<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
@font-face
{font-family:Corbel;
panose-1:2 11 5 3 2 2 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:10.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
p.p1, li.p1, div.p1
{mso-style-name:p1;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-GB" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-US">Hi Mats<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-US">Hopefully, the locking should handle the case of multiple concurrent authentications via the same IdP. I’ll dig deeper into the plugin to check the logic around that is correct.
<o:p></o:p></span></p>
<p class="p1"><span style="mso-fareast-language:EN-US">Yes, in hindsight, I probably should have kept the signature counter updates disabled and just added some documentation on how to enable it if you really needed to.
</span>As it stands, if you disable that setting, the system will only write to the database for new FIDO2 registrations and updates to existing ones via the admin interface<span style="mso-fareast-language:EN-US">—so I’d probably do that.</span><o:p></o:p></p>
<p class="p1">Please let us know if this happens again or if you encounter any other similar database issues.<span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-US">Phil<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Mats Luspa <mats.luspa@irf.se><br>
<b>Date: </b>Sunday, 29 March 2026 at 20:14<br>
<b>To: </b>Shib Users <users@shibboleth.net>, Philip Smart <Philip.Smart@jisc.ac.uk><br>
<b>Subject: </b>Re: WebaAuthn: VersionMismatchException<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt">It should only be one idp process running. I'm using systemctl to start and stop the process.<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt">However as it is a test instance a container I occasionally move back and forth between versions so maybe something happened with the database. I also had two browsers running to authenticate to a test sp.
It can also be the reason.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt">But it is a good advice to turn off the signature counter. I didn't of course knew that.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt">/Regards Mats<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt">Den 27 mars 2026 16:10 skrev Philip Smart via users <users@shibboleth.net>:<o:p></o:p></span></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p> > Caused by: org.opensaml.storage.VersionMismatchException<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>The updated credential record (with new signature count) is out of synch with the current version in the database. Updating the signature counter occurs under a write lock (likely multiple locks). This lock only affects a single running instance of the IdP,
so if you have only one ‘process’ (IdP) updating the database, this is a bit unexpected. Do you have multiple IdP processes running that use the database?
<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>Arguably, the signature counter offers no security benefit [1], and WebAuthn does not need it to securely authenticate. Consequently, you could turn that off using the idp.authn.webauthn.updateSignatureCount property in webauthn.properties, which frees up
some DB writes. But you’d need to assess that for yourself.<o:p></o:p></p>
<p> <o:p></o:p></p>
<p>Phil<o:p></o:p></p>
<p> <o:p></o:p></p>
<p> <o:p></o:p></p>
<p>[1] <a href="https://shibboleth.atlassian.net/browse/JWEBAUTHN-45">https://shibboleth.atlassian.net/browse/JWEBAUTHN-45</a><o:p></o:p></p>
<p> <o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Corbel",sans-serif"><o:p> </o:p></span></p>
<p style="margin-bottom:12.0pt"><span style="font-size:7.5pt;font-family:"Corbel",sans-serif">Jisc is a registered charity (in England and Wales under charity number 1149740; in Scotland under charity number SC053607) and a company limited by guarantee registered
in England under company number 05747339, VAT number GB 197 0632 86. Jisc's registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<o:p></o:p></span></p>
<p style="margin-bottom:12.0pt"><span style="font-size:7.5pt;font-family:"Corbel",sans-serif">Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number
GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<o:p></o:p></span></p>
<p><span style="font-size:7.5pt;font-family:"Corbel",sans-serif">For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice<o:p></o:p></span></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>