diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-d00b0dcbe241793d30daf91c.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-d00b0dcbe241793d30daf91c.yaml index 3c3b9cc..6860ff6 100644 --- a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-d00b0dcbe241793d30daf91c.yaml +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-d00b0dcbe241793d30daf91c.yaml @@ -45,13 +45,15 @@ spec: podDisruptionBudget: maxUnavailable: "50%" git: - tag: "r-6c7464eb8d6ece1e29939bf3c8d50b1c424a0b45" + tag: "r-4d495f8f73f00597da5fbe633d85d96ac04db24e" dir: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth" credentials: "git-credentials" keystores: - "ob-auth-default-identity" + - "ob-auth-ob-realm-accessapp-registration-nevisfido-tls-client-ke" truststores: - "ob-auth-agov-work-internal-trust-store" + - "ob-auth-ob-realm-accessapp-registration-nevisfido-tls-trust-sto" - "ob-auth-default-tls-client-trust" podSecurity: policy: "baseline" diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-ob-realm-accessapp-registration-nevisfido-tls-client-ke-d00b0dcbe241793d30daf91c.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-ob-realm-accessapp-registration-nevisfido-tls-client-ke-d00b0dcbe241793d30daf91c.yaml new file mode 100644 index 0000000..25d27da --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-ob-realm-accessapp-registration-nevisfido-tls-client-ke-d00b0dcbe241793d30daf91c.yaml @@ -0,0 +1,18 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisKeyStore" +metadata: + name: "ob-auth-ob-realm-accessapp-registration-nevisfido-tls-client-ke" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-auth" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d00b0dcbe241793d30daf91c" +spec: + cn: "ob-auth" + usage: "" + san: + dns: + - "ob-auth" + - "ob-auth.adn-agov-nevisidm-ob-01-uat" + email: [] diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-ob-realm-accessapp-registration-nevisfido-tls-trust-sto-d00b0dcbe241793d30daf91c.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-ob-realm-accessapp-registration-nevisfido-tls-trust-sto-d00b0dcbe241793d30daf91c.yaml new file mode 100644 index 0000000..7e624c0 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/etc/nevis/k8s-ob-auth-ob-realm-accessapp-registration-nevisfido-tls-trust-sto-d00b0dcbe241793d30daf91c.yaml @@ -0,0 +1,14 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisTrustStore" +metadata: + name: "ob-auth-ob-realm-accessapp-registration-nevisfido-tls-trust-sto" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-auth" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d00b0dcbe241793d30daf91c" +spec: + keystores: + - name: "ob-fido-uaf-default-server-identity" + namespace: "adn-agov-nevisidm-ob-01-uat" diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/esauth4.xml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/esauth4.xml index ca0a551..c147a6b 100644 --- a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/esauth4.xml +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/esauth4.xml @@ -35,11 +35,21 @@ + + + + + + + + + + - - + + @@ -88,11 +98,11 @@ - + - + - + @@ -202,6 +212,56 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -248,6 +308,29 @@ + + + + + + + + + + + + + + + + + + + + + + + @@ -278,17 +361,6 @@ - - - - - - - - - - - diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/ob-realm-accessapp-registration.groovy b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/ob-realm-accessapp-registration.groovy new file mode 100644 index 0000000..36336bc --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-auth/var/opt/nevisauth/default/conf/ob-realm-accessapp-registration.groovy @@ -0,0 +1,169 @@ +import groovy.json.JsonSlurper +import groovy.json.JsonOutput + +import ch.nevis.esauth.auth.engine.AuthUtil +import ch.nevis.esauth.util.httpclient.configuration.HttpClientConfiguration + +/** + * + * Initiate the registration process with a `POST /nevisfido/token/dispatch/registration` to nevisFIDO. + * + * @param username - required + * @param policy - default policy is used when null + */ +void dispatchRegistration(HttpClient httpClient, String baseUrl, String username, String policy) { + + LOG.debug(" ==> Starting out-of-band mobile onboarding for username '{}'.", username) + + String context = '{"username":"' + username + '", "policy":"' + (policy ?: 'default') + '"}' + + def jsonBody = JsonOutput.toJson([ + dispatcher: 'link', + getUafRequest: [ + op: 'Reg', + context: context + ] + ]) + + LOG.debug("JSON body: {}", jsonBody) + + def fidoRequest = Http.post().url(baseUrl + "/token/dispatch/registration") + .header('Accept', 'application/json; charset=utf-8') + .header('Content-Type', 'application/json; charset=utf-8') + .entity(Http.entity().content(jsonBody).build()) + .build() + + def fidoResponse = fidoRequest.send(httpClient) + + def responseCode = fidoResponse.code() + if (responseCode != 200) { + LOG.error('<== Failed to enroll user with username: ' + username + '. Response: ' + responseCode + ": " + fidoResponse.bodyAsString()) + response.setResult('failed') + return + } + + def json = new JsonSlurper().parseText(fidoResponse.bodyAsString()) + LOG.debug('JSON response: {}', json) + + if (json.dispatchResult != 'dispatched') { + LOG.error('<== Failed to enroll user with username: ' + username + '. Response: ' + responseCode + ": " + fidoResponse.bodyAsString()) + response.setResult('failed') + return + } + + String dispatcherLink = json.dispatcherInformation.response + String sessionId = json.sessionId + + // store dispatcher information and session ID as session variables + // to handle page refresh and status polling + + // the session variable is rendered as a hidden field + // and picked up by the mauth_onboard.js to render a link / QR code + session.put('mauth_dispatcher_link', dispatcherLink) + + // the session ID is used to handle status polling + session.put('mauth_session_id', sessionId) +} + +/** + * + * Check registration status by sending a `POST /nevisfido/status` to nevisFIDO. + * + * @param sessionId - required + */ +void checkRegistrationStatus(HttpClient httpClient, String baseUrl, String sessionId) { + + LOG.debug(" ==> Checking out-of-band mobile registration status for session '{}'.", sessionId) + + def jsonBody = JsonOutput.toJson([ + sessionId: sessionId + ]) + + def fidoRequest = Http.post().url(baseUrl + "/status") + .header('Accept', 'application/json; charset=utf-8') + .header('Content-Type', 'application/json; charset=utf-8') + .entity(Http.entity().content(jsonBody).build()) + .build() + + def fidoResponse = fidoRequest.send(httpClient) + + def responseCode = fidoResponse.code() + if (responseCode == 200) { + + def json = new JsonSlurper().parseText(fidoResponse.bodyAsString()) + LOG.debug('JSON response: {}', json) + + String status = json.status + LOG.debug('status: {}', status) + + def inctx = request.getLoginContext() + + def contentType = request.getHttpHeader('Content-Type') + LOG.debug("incoming request has Content-Type: {}", contentType) + + if (contentType ==~ /.*json.*/) { + LOG.debug("detected AJAX call") + + // responding AJAX call from JS and returning only the status (nothing else) + def statusJson = JsonOutput.toJson([ + status: status + ]) + + response.setContent(statusJson) + response.setContentType('application/json') + response.setHttpStatusCode(200) + response.setIsDirectResponse(true) + } + else { + // this is a form POST and thus we have to check if we have to continue + if (status == 'succeeded') { + response.setResult('ok') + return + } + } + } + else { + LOG.error('<== Failed to check status for session ' + sessionId + '. Response: ' + responseCode + ": " + fidoResponse.bodyAsString()) + response.setResult('failed') + } +} + +// convert parameters to Properties +Properties properties = new Properties() +for (Map.Entry entry : parameters.entrySet()) { + properties.setProperty(entry.getKey(), entry.getValue()) +} + +def httpClientConfig = HttpClientConfiguration.from(properties, request, response) + +// we cannot use a cached HTTP client here as the parameters contain expressions that depend on the request +def httpClient = HttpClients.create(httpClientConfig) + +def baseUrl = parameters.get('fidoUrl') + +if (session.containsKey('mauth_session_id')) { + + def sessionId = session['mauth_session_id'] + + // mauth_onboard.js sends empty AJAX calls to check for completion. + // we have to check the status by sending a `POST /nevisfido/status` to nevisFIDO respond to the AJAX call. + checkRegistrationStatus(httpClient, baseUrl, sessionId) +} +else { + def usernameSource = parameters.get('username') + if (usernameSource == null || usernameSource.isBlank()) { + LOG.error('out-of-band mobile onboarding failed. no expression to determine username.') + response.setResult('failed') + return + } + + def username = AuthUtil.substituteVariables(request, response, usernameSource) + if (username == null || username.isBlank()) { + LOG.error('out-of-band mobile onboarding failed. missing username.') + response.setResult('failed') + return + } + + def policy = parameters.get('policy') + dispatchRegistration(httpClient, baseUrl, username, policy) +} diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-agov-work-internal-trust-store-d990accd4fedae1acbc7109d.