== Configuration

WebAuthn4J has a one main entry point class, `WebAuthnManager`.
It delegates attestation statements validation to an implementation of
`AttestationStatementValidator` and attestation statements trustworthiness validation to an implementation of
`CertPathTrustworthinessValidator`.

Since most sites don't require strict attestation statement validation
(https://www.w3.org/TR/webauthn-1/#sctn-no-attestation-security-attestation[WebAuthn Spec related topic] ),
WebAuthn4J provides `WebAuthnManager.createNonStrictWebAuthnManager` factory method
that returns an `WebAuthnManager` instance configured `AttestationStatementValidator` and
`CertPathTrustworthinessValidator` not to validate attestation statements.

If you are engaging an enterprise use case and strict authenticator verification is a requirement,
Use the constructor of the `WebAuthnManager` class and inject validators.

=== Attestation statement validation

Attestation statement validation is provided by the implementation of `AttestationStatementValidator` interface.
For each attestation statement format, corresponding validator classes are provided.
Please specify its list at the first argument of the constructor of `WebAuthnManager` class.
For example, if you would like to limit the supported format to `packed` only, add only
`PackedAttestationStatementValidator` to the `List`, and if you would like to support `packed` and `tpm` format,
make the `List` with `PackedAttestationStatementValidator` and `TPMAttestationStatementValidator`.

==== Attestation statement trustworthiness validation

Attestation statement trustworthiness validation has three patterns: certificate path validation, ecdaa validation, and
self attestation.
Certificate path validation is delegated via `CertPathTrustworthinessValidator` interface, and ECDAA is delegated via
`ECDAATrustworthinessValidator` interface. WebAuthn4J provides some `CertPathTrustworthinessValidator` implementations.
For example, `TrustAnchorCertPathTrustworthinessValidator` verifies trustworthiness by checking the attestation certificate
chains to the root certificate provided as `TrustAnchor` via `TrustAnchorResolver` interface.

==== Trust anchor resolution

`TrustAnchorResolver` interface is provided for `TrustAnchor` resolution.
WebAuthn4J provides a `TrustAnchorResolver` implementation `TrustAnchorResolverImpl`.
`TrustAnchorResolverImpl` delegates `TrustAnchor` fetching to `TrustAnchorsProvider` interface.
There are some `TrustAnchorsProvider` implementations - `KeyStoreTrustAnchorsProvider` is to fetch `TrustAnchor`s from
Java Key Store file, and `MetadataStatementsTrustAnchorsProvider` is to fetch them from
https://fidoalliance.org/specs/fido-v2.0-rd-20180702/fido-metadata-statement-v2.0-rd-20180702.html[metadata statement].

===== Trust anchor resolution using FIDO Metadata Service

WARNING: `webauthn4j-meta` module, which provides FIDO Metadata Statement handling is under experimental status.

FIDO Alliance offers FIDO Metadata Service, which provides metadata of authenticators.
`FidoMdsMetadataItemsProvider` is provided for utilizing the authenticator metadata from the service.
It can be used for `TrustAnchor` resolution by combining with `MetadataItemsMetadataStatementsProvider`.

===== Authenticator vulnerability announcement check using FIDO Metadata Service

Authenticator vulnerability announcement check is also possible with FIDO Metadata Service by utilizing
`FidoMdsMetadataValidator`. As it is an implementation of `CustomRegistrationValidator`, please refer
<<_./deep-dive.adoc#Custom validator registration,Custom validator registration>>.

=== Representation of an authenticator

WebAuthn4j provides `Authenticator` interface as a representation of an authenticator.

On registering the authenticator, you need to persist its representation by creating the instance implementing
`Authenticator` interface in your application manner because it is used afterwards on authentication verification.
It might be better to use credentialId as a search key for this persisted instance.

You can freely enhance the class implementing `Authenticator` interface in order to meet your application’s requirements.
For example, you can add the field for your application’s user to identify the authenticator.

=== What WebAuthn4J doesn't offer

In order to realize framework independence, WebAuthn4J intentionally scopes functions to WebAuthn Assertion / Attestation verification. Fetching parameters from HTTP request, issuing and saving Challenge in session, counter Value validation are not provided.
Please implement in your caller code. If you are using Spring Security, consider using Spring Security WebAuthn as it provides these implementations of authentication framework specific parts.

