Package com.thalesgroup.gemalto.fido2.client

Class Fido2Config

java.lang.Object
com.thalesgroup.gemalto.fido2.client.Fido2Config
public class Fido2Config extends Object
A global configuration class for the FIDO2 SDK.

The SDK is designed with secure defaults. This class provides a limited set of options for applications that need to customize certain security features or behaviors, such as rate limiting, logging, and TLS certificate pinning.

Since:
1.0.0

  • Constructor Summary

    Constructors
    Constructor
    Description
    Fido2Config()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    static void
    setAuthenticatorAaguid(String aaguid, VerifyMethod verifyMethod)
    Configures a custom AAGUID for enrollments performed with the specified verify method.
    static void
    setBaseLockoutDuration(int durationInSecs)
    Sets the base duration for the lockout penalty after too many failed verification attempts.
    static void
    setMaximumRetryCount(int maxRetryCount)
    Sets the maximum number of failed user verification attempts before the authenticator is locked.
    static void
    setSecureLog(com.thalesgroup.gemalto.securelog.SecureLog securelog)
    Sets a pre-configured secure logger instance for the SDK to use.
    static void
    setTlsCertificates(X509Certificate[] certificates)
    Sets the TLS certificates to be used for certificate pinning when communicating with the Relying Party.
    static com.thalesgroup.gemalto.securelog.SecureLog
    setUpSecureLog(com.thalesgroup.gemalto.securelog.SecureLogConfig config)
    Configures and initializes the secure logger for the SDK.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Constructor Details

    • Fido2Config

      public Fido2Config()

  • Method Details

    • setMaximumRetryCount

      public static void setMaximumRetryCount(int maxRetryCount)
      Sets the maximum number of failed user verification attempts before the authenticator is locked.

      This value can only be configured once per application runtime. Subsequent calls will be ignored.

      • Default value: 5
      • Minimum value: 1
      • Maximum value: 5
      Values outside the allowed range will be ignored.
      Parameters:
      maxRetryCount - The maximum number of retries.
      Since:
      1.0.0

    • setBaseLockoutDuration

      public static void setBaseLockoutDuration(int durationInSecs)
      Sets the base duration for the lockout penalty after too many failed verification attempts.

      The actual lockout duration increases exponentially with each subsequent lockout. This value can only be configured once per application runtime. Subsequent calls will be ignored.

      • Default value: 30 seconds
      • Minimum value: 30 seconds
      • Maximum value: 1800 seconds (30 minutes)
      Values outside the allowed range will be ignored.
      Parameters:
      durationInSecs - The base lockout duration in seconds.
      Since:
      1.0.0

    • setUpSecureLog

      public static com.thalesgroup.gemalto.securelog.SecureLog setUpSecureLog(@Nullable com.thalesgroup.gemalto.securelog.SecureLogConfig config)
      Configures and initializes the secure logger for the SDK.
      Parameters:
      config - The configuration for the secure logger.
      Returns:
      An instance of SecureLog, or null if the provided config is null.
      Since:
      1.2.0

    • setSecureLog

      public static void setSecureLog(@Nullable com.thalesgroup.gemalto.securelog.SecureLog securelog)
      Sets a pre-configured secure logger instance for the SDK to use.
      Parameters:
      securelog - A previously created SecureLog instance.
      Since:
      1.2.0

    • setTlsCertificates

      public static void setTlsCertificates(@Nullable X509Certificate[] certificates)
      Sets the TLS certificates to be used for certificate pinning when communicating with the Relying Party.

      This enhances security by ensuring the app communicates only with servers that have a trusted certificate. If this is not set, standard system trust validation will be used.

      Parameters:
      certificates - An array of X509Certificate to pin against.
      Since:
      1.9.0

    • setAuthenticatorAaguid

      public static void setAuthenticatorAaguid(@NonNull String aaguid, @NonNull VerifyMethod verifyMethod) throws Fido2Exception
      Configures a custom AAGUID for enrollments performed with the specified verify method.

      New enrollments using the given verify method will embed the provided AAGUID in their attestation data instead of the SDK's built-in default. Previously completed enrollments are unaffected by this configuration — existing credentials remain fully valid.

      The VerifyMethod.PLATFORM and VerifyMethod.NONE verify methods are not configurable. The platform AAGUID is always 00000000000000000000000000000000 as required by the FIDO2 specification.

      Warning: This method must be called before any FIDO2 operation (registration or authentication). The configuration is stored in memory for the lifetime of the process only — it is not persisted across process launches. This means it must be called on every launch of every process that performs FIDO2 operations. The recommended call site is during application startup, before initialising any Fido2Client instance.

      Parameters:
      aaguid - A 32-character lowercase hexadecimal string representing the AAGUID (e.g. "27ae41e4649b934ca495991b7852b855"). Must not be null. Dashes, braces, and uppercase letters are not accepted. All-zeros values are not accepted.
      verifyMethod - The verify method for which to apply the AAGUID override. Must be VerifyMethod.BIOMETRIC or VerifyMethod.PASSCODE.
      Throws:
      Fido2Exception - with Fido2ErrorCode.ERROR_INVALID_AAGUID if aaguid is null, not a valid 32-character lowercase hex string, or is all zeros.
      Fido2Exception - with Fido2ErrorCode.ERROR_NOT_ALLOWED if verifyMethod is VerifyMethod.PLATFORM or VerifyMethod.NONE.
      Fido2Exception - with Fido2ErrorCode.ERROR_UNSAFE_ENVIRONMENT_DETECTED if a debugger or hook is detected.
      Since:
      4.1.0