Webauthn problems with FIDO Metadata Service

[Philip Smart]

Hi Mats,

Yes, the Yubico parser failed to parse the FIDO metadata after new values were added to it [1]. They’ve fixed that, and we are looking to patch and ship a new version of the WebAuthn plugin in the next few hours.

[1] https://shibboleth.atlassian.net/browse/JWEBAUTHN-76

From: dev <dev-bounces at shibboleth.net> on behalf of Mats Luspa via dev <dev at shibboleth.net>
Date: Wednesday, 20 May 2026 at 08:00
To: users at shibboleth.net <users at shibboleth.net>, Shib Dev <dev at shibboleth.net>
Cc: Mats Luspa <mats.luspa at irf.se>
Subject: Webauthn problems with FIDO Metadata Service
Hello!

I restarted jetty and got this in the log files and webauthn is not
working now:

2026-05-20 06:53:44,282 - ERROR
[org.springframework.web.context.ContextLoader:291] - Context
initialization failed
org.springframework.beans.factory.BeanCreationException: Error creating
bean with name
'shibboleth.authn.WebAuthn.DefaultWebAuthnAuthenticationClientFactory'
defined in URL
[jar:file:/tmp/jetty-0_0_0_0-8080-idp_war-_idp-any-8368797749509679685/webinf/WEB-INF/lib/idp-plugin-webauthn-impl-1.4.1.jar!/META-INF/net.shibboleth.idp/postconfig.xml]:
Expression parsing failed
         at
org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:610)

Caused by: org.springframework.beans.factory.BeanExpressionException:
Expression parsing failed
         at
org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:185)

Caused by: org.springframework.beans.factory.BeanCreationException:
Error creating bean with name
'shibboleth.authn.WebAuthn.DefaultWebAuthnFidoMetadataServiceFactory':
FactoryBean threw exception on object creation
         at
org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:209)

Caused by: org.springframework.beans.FatalBeanException: Can not
construct FIDO Metadata service
         at
net.shibboleth.idp.plugin.authn.webauthn.metadata.impl.FidoMetadataServiceFactory.getObject(FidoMetadataServiceFactory.java:135)

Caused by: com.fasterxml.jackson.databind.exc.InvalidFormatException:
Cannot deserialize value of type
`com.yubico.fido.metadata.AttachmentHint` from String "smart-card": not
one of the values accepted for Enum class: [ready, external, internal,
bluetooth, wired, wifi_direct, nfc, wireless, network]
  at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION`
disabled); line: 1, column: 1230384] (through reference chain:
com.yubico.fido.metadata.MetadataBLOBPayload$MetadataBLOBPayloadBuilder["entries"]->java.util.HashSet[84]->com.yubico.fido.metadata.MetadataBLOBPayloadEntry$MetadataBLOBPayloadEntryBuilder["metadataStatement"]->com.yubico.fido.metadata.MetadataStatement$MetadataStatementBuilder["attachmentHint"]->java.util.HashSet[4])

         at
com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67)

JavaScript error: resource:///modules/MailNotificationManager.sys.mjs,
line 539: NS_ERROR_FAILURE: Component returned failure code: 0x80004005
(NS_ERROR_FAILURE) [nsIAlertsService.showAlert]

It seem that WevAuthn cannot understand "smart-card" in FIDO metadata?

What has happened?

/Regards Mats

--
--
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email: matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
--
PGP Public Key: https://www.irf.se/pgp/matsl
Digital vcard: https://www.irf.se/vcard/mats.luspa


Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20260520/66309559/attachment-0001.htm>