Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Apple attestation #5165

Merged
merged 9 commits into from
Nov 16, 2023
Merged

Add Apple attestation #5165

merged 9 commits into from
Nov 16, 2023

Conversation

Thumimku
Copy link
Contributor

Proposed changes in this pull request

Issue : wso2/product-is#16836

Implementation of the ClientAttestationValidator interface specific to Apple attestation.
This class validates attestation responses from Apple devices, ensuring the integrity and authenticity of the attested information.
The validation process involves decoding the Base64-encoded attestation object, parsing the CBOR data, and performing various checks on the attestation statement and authentication data.
Additionally, it validates the certificate chain using the Apple Root CA and ensures that the reply party Id matches the configured Apple App ID.
This method developed using following documentation Validating Apps That Connect to Your Servers

Two additional config parameters added with this fix.

<AppleAttestationRootCertificatePath>
${carbon.home}/repository/resources/identity/apple/attestation/apple_attestation_root_ca.pem
</AppleAttestationRootCertificatePath>

In the context of PKIX (Public Key Infrastructure for X.509), revocation refers to the process of declaring a digital certificate as invalid before its natural expiration date. In Development this is not necessary, hence provide a config to configure revocation.
<AppleAttestationRevocationCheckEnabled>false</AppleAttestationRevocationCheckEnabled>

@jenkins-is-staging
Copy link

@jenkins-is-staging
Copy link

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6875207565
Status: cancelled

@jenkins-is-staging
Copy link

@jenkins-is-staging
Copy link

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6877323899
Status: cancelled

@jenkins-is-staging
Copy link

@jenkins-is-staging
Copy link

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6881564107
Status: cancelled

@jenkins-is-staging
Copy link

@jenkins-is-staging
Copy link

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6886406037
Status: failure

@jenkins-is-staging
Copy link

@jenkins-is-staging
Copy link

PR builder completed
Link: https://github.com/wso2/product-is/actions/runs/6887687116
Status: success

Copy link

@jenkins-is-staging jenkins-is-staging left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approving the pull request based on the successful pr build https://github.com/wso2/product-is/actions/runs/6887687116

@Thumimku Thumimku merged commit 1eaf6e0 into wso2:master Nov 16, 2023
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants