KeyCloak/keycloak
1
0
Fork 0
mirror of https://github.com/keycloak/keycloak.git synced 2026-05-26 13:50:48 +00:00
Code Issues Packages Projects Releases Wiki Activity

Upgrade webauthn4j to 0.30.3

Browse Source 
Closes #48420

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
This commit is contained in:
Martin Bartoš
2026-04-30 15:07:20 +02:00
committed by GitHub
parent a9e73c22ab
commit 3a825c8de9
4 changed files with 3 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pom.xml
+1 -7
View File
@@ -227,8 +227,7 @@
</testframework.surefire.args>
<!-- webauthn support -->
<webauthn4j.version>0.29.3.RELEASE</webauthn4j.version>
<org.apache.kerby.kerby-asn1.version>2.0.3</org.apache.kerby.kerby-asn1.version>
<webauthn4j.version>0.30.3.RELEASE</webauthn4j.version>
<!-- Used to test SAML Galleon feature-pack layers discovery -->
<version.org.wildfly.glow>1.0.0.Alpha8</version.org.wildfly.glow>
@@ -1213,11 +1212,6 @@
<artifactId>webauthn4j-util</artifactId>
<version>${webauthn4j.version}</version>
</dependency>
<dependency>
<groupId>org.apache.kerby</groupId>
<artifactId>kerby-asn1</artifactId>
<version>${org.apache.kerby.kerby-asn1.version}</version>
</dependency>
<!-- used in server-dist build while provisioning the distribution -->
<dependency>
quarkus/runtime/pom.xml
-10
View File
@@ -513,16 +513,6 @@
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.apache.kerby</groupId>
<artifactId>kerby-asn1</artifactId>
<exclusions>
<exclusion>
<groupId>*</groupId>
<artifactId>*</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.freemarker</groupId>
<artifactId>freemarker</artifactId>
services/src/main/java/org/keycloak/authentication/authenticators/browser/WebAuthnAuthenticator.java
+1 -1
View File
@@ -171,7 +171,7 @@ public class WebAuthnAuthenticator implements Authenticator, CredentialValidator
Origin origin = new Origin(baseUrl);
Challenge challenge = new DefaultChallenge(context.getAuthenticationSession().getAuthNote(WebAuthnConstants.AUTH_CHALLENGE_NOTE));
ServerProperty server = new ServerProperty(origin, rpId, challenge, null);
ServerProperty server = new ServerProperty(origin, rpId, challenge);
byte[] credentialId = Base64Url.decode(params.getFirst(WebAuthnConstants.CREDENTIAL_ID));
byte[] clientDataJSON = Base64Url.decode(params.getFirst(WebAuthnConstants.CLIENT_DATA_JSON));
services/src/main/java/org/keycloak/authentication/requiredactions/WebAuthnRegister.java
+1 -1
View File
@@ -248,7 +248,7 @@ public class WebAuthnRegister implements RequiredActionProvider, CredentialRegis
.collect(Collectors.toSet());
allOrigins.add(origin);
Challenge challenge = new DefaultChallenge(context.getAuthenticationSession().getAuthNote(WebAuthnConstants.AUTH_CHALLENGE_NOTE));
ServerProperty serverProperty = new ServerProperty(allOrigins, rpId, challenge, null);
ServerProperty serverProperty = new ServerProperty(allOrigins, rpId, challenge);
// check User Verification by considering a malicious user might modify the result of calling WebAuthn API
boolean isUserVerificationRequired = policy.getUserVerificationRequirement().equals(Constants.WEBAUTHN_POLICY_OPTION_REQUIRED);