WebAuthn.Net

The WebAuthn.Net.Storage.MySql package requires a specific database schema to store credential data. This implementation is intended for MySQL 8.0+; MySQL 5.7 is not supported.

Because this library is designed to be integrated into existing applications, you must decide how to apply these migrations (e.g., using Entity Framework, FluentMigrator, or manual scripts).

Critical Requirement: You must ensure a unique index exists on the combination of RpId, UserHandle, and CredentialId, as this combination uniquely identifies a public key.

CREATE TABLE `CredentialRecords` 
(
    `Id`                        binary(16)      NOT NULL,
    `RpId`                      varchar(256)    NOT NULL,
    `UserHandle`                varbinary(128)  NOT NULL,
    `CredentialId`              varbinary(1024) NOT NULL,
    `Type`                      int             NOT NULL,
    `Kty`                       int             NOT NULL,
    `Alg`                       int             NOT NULL,
    `Ec2Crv`                    int             NULL,
    `Ec2X`                       varbinary(256)  NULL,
    `Ec2Y`                       varbinary(256)  NULL,
    `RsaModulusN`               varbinary(1024) NULL,
    `RsaExponentE`               varbinary(32)   NULL,
    `OkpCrv`                    int             NULL,
    `OkpX`                       varbinary(32)   NULL,
    `SignCount`                 int unsigned    NOT NULL,
    `Transports`                json            NOT NULL,
    `UvInitialized`             tinyint(1)      NOT NULL,
    `BackupEligible`            tinyint(1)      NOT NULL,
    `BackupState`               tinyint(1)      NOT NULL,
    `AttestationObject`         longblob        NULL,
    `AttestationClientDataJson` longblob        NULL,
    `Description`               varchar(200)    NULL,
    `CreatedAtUnixTime`         bigint          NOT NULL,
    `UpdatedAtUnixTime`         bigint          NOT NULL,
    CONSTRAINT `PK_CredentialRecords` PRIMARY KEY (`Id`)
) CHARACTER SET = utf8mb4
  COLLATE = utf8mb4_0900_ai_ci;

CREATE UNIQUE INDEX `IX_CredentialRecords_UserHandle_CredentialId_RpId` ON `CredentialRecords` 
(
    `UserHandle`,
    `CredentialId`,
    `RpId`
);

CREATE UNIQUE INDEX `IX_CredentialRecords_CredentialId_RpId` ON `CredentialRecords` 
(
     `CredentialId`,
     `RpId`
);

When using WebAuthn.Net.Storage.SqlServer, you must implement a schema migration strategy (e.g., Entity Framework, FluentMigrator) to create the required tables.

Critical Requirements

1. Unique Indexes: You must create unique indexes on the combination of RpId, UserHandle, and CredentialId. This combination acts as the unique descriptor for the public key.
2. Data Types: The identifier generator produces sequential identifiers compatible only with the uniqueidentifier data type (passed as System.Guid in C#).
   • Warning: Do not use binary(16) for the primary key instead of uniqueidentifier, as this will cause significant performance degradation.
3. JSON Constraint: The Transports column must be valid JSON.

CREATE TABLE [CredentialRecords]
(
    [Id]                        uniqueidentifier NOT NULL,
    [RpId]                      nvarchar(256)    NOT NULL,
    [UserHandle]                varbinary(128)   NOT NULL,
    [CredentialId]              varbinary(1024)  NOT NULL,
    [Type]                      int              NOT NULL,
    [Kty]                       int              NOT NULL,
    [Alg]                       int              NOT NULL,
    [Ec2Crv]                    int              NULL,
    [Ec2X]                      varbinary(256)   NULL,
    [Ec2Y]                      varbinary(256)   NULL,
    [RsaModulusN]               varbinary(1024)  NULL,
    [RsaExponentE]              varbinary(32)    NULL,
    [OkpCrv]                    int              NULL,
    [OkpX]                      varbinary(32)    NULL,
    [SignCount]                 bigint           NOT NULL,
    [Transports]                nvarchar(max)    NOT NULL,
    [UvInitialized]             bit              NOT NULL,
    [BackupEligible]            bit              NOT NULL,
    [BackupState]               bit              NOT NULL,
    [AttestationObject]         varbinary(max)   NULL,
    [AttestationClientDataJson] varbinary(max)   NULL,
    [Description]               nvarchar(200)    NULL,
    [CreatedAtUnixTime]         bigint           NOT NULL,
    [UpdatedAtUnixTime]         bigint           NOT NULL,
    CONSTRAINT [PK_CredentialRecords] PRIMARY KEY ([Id])
);
ALTER TABLE [CredentialRecords]
    ADD CONSTRAINT [Transports should be formatted as JSON] CHECK (ISJSON(Transports) = 1);
CREATE UNIQUE INDEX [IX_CredentialRecords_UserHandle_CredentialId_RpId] ON [CredentialRecords] ([UserHandle], [CredentialId], [RpId]);
CREATE UNIQUE INDEX [IX_CredentialRecords_CredentialId_RpId] ON [CredentialRecords] ([CredentialId], [RpId]);

Follow these steps to execute the FIDO2 MDS3 tests using the conformance tools and the demo application:

1. Configure the Conformance Tools

1. Launch the FIDO Conformance Tools.
2. Select FIDO2 Server - MDS3 Tests from the test options.
3. In SELECT TESTS TO RUN, enable all available options.
4. In TESTS CONFIGURATION, enable all available options and specify your application URL (default: https://localhost:5000).
5. Click Download test metadata.
6. Extract the metadataStatements folder from the downloaded metadata.zip and move its contents to: demo/WebAuthn.Net.Demo.FidoConformance/ConformanceMetadata/MetadataStatements.

2. Set up the MDS3 Test Server

1. Click the MDS3 test server button.
2. In the Server endpoint field, enter your application address (default: https://localhost:5000).
3. Click Download root certificate. Place the resulting MDS3ROOT.crt in: demo/WebAuthn.Net.Demo.FidoConformance/ConformanceMetadata/RootCertificate.
4. Click SUBMIT. Download the 5 resulting file links and place them in: demo/WebAuthn.Net.Demo.FidoConformance/ConformanceMetadata/Jwt.

3. Execute the Test

1. Start the test application (see Starting the test application).
2. Once the application is running, return to the tools and press RUN.
3. Verify that all tests complete successfully.