counter updates for authenticators which do no implement

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=25c44542cf9c223e7a56f54a84f83b2e89c3e160

The following commit(s) were added to refs/heads/main by this push:
     new 25c4454  Avoid signature counter updates for authenticators which do no implement
25c4454 is described below

commit 25c44542cf9c223e7a56f54a84f83b2e89c3e160
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Feb 20 10:40:55 2025 +0000

    Avoid signature counter updates for authenticators which do no implement
    
     - If both current and new signCounts are 0, there is not need to update
    the storage record. This is a special case for authenticators that do
    not implement the signature counter.
---
 .../IdPStorageServiceCredentialRespository.java    |  9 +++++++
 ...IdPStorageServiceCredentialRespositoryTest.java | 31 ++++++++++++++++++++++
 2 files changed, 40 insertions(+)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java
index 6e5fdfc..68dd1f0 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java
@@ -540,6 +540,15 @@ public class IdPStorageServiceCredentialRespository extends AbstractIdentifiable
                         + "No existing credential found.", username, credentialId.getBase64());
                 return false;                
             }
+            
+            // If both the current signCount is 0 and the new signCount is 0 there is no need to update, this
+            // avoids unnecessary updates and will be common for synched software authenticators. This is a special
+            // case for authenticators which do not implement the signature counter.
+            if (newSignatureCount == 0 && credential.get().getCredential().getSignatureCount() == 0) {
+                log.trace("Authenticator does not implement a signature counter");
+                return true;
+            }
+            
             // Only update the signature counter, keep other fields the same as those already registered
             final RegisteredCredential updatedCredential = credential.get().getCredential().toBuilder()
                     .signatureCount(newSignatureCount)
diff --git a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespositoryTest.java b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespositoryTest.java
index b32d8b7..85e7c40 100644
--- a/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespositoryTest.java
+++ b/webauthn-impl/src/test/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespositoryTest.java
@@ -466,6 +466,37 @@ public class IdPStorageServiceCredentialRespositoryTest extends AbstractWebAuthn
         assertEquals(credReg.getCredential().getSignatureCount(),10);
         
         
+    }
+    
+    /* 
+     * Try an update with a signCount of 0, used by authenticators which do not implement the signature counter
+     * feature.
+     */
+    @SuppressWarnings("null")
+    @Test
+    public void testUpdateSignatureCounter_AuthenticatorDoesNotSupport() throws Exception {
+        
+        final CredentialRecord registration = createRegistration("jdoe", "John Doe", "user-handle".getBytes());
+        repo.addRegistrationByUsername("jdoe", registration);
+        
+        var registrations = repo.getRegistrationsByUsername("jdoe");
+        assertNotNull(registrations);
+        assertEquals(registrations.size(), 1);
+        var iterator = registrations.iterator();
+        var credReg = iterator.next();
+        assertEquals(credReg.getUsername(),"jdoe");
+        assertEquals(credReg.getCredential().getCredentialId(),
+                registration.getCredential().getCredentialId());
+        
+        repo.updateSignatureCounter("jdoe", credReg.getCredential().getCredentialId(), 0);
+        registrations = repo.getRegistrationsByUsername("jdoe");
+        assertNotNull(registrations);
+        assertEquals(registrations.size(), 1);
+        iterator = registrations.iterator();
+        credReg = iterator.next();
+        assertEquals(credReg.getCredential().getSignatureCount(),0);
+        
+        
     }
     
     @SuppressWarnings("null")

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.