WebaAuthn: VersionMismatchException

[Philip Smart]

Hi Mats

Hopefully, the locking should handle the case of multiple concurrent authentications via the same IdP. I’ll dig deeper into the plugin to check the logic around that is correct.

Yes, in hindsight, I probably should have kept the signature counter updates disabled and just added some documentation on how to enable it if you really needed to. As it stands, if you disable that setting, the system will only write to the database for new FIDO2 registrations and updates to existing ones via the admin interface—so I’d probably do that.

Please let us know if this happens again or if you encounter any other similar database issues.
Phil

From: Mats Luspa <mats.luspa at irf.se>
Date: Sunday, 29 March 2026 at 20:14
To: Shib Users <users at shibboleth.net>, Philip Smart <Philip.Smart at jisc.ac.uk>
Subject: Re: WebaAuthn: VersionMismatchException
It should only be one idp process running. I'm using systemctl to start and stop the process.
However as it is a test instance a container I occasionally move back and forth between versions so maybe something happened with the database. I also had two browsers running to authenticate to a test sp. It can also be the reason.
But it is a good advice to turn off the signature counter. I didn't of course knew that.

/Regards Mats

Den 27 mars 2026 16:10 skrev Philip Smart via users <users at shibboleth.net>:

  > Caused by: org.opensaml.storage.VersionMismatchException



The updated credential record (with new signature count) is out of synch with the current version in the database. Updating the signature counter occurs under a write lock (likely multiple locks). This lock only affects a single running instance of the IdP, so if you have only one ‘process’ (IdP) updating the database, this is a bit unexpected. Do you have multiple IdP processes running that use the database?



Arguably, the signature counter offers no security benefit [1], and WebAuthn does not need it to securely authenticate. Consequently, you could turn that off using the idp.authn.webauthn.updateSignatureCount property in webauthn.properties, which frees up some DB writes. But you’d need to assess that for yourself.



Phil





[1] https://shibboleth.atlassian.net/browse/JWEBAUTHN-45




Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260330/c01c5f02/attachment.htm>