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-agov-work-internal-trust-store-d990accd4fedae1acbc7109d.yaml new file mode 100644 index 0000000..cb08012 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-agov-work-internal-trust-store-d990accd4fedae1acbc7109d.yaml @@ -0,0 +1,14 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisTrustStore" +metadata: + name: "ob-fido-uaf-agov-work-internal-trust-store" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-fido-uaf" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d990accd4fedae1acbc7109d" +spec: + keystores: [] + extraCerts: + - "-----BEGIN CERTIFICATE-----\nMIIBcTCCARagAwIBAgIQWRl1eifIt8yohQYzh6yr/jAKBggqhkjOPQQDAjAYMRYw\nFAYDVQQDEw1zZWxmc2lnbmVkLWNhMB4XDTIzMDYyODE0MzI0MFoXDTQzMDYyODE0\nMzI0MFowGDEWMBQGA1UEAxMNc2VsZnNpZ25lZC1jYTBZMBMGByqGSM49AgEGCCqG\nSM49AwEHA0IABEwcjsIhSyyh0i9zP1G7ReOkFt/djzlGoUtSd5v3ZEk5QoZYjfl9\n04HdaZzrmveB2aRppbXgW7//s2Ma8wTd5uejQjBAMA4GA1UdDwEB/wQEAwICpDAP\nBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBT7YRoWIjHwkvFicwvk0Tx/yA4uUTAK\nBggqhkjOPQQDAgNJADBGAiEAgyg9t0qgb+czuscs07pNGI+12BedrD+y71psIlqx\nt2UCIQC/85UXyjYI9zg7Mg7rROTbGNCU3Jq/KIC3VzbbD+68VA==\n-----END CERTIFICATE-----\n" diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-d990accd4fedae1acbc7109d.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-d990accd4fedae1acbc7109d.yaml new file mode 100644 index 0000000..c120de9 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-d990accd4fedae1acbc7109d.yaml @@ -0,0 +1,61 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisComponent" +metadata: + name: "ob-fido-uaf" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-fido-uaf" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d990accd4fedae1acbc7109d" +spec: + type: "NevisFIDO" + replicas: 1 + version: "8.2405.0" + gitInitVersion: "1.3.0" + runAsNonRoot: true + ports: + rest: 9443 + management: 9089 + resources: + limits: + cpu: "1000m" + memory: "1000Mi" + requests: + cpu: "100m" + memory: "700Mi" + livenessProbe: + management: + httpGet: + path: "/nevisfido/liveness" + periodSeconds: 5 + timeoutSeconds: 6 + readinessProbe: + management: + httpGet: + path: "/nevisfido/health" + periodSeconds: 5 + timeoutSeconds: 6 + startupProbe: + management: + httpGet: + path: "/nevisfido/health" + periodSeconds: 5 + timeoutSeconds: 6 + failureThreshold: 50 + podDisruptionBudget: + maxUnavailable: "50%" + git: + tag: "r-4d495f8f73f00597da5fbe633d85d96ac04db24e" + dir: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf" + credentials: "git-credentials" + keystores: + - "ob-fido-uaf-default-server-identity" + truststores: + - "ob-fido-uaf-agov-work-internal-trust-store" + - "ob-fido-uaf-default-signer-trust" + - "ob-fido-uaf-default-client-trust" + podSecurity: + policy: "baseline" + automountServiceAccountToken: false + timeZone: "Europe/Zurich" diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-client-trust-d990accd4fedae1acbc7109d.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-client-trust-d990accd4fedae1acbc7109d.yaml new file mode 100644 index 0000000..f1c04b1 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-client-trust-d990accd4fedae1acbc7109d.yaml @@ -0,0 +1,12 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisTrustStore" +metadata: + name: "ob-fido-uaf-default-client-trust" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-fido-uaf" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d990accd4fedae1acbc7109d" +spec: + keystores: [] diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-server-identity-d990accd4fedae1acbc7109d.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-server-identity-d990accd4fedae1acbc7109d.yaml new file mode 100644 index 0000000..d32df3d --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-server-identity-d990accd4fedae1acbc7109d.yaml @@ -0,0 +1,18 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisKeyStore" +metadata: + name: "ob-fido-uaf-default-server-identity" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-fido-uaf" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d990accd4fedae1acbc7109d" +spec: + cn: "ob-fido-uaf" + usage: "" + san: + dns: + - "ob-fido-uaf" + - "ob-fido-uaf.adn-agov-nevisidm-ob-01-uat" + email: [] diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-signer-trust-d990accd4fedae1acbc7109d.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-signer-trust-d990accd4fedae1acbc7109d.yaml new file mode 100644 index 0000000..3457a5f --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/k8s-ob-fido-uaf-default-signer-trust-d990accd4fedae1acbc7109d.yaml @@ -0,0 +1,12 @@ +apiVersion: "operator.nevis-security.ch/v1" +kind: "NevisTrustStore" +metadata: + name: "ob-fido-uaf-default-signer-trust" + namespace: "adn-agov-nevisidm-ob-01-uat" + labels: + deploymentTarget: "ob-fido-uaf" + annotations: + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d990accd4fedae1acbc7109d" +spec: + keystores: [] diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/nevisfido_default.yml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/nevisfido_default.yml new file mode 100644 index 0000000..48830f2 