Webauthn problems with FIDO Metadata Service

[Mats Luspa]

Ok, thank you. Yes, I noticed that an old blob was working.

/Regards Mats

On 5/20/26 4:23 AM, Philip Smart wrote:
>
> Hi Mats,
>
> Yes, the Yubico parser failed to parse the FIDO metadata after new 
> values were added to it [1]. They’ve fixed that, and we are looking to 
> patch and ship a new version of the WebAuthn plugin in the next few 
> hours.
>
> [1] https://shibboleth.atlassian.net/browse/JWEBAUTHN-76
>
> *From: *dev <dev-bounces at shibboleth.net> on behalf of Mats Luspa via 
> dev <dev at shibboleth.net>
> *Date: *Wednesday, 20 May 2026 at 08:00
> *To: *users at shibboleth.net <users at shibboleth.net>, Shib Dev 
> <dev at shibboleth.net>
> *Cc: *Mats Luspa <mats.luspa at irf.se>
> *Subject: *Webauthn problems with FIDO Metadata Service
>
> Hello!
>
> I restarted jetty and got this in the log files and webauthn is not
> working now:
>
> 2026-05-20 06:53:44,282 - ERROR
> [org.springframework.web.context.ContextLoader:291] - Context
> initialization failed
> org.springframework.beans.factory.BeanCreationException: Error creating
> bean with name
> 'shibboleth.authn.WebAuthn.DefaultWebAuthnAuthenticationClientFactory'
> defined in URL
> [jar:file:/tmp/jetty-0_0_0_0-8080-idp_war-_idp-any-8368797749509679685/webinf/WEB-INF/lib/idp-plugin-webauthn-impl-1.4.1.jar!/META-INF/net.shibboleth.idp/postconfig.xml]: 
>
> Expression parsing failed
>          at
> org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:610) 
>
>
> Caused by: org.springframework.beans.factory.BeanExpressionException:
> Expression parsing failed
>          at
> org.springframework.context.expression.StandardBeanExpressionResolver.evaluate(StandardBeanExpressionResolver.java:185) 
>
>
> Caused by: org.springframework.beans.factory.BeanCreationException:
> Error creating bean with name
> 'shibboleth.authn.WebAuthn.DefaultWebAuthnFidoMetadataServiceFactory':
> FactoryBean threw exception on object creation
>          at
> org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:209) 
>
>
> Caused by: org.springframework.beans.FatalBeanException: Can not
> construct FIDO Metadata service
>          at
> net.shibboleth.idp.plugin.authn.webauthn.metadata.impl.FidoMetadataServiceFactory.getObject(FidoMetadataServiceFactory.java:135) 
>
>
> Caused by: com.fasterxml.jackson.databind.exc.InvalidFormatException:
> Cannot deserialize value of type
> `com.yubico.fido.metadata.AttachmentHint` from String "smart-card": not
> one of the values accepted for Enum class: [ready, external, internal,
> bluetooth, wired, wifi_direct, nfc, wireless, network]
>   at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION`
> disabled); line: 1, column: 1230384] (through reference chain:
> com.yubico.fido.metadata.MetadataBLOBPayload$MetadataBLOBPayloadBuilder["entries"]->java.util.HashSet[84]->com.yubico.fido.metadata.MetadataBLOBPayloadEntry$MetadataBLOBPayloadEntryBuilder["metadataStatement"]->com.yubico.fido.metadata.MetadataStatement$MetadataStatementBuilder["attachmentHint"]->java.util.HashSet[4]) 
>
>
>          at
> com.fasterxml.jackson.databind.exc.InvalidFormatException.from(InvalidFormatException.java:67) 
>
>
> JavaScript error: resource:///modules/MailNotificationManager.sys.mjs,
> line 539: NS_ERROR_FAILURE: Component returned failure code: 0x80004005
> (NS_ERROR_FAILURE) [nsIAlertsService.showAlert]
>
> It seem that WevAuthn cannot understand "smart-card" in FIDO metadata?
>
> What has happened?
>
> /Regards Mats
>
> -- 
> -- 
> Mats Luspa
> Phone: +46 (0)980 79 022
> Cellular phone: +46 (0)725813330
> Institutet för rymdfysik               Fax: +46 (0)980 79 050
> Swedish Institute of Space Physics      email: matsl at irf.se
> Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
> Postal address: Box 812, SE-981 28 Kiruna
> -- 
> PGP Public Key: https://www.irf.se/pgp/matsl 
> <https://www.irf.se/pgp/matsl>
> Digital vcard: https://www.irf.se/vcard/mats.luspa 
> <https://www.irf.se/vcard/mats.luspa>
>
>
> Jisc is a registered charity (in England and Wales under charity 
> number 1149740; in Scotland under charity number SC053607) and a 
> company limited by guarantee registered in England under company 
> number 05747339, VAT number GB 197 0632 86. Jisc's registered office 
> is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> Jisc Services Limited is a wholly owned Jisc subsidiary and a company 
> limited by guarantee which is registered in England under company 
> number 02881024, VAT number GB 197 0632 86. The registered office is: 
> 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.
>
> For more details on how Jisc handles your data see our privacy notice 
> here: https://www.jisc.ac.uk/website/privacy-notice
>
-- 
-- 
Mats Luspa
Phone: +46 (0)980 79 022
Cellular phone: +46 (0)725813330
Institutet för rymdfysik               Fax: +46 (0)980 79 050
Swedish Institute of Space Physics      email:matsl at irf.se
Visiting/Delivery address: Bengt Hultqvists väg 1, SE-981 92 Kiruna
Postal address: Box 812, SE-981 28 Kiruna
-- 
PGP Public Key:https://www.irf.se/pgp/matsl
Digital vcard:https://www.irf.se/vcard/mats.luspa

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20260520/4c5e57d0/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4382 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20260520/4c5e57d0/attachment.p7s>