Jans fido Review Configs #10101

[imran-ishaq]

Prepare

• Read PR guidelines
• Read license information

---

Description

Target issue

closes #10101

Implementation Details

---

Test and Document the changes

• Static code analysis has been run locally and issues have been fixed
• Relevant unit and integration tests have been added/updated
• Relevant documentation has been updated if any (i.e. user guides, installation and configuration guides, technical design docs etc)

Please check the below before submitting your PR. The PR will not be merged if there are no commits that start with docs: to indicate documentation changes or if the below checklist is not selected.

• I confirm that there is no impact on the docs due to the code changes in this PR.

[dryrunsecurity]

DryRun Security Summary

The pull request primarily focuses on the configuration and documentation of the FIDO2 authentication system within the Janssen server, including the removal of legacy features and updates to the FIDO2 configuration settings, which generally improve the application's security by simplifying the configuration and focusing on the more secure and standardized FIDO2 authentication protocol.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on the configuration and documentation of the FIDO2 (Fast IDentity Online) authentication system within the Janssen server. The changes involve the removal of legacy features, such as the support for the old U2F (Universal 2nd Factor) authentication method and the "Super Gluu" extension, as well as updates to the FIDO2 configuration settings.

From an application security perspective, the changes generally appear to be positive, as they simplify the configuration and focus on the more secure and standardized FIDO2 authentication protocol. The removal of the legacy features reduces the attack surface and potential vulnerabilities associated with those components.

The changes to the FIDO2 configuration settings, such as the specification of enabled FIDO algorithms, Relying Party (RP) information, and metadata service (MDS) configuration, are also important security enhancements. These changes help ensure the proper and secure implementation of the FIDO2 authentication mechanism.

However, it's crucial to thoroughly review the changes and their potential impact on the overall security of the application. The removal of legacy features may have implications for existing users or integrations, and the new FIDO2 configuration settings should be carefully tested and validated to ensure they are properly implemented and secured.

Files Changed:

1. Documentation Updates:

   • docs/janssen-server/reference/json/properties/fido2-properties.md: Removes the oldU2fMigrationEnabled and superGluuEnabled properties from the Fido2 configuration documentation.
   • docs/janssen-server/fido/config.md: Updates the documentation for the Fido2 configuration, including changes to the fido2Configuration section.
   • docs/janssen-server/config-guide/fido2-config/janssen-fido2-configuration.md: Provides more detailed documentation on the Fido2 configuration settings.

2. Code Changes:

   • docker-jans-fido2/scripts/upgrade.py: Removes the oldU2fMigrationEnabled configuration and performs transformations on the Fido2 configurations.
   • jans-cli-tui/cli_tui/plugins/020_fido/main.py: Removes the "Enable Super Gluu" checkbox from the FIDO2 plugin.
   • jans-fido2/model/src/main/java/io/jans/fido2/model/conf/AppConfiguration.java: Removes the oldU2fMigrationEnabled property.
   • jans-config-api/plugins/docs/fido2-plugin-swagger.yaml: Updates the Fido2 configuration and registration endpoints in the Jans Config API.
   • jans-fido2/model/src/main/java/io/jans/fido2/model/conf/Fido2Configuration.java: Changes the attestationMode field from an enum to a string, with a default value of "monitor".
   • terraform-provider-jans/jans/fido2_config_test.go, terraform-provider-jans/provider/resource_fido2_configuration_test.go, and terraform-provider-jans/jans/fido2_config.go: Remove the SuperGluuEnabled and OldU2fMigrationEnabled fields from the Fido2 configuration.
   • jans-linux-setup/jans_setup/templates/jans-fido2/dynamic-conf.json: Removes the superGluuEnabled and oldU2fMigrationEnabled options and adds new Fido2 configuration settings.

Overall, the changes in this pull request appear to be focused on improving the security and reliability of the FIDO2 authentication implementation within the Janssen server. However, it's essential to thoroughly review the changes and their potential impact on the application's security posture.

Code Analysis

We ran 9 analyzers against 12 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.