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/etc/nevis/nevisfido_default.yml @@ -0,0 +1,18 @@ +schemaVersion: 1.0 +instance: + type: "nevisfido" + name: "default" + directory: "/var/opt/nevisfido/default" + pid: "systemctl show nevisfido@default -p MainPID | cut -d '=' -f2" + source: + url: "/nevisadmin/#/projects/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/patterns/d990accd4fedae1acbc7109d" + projectKey: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT" + patternId: "d990accd4fedae1acbc7109d" + patternClass: "ch.nevis.admin.v4.plugin.nevisfido.deployable.patterns.NevisFIDODeployable" + resources: + ports: + - "0.0.0.0:9443" + control: + start: "systemctl restart nevisfido@default" + stop: "systemctl stop nevisfido@default" + status: "systemctl status nevisfido@default" diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/cert.pem b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/cert.pem new file mode 100644 index 0000000..0d07b2a --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/cert.pem @@ -0,0 +1,18 @@ +-----BEGIN CERTIFICATE----- +MIIC6TCCAo+gAwIBAgIQfcfd9dgdKT/5gdDbpAiKlDAKBggqhkjOPQQDAjAYMRYw +FAYDVQQDEw1zZWxmc2lnbmVkLWNhMB4XDTI0MDUwNTE1NTAzOFoXDTI1MDUwNTE1 +NTAzOFowWDELMAkGA1UEBhMCQ0gxDDAKBgNVBAgTA0s4UzEMMAoGA1UEBxMDSzhT +MQwwCgYDVQQKEwNLOFMxDDAKBgNVBAsTA0s4UzERMA8GA1UEAxMIZmlkby11YWYw +ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWcQPIzUN2zbPkB3yISIGw +mDAd285YKm/ZLbE4WWw2SIHhjfh0XoYZ6QvLMENWcC8/iOX/6g6upQnYegzZKlST +Lix0zJjEbtMlK8fITiPhwziWPSOeqtuW66Rj+13G6kKYVtZ8vviu73LBDkXKHSNi +g4knNgACJpIItiDhOmtmD3Wsb8JAIQ161m7D3i2jr/kqBFKLc2DXcCHYSwxBXu3A +99iqWxoHfprL/L7RfxBo7mKbk+xjRvw6wFHBb76m6hd8fe4yg3g9zZTsZ5KeKqtA +8NT7CTG26F/MEBEmreU6NcNP62sYBkQiY+K5WweUs5qnDCAUPz+Upu0lX49ZDsvZ +AgMBAAGjga8wgawwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMB +BggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFPthGhYiMfCS8WJz +C+TRPH/IDi5RMEwGA1UdEQRFMEOCCGZpZG8tdWFmgiFmaWRvLXVhZi5hZG4tYWdv +di1uZXZpc2lkbS0wMS11YXSBFG5vcmVwbHlAbG9jYWwuZG9tYWluMAoGCCqGSM49 +BAMCA0gAMEUCIBCueTTUwnN53/dIs6W4FpbFtF/wkAhYjLZGuKgY08ZAAiEA9VFz +WoaxaINHqGPR10Sh1hqeuCHRzHxnQUt07sZf2DU= +-----END CERTIFICATE----- diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/key.pem b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/key.pem new file mode 100644 index 0000000..2637d2f --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/key.pem @@ -0,0 +1,30 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIFKzBVBgkqhkiG9w0BBQ0wSDAnBgkqhkiG9w0BBQwwGgQUWtp2pbSNdJCf9jA9 +KTzjbdorVLQCAggAMB0GCWCGSAFlAwQBKgQQb0NJGFGc8MxZaCZ71uYlEASCBND5 +XhsSZKjT6CN02euPCcN5ssgXTfOlHG5hl4KcpNl/K61CH+gNH3rTzzao8utmd5ko +cWbl6o6nj2IdiU8IlaqI+VIR2nfHaqoGhJHfLbvPu/SItKTFjFTRRKddyKTIjN0o +eVbHMzt8pHvNKnNK2JmKQ+TqphGTaDIgEEqPRSniE6WHLGuCfG/VdaeRxTZldj9D +QDR41gC2kgDbsenkZZjhGEJpgM4g3mD7bc0IHMRG1wfSW8qyd+S+XxjYdgMJmffc +PCMPv3TJ0Xbxfw+BKED9WeSIaXfCFmVprNXhWhMMN8Z7o3WxigVo2oRkHWbhSff4 +hFy4AQgyq8TOE1C2xeAcADEFagCHDdf0cs5LgwytpH5/0oTsm0+pFol6yEa7X1rF +Eu7NT8zLxXxqUdlCJ1A2AWbi17ER6snst4RfT7cCiI3d6q6IO2dsfuHSs17AHY2m +1KSfgVwH05o3W58ADUVuoZxtqCS0xMv2mvlTJ7xSb90R4hz5w1JBKjrYqq1Xy1Lr +pDc9kBEwJKtN9V63veUnHR5tFku9mVTEK6iykYWRNORexNEas5wsiuxrgaXtGN5G +ouhq9MCe5DI0coQOHM0Bvw1zfQ+wj8RUgrt0290WF0VtHW+zH0qbVHYZ6dKRY5YX +azzLvyu5AlH9p2MZr/+oZn6lgjmVEYq0UbsUvFoZy65qwi2XqL7FvXIVSVTgr7YY +hiODL4FBWJEevE+MujfOpOftzivdx1+/cuiQHcbqKlPQLnQXaUKI337u2o8uAEch +lP3AvI4DVi4m6IC9lo6657r8MqwMGmdEK9PRDPHUf7SP3HGX8fYArwRWILtHrcmc +/kHhKUkMxHduFb0nYQTVFnlpLEidcv6gYIVsh8Fx5pQWW+HyBD4sJuG7mLMgtmtY +vk9zayWbq0lw0Bb+E83vk9xtE0tUoFF/Wcl2nBf5PjfCqesGqr9CHElcQGfcINCg +3llXoeceN868e5DKgtQE6Fp5KukclgeeeX4kPj+UK7x4UGtdGcdghwH6EO7McQX1 +67kyLDcF4p5HnrzEhP2CVcVDHXoeykMCitvHaInwmJQsR209PVa/XxXB8YoMAAV1 +DB3GT024dAxFEl5r1HJm3A7BiFFuvQdUi+recFGKfmSNZ1Pwp2+8DV7UiAYLJ5Wf +o/aAwUQByITI3fBPvmEAA86FeWwtQ5BG5e+q7imH1ooOzrHQzaqwzQKU+IQCzaDF +sAqMtSD/hzIRjMKOSAL8bA2SVIXlLUnulWjPwW9zhUTv9yS1q2EsiFUJnOyq7iAI +fX72qEBvBXLFBdGhotMAXeg1YsXLUxbldqAWuPxpZMQ5S6J7GZZloXSe1Gy/ZZh4 +tKD8qQTS5Rfwiqxxo3kgaB/z0qG99pTB/wWv4fwnv6lFjJRjgyGONRYIGCVCFH2X +mdV2rTUxtwB1cIr71ksA64O3YkUObyfT8gSbLjPoBDBBPQQ3crbaQdiOjGUE9zUF +8kp3/mVj/kBCNtlc4dR/lJGuM97h2OpR5sLvb/5TN9C3tcXUyRmDjqJY/eX9ui0D +pEe6juN9Wy1yZtHauTIK0dqol+DJr56mMdMzBBmDagdr17Q2XK+GKrp5Z9rPbXJv +8qjMHKVFlbQRMtOY8N/PQenRyl1XmZIPk9HWj+9+6w== +-----END ENCRYPTED PRIVATE KEY----- diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keypass b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keypass new file mode 100755 index 0000000..85ccc28 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keypass @@ -0,0 +1,2 @@ +#!