Crypto.WebAuthn.Metadata.Service.Processing

This module exposes functions for processing and querying FIDO Metadata Service blobs and entries.

Documentation

data RootCertificate

A root certificate along with the host it should be verified against

Constructors

RootCertificate

Fields

• rootCertificateStore :: CertificateStore

  The root certificate itself

• rootCertificateHostName :: HostName

  The hostname it is for

Instances

(MonadError ProcessingError m, MonadReader DateTime m) => VerificationKeyStore m (JWSHeader ()) p RootCertificate

Defined in Crypto.WebAuthn.Metadata.Service.Processing

Methods

getVerificationKeys :: JWSHeader () -> p -> RootCertificate -> m [JWK]

data ProcessingError

Errors related to the processing of the metadata

Constructors

ProcessingValidationErrors (NonEmpty FailedReason)

An error wrapping the errors encountered by the X509 Validation

ProcessingMissingX5CHeader

There was no x5c header present in the metadata JWT

ProcessingJWSError Error

An error wrapping the general Errors from the JOSE library

ProcessingJWTError JWTError

An error wrapping the JWT specific Errors from the JOSE library

ProcessingX5UPresent URI

There was a x5u header present in the metadata JWT but this is unimplemented TODO: Implement step 4 of the (spec)

Instances

Show ProcessingError

Defined in Crypto.WebAuthn.Metadata.Service.Processing

Methods

showsPrec :: Int -> ProcessingError -> ShowS

show :: ProcessingError -> String

showList :: [ProcessingError] -> ShowS

Eq ProcessingError

Defined in Crypto.WebAuthn.Metadata.Service.Processing

Methods

(==) :: ProcessingError -> ProcessingError -> Bool

(/=) :: ProcessingError -> ProcessingError -> Bool

AsError ProcessingError

Instantiate JOSE's AsError typeclass as a simple cast to our own error type. This allows using our own error type in JOSE operations.

Defined in Crypto.WebAuthn.Metadata.Service.Processing

Methods

_Error :: Prism' ProcessingError Error

_AlgorithmNotImplemented :: Prism' ProcessingError ()

_AlgorithmMismatch :: Prism' ProcessingError String

_KeyMismatch :: Prism' ProcessingError Text

_KeySizeTooSmall :: Prism' ProcessingError ()

_OtherPrimesNotSupported :: Prism' ProcessingError ()

_RSAError :: Prism' ProcessingError Error

_CryptoError :: Prism' ProcessingError CryptoError

_CompactDecodeError :: Prism' ProcessingError CompactDecodeError

_JSONDecodeError :: Prism' ProcessingError String

_NoUsableKeys :: Prism' ProcessingError ()

_JWSCritUnprotected :: Prism' ProcessingError ()

_JWSNoValidSignatures :: Prism' ProcessingError ()

_JWSInvalidSignature :: Prism' ProcessingError ()

_JWSNoSignatures :: Prism' ProcessingError ()

AsJWTError ProcessingError

Instantiate JOSE's AsJWTError typeclass as a simple cast to our own error type. This allows using our own error type in JWT operations.

Defined in Crypto.WebAuthn.Metadata.Service.Processing

Methods

_JWTError :: Prism' ProcessingError JWTError

_JWSError :: Prism' ProcessingError Error

_JWTClaimsSetDecodeError :: Prism' ProcessingError String

_JWTExpired :: Prism' ProcessingError ()

_JWTNotYetValid :: Prism' ProcessingError ()

_JWTNotInIssuer :: Prism' ProcessingError ()

_JWTNotInAudience :: Prism' ProcessingError ()

_JWTIssuedAtFuture :: Prism' ProcessingError ()

createMetadataRegistry :: [SomeMetadataEntry] -> MetadataServiceRegistry

Creates a MetadataServiceRegistry from a list of SomeMetadataEntry, which can either be obtained from a MetadataPayloads mpEntries field, or be constructed directly

The resulting structure can be queried efficiently for MetadataEntry using queryMetadata

queryMetadata :: MetadataServiceRegistry -> AuthenticatorIdentifier p -> Maybe (MetadataEntry p)

Query a MetadataEntry for an AuthenticatorIdentifier

jwtToJson

Arguments

:: ByteString

The bytes of the JWT blob

-> RootCertificate

The root certificate the blob is signed with

-> DateTime

The current time for which to validate the JWT blob

-> Either ProcessingError (HashMap Text Value)

Extracts a FIDO Metadata payload JSON value from a JWT bytestring according to https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html

jsonToPayload :: HashMap Text Value -> These (NonEmpty Text) MetadataPayload

Decodes a FIDO Metadata payload JSON value to a MetadataPayload, returning an error when the JSON is invalid, and ignoring any entries not relevant for webauthn. For the purposes of implementing the relying party the mpNextUpdate and mpEntries fields are most important.

fidoAllianceRootCertificate :: RootCertificate

The root certificate used for the blob downloaded from https://mds.fidoalliance.org/, which can be found in here, see also https://fidoalliance.org/metadata/