-
Notifications
You must be signed in to change notification settings - Fork 546
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add Apple attestation #5165
Add Apple attestation #5165
Conversation
...o2/carbon/identity/client/attestation/mgt/internal/ClientAttestationMgtServiceComponent.java
Outdated
Show resolved
Hide resolved
...a/org/wso2/carbon/identity/client/attestation/mgt/services/ClientAttestationServiceImpl.java
Show resolved
Hide resolved
...va/org/wso2/carbon/identity/client/attestation/mgt/validators/AppleAttestationValidator.java
Outdated
Show resolved
Hide resolved
...va/org/wso2/carbon/identity/client/attestation/mgt/validators/AppleAttestationValidator.java
Outdated
Show resolved
Hide resolved
...va/org/wso2/carbon/identity/client/attestation/mgt/validators/AppleAttestationValidator.java
Outdated
Show resolved
Hide resolved
...va/org/wso2/carbon/identity/client/attestation/mgt/validators/AppleAttestationValidator.java
Show resolved
Hide resolved
...va/org/wso2/carbon/identity/client/attestation/mgt/validators/AppleAttestationValidator.java
Outdated
Show resolved
Hide resolved
PR builder started |
PR builder completed |
PR builder started |
PR builder completed |
PR builder started |
PR builder completed |
PR builder started |
PR builder completed |
PR builder started |
PR builder completed |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/6887687116
Proposed changes in this pull request
Issue : wso2/product-is#16836
Implementation of the ClientAttestationValidator interface specific to Apple attestation.
This class validates attestation responses from Apple devices, ensuring the integrity and authenticity of the attested information.
The validation process involves decoding the Base64-encoded attestation object, parsing the CBOR data, and performing various checks on the attestation statement and authentication data.
Additionally, it validates the certificate chain using the Apple Root CA and ensures that the reply party Id matches the configured Apple App ID.
This method developed using following documentation Validating Apps That Connect to Your Servers
Two additional config parameters added with this fix.
In the context of PKIX (Public Key Infrastructure for X.509), revocation refers to the process of declaring a digital certificate as invalid before its natural expiration date. In Development this is not necessary, hence provide a config to configure revocation.
<AppleAttestationRevocationCheckEnabled>false</AppleAttestationRevocationCheckEnabled>