/bin/bash +echo 'Hsk+IJIkp1oGu8i1S+w6p2QMDB+9WFSNjNlSYdUCfA8=' \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.jks b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.jks new file mode 100644 index 0000000..9641839 Binary files /dev/null and b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.jks differ diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.p12 b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.p12 new file mode 100644 index 0000000..3ca00a3 Binary files /dev/null and b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.p12 differ diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.pem b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.pem new file mode 100644 index 0000000..0127d82 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/keys/own/nevisfido-techuser-key/keystore.pem @@ -0,0 +1,49 @@ +-----BEGIN ENCRYPTED PRIVATE KEY----- +MIIFKzBVBgkqhkiG9w0BBQ0wSDAnBgkqhkiG9w0BBQwwGgQUWtp2pbSNdJCf9jA9 +KTzjbdorVLQCAggAMB0GCWCGSAFlAwQBKgQQb0NJGFGc8MxZaCZ71uYlEASCBND5 +XhsSZKjT6CN02euPCcN5ssgXTfOlHG5hl4KcpNl/K61CH+gNH3rTzzao8utmd5ko +cWbl6o6nj2IdiU8IlaqI+VIR2nfHaqoGhJHfLbvPu/SItKTFjFTRRKddyKTIjN0o +eVbHMzt8pHvNKnNK2JmKQ+TqphGTaDIgEEqPRSniE6WHLGuCfG/VdaeRxTZldj9D +QDR41gC2kgDbsenkZZjhGEJpgM4g3mD7bc0IHMRG1wfSW8qyd+S+XxjYdgMJmffc +PCMPv3TJ0Xbxfw+BKED9WeSIaXfCFmVprNXhWhMMN8Z7o3WxigVo2oRkHWbhSff4 +hFy4AQgyq8TOE1C2xeAcADEFagCHDdf0cs5LgwytpH5/0oTsm0+pFol6yEa7X1rF +Eu7NT8zLxXxqUdlCJ1A2AWbi17ER6snst4RfT7cCiI3d6q6IO2dsfuHSs17AHY2m +1KSfgVwH05o3W58ADUVuoZxtqCS0xMv2mvlTJ7xSb90R4hz5w1JBKjrYqq1Xy1Lr +pDc9kBEwJKtN9V63veUnHR5tFku9mVTEK6iykYWRNORexNEas5wsiuxrgaXtGN5G +ouhq9MCe5DI0coQOHM0Bvw1zfQ+wj8RUgrt0290WF0VtHW+zH0qbVHYZ6dKRY5YX +azzLvyu5AlH9p2MZr/+oZn6lgjmVEYq0UbsUvFoZy65qwi2XqL7FvXIVSVTgr7YY +hiODL4FBWJEevE+MujfOpOftzivdx1+/cuiQHcbqKlPQLnQXaUKI337u2o8uAEch +lP3AvI4DVi4m6IC9lo6657r8MqwMGmdEK9PRDPHUf7SP3HGX8fYArwRWILtHrcmc +/kHhKUkMxHduFb0nYQTVFnlpLEidcv6gYIVsh8Fx5pQWW+HyBD4sJuG7mLMgtmtY +vk9zayWbq0lw0Bb+E83vk9xtE0tUoFF/Wcl2nBf5PjfCqesGqr9CHElcQGfcINCg +3llXoeceN868e5DKgtQE6Fp5KukclgeeeX4kPj+UK7x4UGtdGcdghwH6EO7McQX1 +67kyLDcF4p5HnrzEhP2CVcVDHXoeykMCitvHaInwmJQsR209PVa/XxXB8YoMAAV1 +DB3GT024dAxFEl5r1HJm3A7BiFFuvQdUi+recFGKfmSNZ1Pwp2+8DV7UiAYLJ5Wf +o/aAwUQByITI3fBPvmEAA86FeWwtQ5BG5e+q7imH1ooOzrHQzaqwzQKU+IQCzaDF +sAqMtSD/hzIRjMKOSAL8bA2SVIXlLUnulWjPwW9zhUTv9yS1q2EsiFUJnOyq7iAI +fX72qEBvBXLFBdGhotMAXeg1YsXLUxbldqAWuPxpZMQ5S6J7GZZloXSe1Gy/ZZh4 +tKD8qQTS5Rfwiqxxo3kgaB/z0qG99pTB/wWv4fwnv6lFjJRjgyGONRYIGCVCFH2X +mdV2rTUxtwB1cIr71ksA64O3YkUObyfT8gSbLjPoBDBBPQQ3crbaQdiOjGUE9zUF +8kp3/mVj/kBCNtlc4dR/lJGuM97h2OpR5sLvb/5TN9C3tcXUyRmDjqJY/eX9ui0D +pEe6juN9Wy1yZtHauTIK0dqol+DJr56mMdMzBBmDagdr17Q2XK+GKrp5Z9rPbXJv +8qjMHKVFlbQRMtOY8N/PQenRyl1XmZIPk9HWj+9+6w== +-----END ENCRYPTED PRIVATE KEY----- + +-----BEGIN CERTIFICATE----- +MIIC6TCCAo+gAwIBAgIQfcfd9dgdKT/5gdDbpAiKlDAKBggqhkjOPQQDAjAYMRYw +FAYDVQQDEw1zZWxmc2lnbmVkLWNhMB4XDTI0MDUwNTE1NTAzOFoXDTI1MDUwNTE1 +NTAzOFowWDELMAkGA1UEBhMCQ0gxDDAKBgNVBAgTA0s4UzEMMAoGA1UEBxMDSzhT +MQwwCgYDVQQKEwNLOFMxDDAKBgNVBAsTA0s4UzERMA8GA1UEAxMIZmlkby11YWYw +ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDWcQPIzUN2zbPkB3yISIGw +mDAd285YKm/ZLbE4WWw2SIHhjfh0XoYZ6QvLMENWcC8/iOX/6g6upQnYegzZKlST +Lix0zJjEbtMlK8fITiPhwziWPSOeqtuW66Rj+13G6kKYVtZ8vviu73LBDkXKHSNi +g4knNgACJpIItiDhOmtmD3Wsb8JAIQ161m7D3i2jr/kqBFKLc2DXcCHYSwxBXu3A +99iqWxoHfprL/L7RfxBo7mKbk+xjRvw6wFHBb76m6hd8fe4yg3g9zZTsZ5KeKqtA +8NT7CTG26F/MEBEmreU6NcNP62sYBkQiY+K5WweUs5qnDCAUPz+Upu0lX49ZDsvZ +AgMBAAGjga8wgawwDgYDVR0PAQH/BAQDAgeAMB0GA1UdJQQWMBQGCCsGAQUFBwMB +BggrBgEFBQcDAjAMBgNVHRMBAf8EAjAAMB8GA1UdIwQYMBaAFPthGhYiMfCS8WJz +C+TRPH/IDi5RMEwGA1UdEQRFMEOCCGZpZG8tdWFmgiFmaWRvLXVhZi5hZG4tYWdv +di1uZXZpc2lkbS0wMS11YXSBFG5vcmVwbHlAbG9jYWwuZG9tYWluMAoGCCqGSM49 +BAMCA0gAMEUCIBCueTTUwnN53/dIs6W4FpbFtF/wkAhYjLZGuKgY08ZAAiEA9VFz +WoaxaINHqGPR10Sh1hqeuCHRzHxnQUt07sZf2DU= +-----END CERTIFICATE----- diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/env.conf b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/env.conf new file mode 100644 index 0000000..30a29d9 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/env.conf @@ -0,0 +1,10 @@ +RUN_ARGS="--config conf/nevisfido.yml --log-config conf/logging.yml" + +JAVA_OPTS=( + "-XX:+UseContainerSupport" + "-XX:MaxRAMPercentage=80.0" + "-javaagent:/opt/agent/opentelemetry-javaagent.jar" + "-Dotel.javaagent.logging=application" + "-Dotel.javaagent.configuration-file=/var/opt/nevisfido/default/conf/otel.properties" + "-Dotel.resource.attributes=service.version=8.2405.0,service.instance.id=$HOSTNAME" +) \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/logging.yml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/logging.yml new file mode 100644 index 0000000..8d3cc20 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/logging.yml @@ -0,0 +1,21 @@ +Configuration: + monitorInterval: 60 + Appenders: + Console: + - name: "SERVER" + target: "SYSTEM_OUT" + PatternLayout: + pattern: "[nevisfido.log] %d{ISO8601} %-15.15t %mdc{trace_id} %mdc{span_id} %-40.40c %-5.5p %m%n" + RegexFilter: + regex: ".