Fido Register API Failing with timeout #197
Comments
|
I have tried using your own OpenAPI(demo4 strongkey( also and the same error is reflected there too. |
|
Hi @sanudatta11, Could you show the GlassFish log's output for when you performed your preregister and register? |
This is the log output |
|
Soumyajit,
The expectation is to see far more detail than what you've sent. You can
either choose to send the entire server.log file that includes the full
preregister and register webservice requests, or you can choose to
copy-paste just the log messages that cover the preregister and register
requests.
To do the latter, you can follow these steps:
1) In a Shell terminal, change directory to the folder where Payara logs
are maintained: /usr/local/strongkey/payara5/glassfish/domains/domain1/logs/
2) Run the "tail -f server.log" command in that directory;
3) Press the Enter key a few times to insert some blank lines at the end
of the log output;
4) Perform a registration operation on the client device (which will
cover preregister and register). This will generate a fair number of log
messages, including the failure you're seeing;
5) Copy-paste all the messages from where you inserted the blank lines
in your Shell window, till the end of the log output after the
completion of the register request.
That is the detail that we need to see.
…On 6/12/22 7:45 PM, Soumyajit Dutta wrote:
`[2022-06-13T00:00:03.139+0000] [Payara 5.2020.7] [INFO] [] [] [tid:
_ThreadID=234 _ThreadName=__ejb-thread-pool14] [timeMillis:
1655078403139] [levelValue: 800] [[
w20Chq__w5phZO2MRKRf7uOylSI9D1vs0hduCZbwyM3rByH2SQ-7mnxf-KKlLAbNlynqwZDAV3-t5d0NSsEXWd7hTsgu9GTx8_lLa1vAegWT1VqA6B21Vw_C7wZkiD5tDNGxLnSmzq5dbxAa-4kGjd86zoPKym3uhNeVsKM0IFJ6zxTyeaKihdTk6kDiAeZIZpItihh2SpWBRYhmo19mI51RrzIQ3wzF-kSLNJ63qmVu182bm6F9EvsT7G-eSlcmX9Zz9EKGMWxCOcTUG4Xin7CS1clLieqO09vHZtlcCcjoZt8yiK1St05Dv961oLIZ_P5SLseO1MA-3ZqJhHplqQ]]
[2022-06-13T00:00:03.150+0000] [Payara 5.2020.7] [INFO] [] [] [tid:
_ThreadID=234 _ThreadName=__ejb-thread-pool14] [timeMillis:
1655078403150] [levelValue: 800] [[
Certificate valid]]
[2022-06-13T00:00:03.162+0000] [Payara 5.2020.7] [INFO] [] [] [tid:
_ThreadID=234 _ThreadName=__ejb-thread-pool14] [timeMillis:
1655078403162] [levelValue: 800] [[
Signature Verified!!]]`
PFA
—
Reply to this email directly, view it on GitHub
<#197 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABWSVTSGCD5CZERM4ZKJCWLVO2OERANCNFSM5YN6U7KQ>.
You are receiving this because you are subscribed to this thread.Message
ID: ***@***.***>
|
|
PFA |
|
Logs for trying from IOS sample app |
|
Hi @sanudatta11,
|
|
|
Attaching the log after we changed the origin in the IOS App |
|
I have a question. Right now with the IOS we are facing a RPID mismatch error. How do we change the RPID. We have tried changing it in the upgrade script and running it but it didn't update it |
|
I changed the RPID in install-skfs script and ran it on a new server, but it gave out LDAP error below The above issue resulted in svcfido user not getting created and thus the pre register call fails with error |
|
Soumyajit,
Which version of the SKFS are you using?
…On 6/14/22 7:24 AM, Soumyajit Dutta wrote:
I changed the RPID in install-skfs script and ran it on a new server,
but it gave out LDAP error below
|Importing default users... ldap_sasl_bind(SIMPLE): Can't contact LDAP
server (-1) Importing default users... ldap_sasl_bind(SIMPLE): Can't
contact LDAP server (-1) Importing default users...
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Importing default
users... ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
Importing default users... ldap_sasl_bind(SIMPLE): Can't contact LDAP
server (-1) Importing default users... ldap_sasl_bind(SIMPLE): Can't
contact LDAP server (-1) Importing default users...
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1) Deploying
StrongKey FidoServer ... Application deployed with name fidoserver.
Command deploy executed successfully. |
The above issue resulted in svcfido user not getting created and thus
the pre register call fails with error
||
—
Reply to this email directly, view it on GitHub
<#197 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABWSVTVD2NIZEIDNCDFKW2LVPCIY3ANCNFSM5YN6U7KQ>.
You are receiving this because you commented.Message ID:
***@***.***>
|
|
@arshadnoor The latest. We were able to resolve the LDAP issue. We also were able to change the RPID and attach it to our domain. Attached latest server logs |
|
Hi @sanudatta11 , Can you give us more detail on what application you are using to test on IOS? If it is the native app, is this what is provided by StrongKey in the sample apps? or have you built your own? If this is the Strongkey sample app, then have you rebuilt the app locally with changes? From the error logs it looks like the application is using domain id 1 which is the minimal policy that enforces counters (https://docs.strongkey.com/index.php/skfs-home/skfs-administration/skfs-security/skfs-policy/minimal-any-hardware-authenticator) and will reject anything that will not have a counter or if the counter does not increment. Our FIDO server during installation adds 8 domains to the database with 8 different policies and if you can change the application to use domain 7 (did=7) then it uses a policy that is defined for apple devices that provide either apple or none attestation and this policy makes the counter optional (https://docs.strongkey.com/index.php/skfs-home/skfs-administration/skfs-security/skfs-policy/skfs-policy-restricted-apple-passkey). So based on your answers above, I can may be point you to the right location to configure the correct domain id. You can also put logs in FINE mode on the server so that we may be able to get more detailed logs for debugging in the future. One the FIDO server run the following to do so: Thank you |
|
Closing this issue as there has not been any update for a long time. Please feel free to reopen this if this is still a problem, |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Error in Register Rest API for Fido2 Server
Pre Register Works fine and returns a challenge. When we use the IOS Sample app and use the challenge to generate the register object, its throwing a timeout error in register API.
Payload
The text was updated successfully, but these errors were encountered: