[java-idp-plugin-webauthn] branch main updated: Improve efficiency of signature count updates

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=9b40c9a9c8da66750984227e03d1d4afaa7950f7

The following commit(s) were added to refs/heads/main by this push:
     new 9b40c9a  Improve efficiency of signature count updates
9b40c9a is described below

commit 9b40c9a9c8da66750984227e03d1d4afaa7950f7
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Fri Feb 21 09:58:15 2025 +0000

    Improve efficiency of signature count updates
    
     - Perform a READ of of the record first to determine if a WRITE is
    required. Then, if required, perform a full write under a write lock
    (the full write is pessimistic in that it reads the record again before
    writing).
     - Most software authenticators will therefore not trigger a WRITE (they
    do not implement the signature counter function)
---
 .../IdPStorageServiceCredentialRespository.java    | 34 +++++++++++++++++-----
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java
index 68dd1f0..964e589 100644
--- a/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java
+++ b/webauthn-impl/src/main/java/net/shibboleth/idp/plugin/authn/webauthn/storage/impl/IdPStorageServiceCredentialRespository.java
@@ -526,6 +526,32 @@ public class IdPStorageServiceCredentialRespository extends AbstractIdentifiable
     @Override
     public boolean updateSignatureCounter(@Nonnull final String username, @Nonnull final ByteArray credentialId, 
             final long newSignatureCount) {
+        checkComponentActive();
+        
+        // If both the current signCount is 0 and the new signCount is 0 there is no need to update, this
+        // avoids unnecessary updates and will be common for synched software authenticators. This is a special
+        // case for authenticators which do not implement the signature counter.
+        final Lock readLock = lock.readLock();
+        try {
+            readLock.lock();
+            // 
+            final Optional<CredentialRecord> credential = 
+                    getRegistrationByUsernameAndCredentialId(username, credentialId);
+            if (credential.isEmpty()) {
+                log.warn("Can not update signature count for user '{}' and credential '{}'. "
+                        + "No existing credential found.", username, credentialId.getBase64());
+                return false;    
+            }
+           
+            if (newSignatureCount == 0 && credential.get().getCredential().getSignatureCount() == 0) {
+                log.trace("Authenticator does not implement a signature counter");
+                return true;
+            }
+        } finally {
+            readLock.unlock();
+        }
+        
+        // If we need to write a new signature counter, get a write lock and try
         final Lock writeLock = lock.writeLock();
         try {
             writeLock.lock();
@@ -541,14 +567,6 @@ public class IdPStorageServiceCredentialRespository extends AbstractIdentifiable
                 return false;                
             }
             
-            // If both the current signCount is 0 and the new signCount is 0 there is no need to update, this
-            // avoids unnecessary updates and will be common for synched software authenticators. This is a special
-            // case for authenticators which do not implement the signature counter.
-            if (newSignatureCount == 0 && credential.get().getCredential().getSignatureCount() == 0) {
-                log.trace("Authenticator does not implement a signature counter");
-                return true;
-            }
-            
             // Only update the signature counter, keep other fields the same as those already registered
             final RegisteredCredential updatedCredential = credential.get().getCredential().toBuilder()
                     .signatureCount(newSignatureCount)

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.