*GET /nevisfido/liveness.*" + onMatch: "DENY" + onMismatch: "ACCEPT" + Loggers: + Logger: + - name: "ch.nevis.auth.fido.application.Application" + level: "INFO" + Root: + level: "WARN" + additivity: "false" + AppenderRef: + - ref: "SERVER" diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/metadata/metadata.json b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/metadata/metadata.json new file mode 100644 index 0000000..7a83c28 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/metadata/metadata.json @@ -0,0 +1,231 @@ +[ + { + "aaid" : "F1D0#0001", + "description" : "Android NEVIS Mobile Authentication PIN Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 4 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 9, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 1, + "matcherProtection" : 1, + "publicKeyAlgAndEncoding" : 256, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#0002", + "description" : "Android NEVIS Mobile Authentication Fingerprint Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 2 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 9, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 4, + "matcherProtection" : 2, + "publicKeyAlgAndEncoding" : 256, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#0003", + "description" : "Android NEVIS Mobile Authentication Biometric Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 346 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 9, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 4, + "matcherProtection" : 2, + "publicKeyAlgAndEncoding" : 256, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#0004", + "description" : "Android NEVIS Mobile Authentication Device Passcode Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 132 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 9, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 4, + "matcherProtection" : 2, + "publicKeyAlgAndEncoding" : 259, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#0005", + "description" : "Android NEVIS Mobile Authentication Password Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 4 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 9, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 1, + "matcherProtection" : 1, + "publicKeyAlgAndEncoding" : 256, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#1001", + "description" : "iOS NEVIS Mobile Authentication PIN Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 4 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 2, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 1, + "matcherProtection" : 1, + "publicKeyAlgAndEncoding" : 257, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#1002", + "description" : "iOS NEVIS Mobile Authentication Fingerprint Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 2 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 2, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 6, + "matcherProtection" : 2, + "publicKeyAlgAndEncoding" : 257, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#1003", + "description" : "iOS NEVIS Mobile Authentication Face Recognition Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 16 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 2, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 6, + "matcherProtection" : 2, + "publicKeyAlgAndEncoding" : 257, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#1004", + "description" : "iOS NEVIS Mobile Authentication Device Passcode Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 4 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 2, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 6, + "matcherProtection" : 2, + "publicKeyAlgAndEncoding" : 257, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }, + { + "aaid" : "F1D0#1005", + "description" : "iOS NEVIS Mobile Authentication Password Authenticator", + "assertionScheme" : "UAFV1TLV", + "attestationRootCertificates" : [], + "attestationTypes" : [ 15880 ], + "upv" : [ { + "major" : 1, + "minor" : 1 + } ], + "userVerificationDetails" : [ [ { + "userVerification" : 4 + } ] ], + "attachmentHint" : 1, + "authenticationAlgorithm" : 2, + "authenticatorVersion" : 1, + "isSecondFactorOnly" : false, + "keyProtection" : 1, + "matcherProtection" : 1, + "publicKeyAlgAndEncoding" : 257, + "tcDisplay" : 1, + "tcDisplayContentType" : "text/plain" + }] \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/nevisfido.yml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/nevisfido.yml new file mode 100644 index 0000000..40793ba --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/nevisfido.yml @@ -0,0 +1,104 @@ +server: + port: 9443 + host: 0.0.0.0 + protocol: https + tls: + keystore: /var/opt/keys/own/ob-fido-uaf-default-server-identity/keystore.p12 + keystore-passphrase: ${exec:/var/opt/keys/own/ob-fido-uaf-default-server-identity/keypass} + keystore-type: pkcs12 + truststore: /var/opt/keys/trust/ob-fido-uaf-default-client-trust/truststore.p12 + truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido-uaf-default-client-trust/keypass} + truststore-type: pkcs12 + +management: + server: + port: 9089 + healthchecks: + enabled: true + +credential-repository: + type: nevisidm + rest-url: https://idm.adn-agov-nevisidm-01-uat:8989/nevisidm + administration-url: https://idm.adn-agov-nevisidm-01-uat:8989/nevisidm/services/v1_46/AdminService + keystore: /var/opt/keys/own/nevisfido-techuser-key/keystore.p12 + keystore-passphrase: ${exec:/var/opt/keys/own/nevisfido-techuser-key/keypass} + keystore-type: pkcs12 + truststore: /var/opt/keys/trust/ob-fido-uaf-agov-work-internal-trust-store/truststore.p12 + truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido-uaf-agov-work-internal-trust-store/keypass} + truststore-type: pkcs12 + admin-service-version: v1_46 + client-id: 100 + user-attribute: extId + +session-repository: + type: in-memory + jdbc-url: + max-connection-lifetime: + user: + password: + schema-user: + schema-user-password: + automatic-db-schema-setup: false + +fido-uaf: + enabled: true + app-id: https://auth.agov-w.azure.adnovum.net//nevisfido/uaf/1.1/facets + facets: + - android:apk-key-hash:kdcDr+sJVydAkZ6nT/HR3UpJFSd+vPORXLww8DIHV7c + - ios:bundle-id:ch.nevis.accessapp + - android:apk-key-hash:ch.nevis.mobile.authentication.sdk.android.example + - android:apk-key-hash:ch.nevis.mobile.authentication.sdk.flutter.example + - android:apk-key-hash:ch.nevis.mobile.authentication.sdk.react.example + - ios:bundle-id:ch.nevis.mobile.authentication.sdk.ios.example + - ios:bundle-id:ch.nevis.mobile.authentication.sdk.flutter.example + - ios:bundle-id:ch.nevis.mobile.authentication.sdk.objc.proxy.example + - ios:bundle-id:ch.nevis.mobile.authentication.sdk.react.example + metadata: + path: conf/metadata/metadata.json + policy: + path: conf/policy/ + timeout: + registration: 600s + authentication: 600s + token-registration: 600s + token-authentication: 600s + token-deregistration: 600s + transaction-confirmation: + max-text-length: 2000 + authorization: + registration: + type: sectoken + truststore: /var/opt/keys/trust/ob-fido-uaf-default-signer-trust/truststore.p12 + truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido-uaf-default-signer-trust/keypass} + truststore-type: pkcs12 + username-attribute-names: + - loginId + - userid + authentication: + type: none + deregistration: + type: sectoken + truststore: /var/opt/keys/trust/ob-fido-uaf-default-signer-trust/truststore.p12 + truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido-uaf-default-signer-trust/keypass} + truststore-type: pkcs12 + username-attribute-names: + - loginId + - userid + create-dispatch-target: + type: sectoken + truststore: /var/opt/keys/trust/ob-fido-uaf-default-signer-trust/truststore.p12 + truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido-uaf-default-signer-trust/keypass} + truststore-type: pkcs12 + username-attribute-names: + - loginId + - userid + query-dispatch-target: + type: none + delete-dispatch-target: + type: sectoken + truststore: /var/opt/keys/trust/ob-fido-uaf-default-signer-trust/truststore.p12 + truststore-passphrase: ${exec:/var/opt/keys/trust/ob-fido-uaf-default-signer-trust/keypass} + truststore-type: pkcs12 + username-attribute-names: + - userid + dispatchers: [] \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/otel.properties b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/otel.properties new file mode 100644 index 0000000..ffe9ce8 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/otel.properties @@ -0,0 +1,4 @@ +otel.service.name = ob-fido-uaf +otel.traces.exporter = none +otel.metrics.exporter = none +otel.logs.exporter = none diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/biometrics_only.json b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/biometrics_only.json new file mode 100644 index 0000000..940439f --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/biometrics_only.json @@ -0,0 +1,24 @@ +{ + "accepted": [ + [ + { + "aaid": ["F1D0#0002"] + } + ], + [ + { + "aaid": ["F1D0#0003"] + } + ], + [ + { + "aaid": ["F1D0#1002"] + } + ], + [ + { + "aaid": ["F1D0#1003"] + } + ] + ] +} \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/default.json b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/default.json new file mode 100644 index 0000000..3e043e9 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/default.json @@ -0,0 +1,44 @@ +{ + "accepted": [ + [ + { + "aaid": ["F1D0#0001"] + } + ], + [ + { + "aaid": ["F1D0#0002"] + } + ], + [ + { + "aaid": ["F1D0#0003"] + } + ], + [ + { + "aaid": ["F1D0#0004"] + } + ], + [ + { + "aaid": ["F1D0#1001"] + } + ], + [ + { + "aaid": ["F1D0#1002"] + } + ], + [ + { + "aaid": ["F1D0#1003"] + } + ], + [ + { + "aaid": ["F1D0#1004"] + } + ] + ] +} \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/pin_only.json b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/pin_only.json new file mode 100644 index 0000000..9f56c78 --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/policy/pin_only.json @@ -0,0 +1,14 @@ +{ + "accepted": [ + [ + { + "aaid": ["F1D0#0001"] + } + ], + [ + { + "aaid": ["F1D0#1001"] + } + ] + ] +} \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/status.py b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/status.py new file mode 100644 index 0000000..a5c9bae --- /dev/null +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/conf/status.py @@ -0,0 +1,47 @@ +import sys +import time +import urllib.request, urllib.error, urllib.parse + +health_endpoint = 'http://localhost:9089/nevisfido/health' +log_file_path = '/var/opt/nevisfido/default/log/nevisfido.log' + +# Calls nevisFIDO's health check endpoint repeatedly to determine whether it is up and running +# Returns True if the service is available or False otherwise +def is_nevisfido_healthy(): + for timeout in [0.1, 2, 4, 8, 16, 30]: + try: + time.sleep(timeout) + response = urllib.request.urlopen(health_endpoint) + if response.getcode() == 200: + return True + except urllib.error.URLError: + continue + return False + +# Parses the nevisFIDO logs for the last error registered and raises and exception about it. +def raise_last_error_in_log(): + event_buffer = [] + for line in reversed(open(log_file_path).readlines()): + stripped_line = line.rstrip() + event_buffer.append(stripped_line) + if '[main] ERROR' in stripped_line: + raise Exception('\n'.join(reversed(event_buffer))) + break + # Log events (by default) starts with logging the time in the following format: '2019-11-04 12:44:45,071 21512 [main]' + # but these events can be multi-lined. + # We check here whether the current line is a start of a new event - in which case we flush the buffer. + if is_year(stripped_line[:4]): + event_buffer = [] + +# This method returns True if the provided string can be parsed to a year (4 digit int), or False otherwise. +def is_year(str): + try: + return int(str) > 999 and int(str) < 10000 + except ValueError: + return False + +if is_nevisfido_healthy(): + sys.exit(0) +else: + raise_last_error_in_log() + sys.exit(1) \ No newline at end of file diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/log/.empty b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/log/.empty new file mode 100644 index 0000000..e69de29 diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/tmp/.empty b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-fido-uaf/var/opt/nevisfido/default/tmp/.empty new file mode 100644 index 0000000..e69de29 diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/etc/nevis/k8s-ob-proxy-b4d2da2fa2d0b060752a1fe2.yaml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/etc/nevis/k8s-ob-proxy-b4d2da2fa2d0b060752a1fe2.yaml index f77b04e..d06db53 100644 --- a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/etc/nevis/k8s-ob-proxy-b4d2da2fa2d0b060752a1fe2.yaml +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/etc/nevis/k8s-ob-proxy-b4d2da2fa2d0b060752a1fe2.yaml @@ -46,7 +46,7 @@ spec: podDisruptionBudget: maxUnavailable: "50%" git: - tag: "r-f65a315ec4cfd8575904ed12349257a59adbd1e2" + tag: "r-4d495f8f73f00597da5fbe633d85d96ac04db24e" dir: "DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy" credentials: "git-credentials" keystores: diff --git a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/var/opt/nevisproxy/default/host-ob.agov-w.azure.adnovum.net/WEB-INF/web.xml b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/var/opt/nevisproxy/default/host-ob.agov-w.azure.adnovum.net/WEB-INF/web.xml index 4d3c3a4..3b61910 100644 --- a/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/var/opt/nevisproxy/default/host-ob.agov-w.azure.adnovum.net/WEB-INF/web.xml +++ b/DEFAULT-ADN-AGOV-WORK-OB-PROJECT/DEFAULT-DEFAULT-ADN-AGOV-OB-INV/ob-proxy/var/opt/nevisproxy/default/host-ob.agov-w.azure.adnovum.net/WEB-INF/web.xml @@ -282,6 +282,22 @@ ch::nevis::isiweb4::listener::SessionListener + + + Connector_NevisFIDO + + ch::nevis::isiweb4::servlet::connector::http::HttpsConnectorServlet + + + AutoRewrite + none + + + + InetAddress + ob-fido-uaf:9443 + + Connector_ob-realm @@ -418,6 +434,31 @@ /nevislogrend + + + Connector_NevisFIDO + /nevisfido/devices/credentials/* + + + + Connector_NevisFIDO + /nevisfido/token/dispatch/targets/* + + + + Connector_NevisFIDO + /nevisfido/token/redeem/registration + + + + Connector_NevisFIDO + /nevisfido/uaf/1.1/facets + + + + Connector_NevisFIDO + /nevisfido/uaf/1.1/registration/ + NevisLogrendConnector_ob-logrend