Metadata | FIDO2 for ASP.NET

FIDO2 for ASP.NET supports the FIDO Authenticator Metadata Service V3 (MDS).
This allows a FIDO relying party to load metadata about certified FIDO authenticators to aid in authenticator attestation.

To configure the FIDO Metadata Service, call the AddFidoMetadataService extension method on the IFidoBuilder.

 services.AddFido(options =>
    {
       //Fido Configuration
    })
    .AddFidoMetadataService();

The FIDO Metadata Service can be customized by passing an FidoMetadataOptions action to the AddFidoMetadataService method.

Metadata Caching

AddFidoMetadataService registers ASP.NET Core HybridCache and caches the downloaded metadata blob for the duration configured by FidoMetadataOptions.MetadataCacheDuration.

HybridCache prevents multiple concurrent requests in the same application instance from downloading the metadata blob more than once. This protects against a startup race inside a single instance when multiple requests need metadata at the same time.

For load-balanced deployments, we recommend configuring a distributed cache provider for HybridCache, such as Redis or SQL Server. The FIDO Metadata Service is rate limited, and a distributed cache allows instances to share the downloaded metadata blob instead of each instance downloading its own copy.

services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = builder.Configuration.GetConnectionString("Redis");
});

services.AddFido(options =>
    {
       // Fido Configuration
    })
    .AddFidoMetadataService();

HybridCache does not provide a distributed startup lock between separate application instances. If several instances cold start at exactly the same time before the distributed cache has been populated, more than one instance may still call the FIDO Metadata Service. To reduce this risk, use a distributed cache, consider staggered deployments or metadata pre-warming, and enable embedded metadata fallback if your application must tolerate metadata service timeouts.

Embedded Metadata

The component includes a copy of the latest FIDO metadata available at the time of package release. You can configure this by calling the UseEmbeddedMetadata extension method.

Embedded metadata can also be used as a fallback if the FIDO Authenticator Metadata Service is unavailable or times out. This behavior can be enabled by setting the EmbeddedMetadataFallback property to true.

FidoMetadataOptions

MetadataCacheDuration: TimeSpan Duration for which metadata will be cached by HybridCache.
EmbeddedMetadataFallback: bool If true, metadata will fall back to an embedded version on retrieval timeout.
HttpMetadataTimeout: TimeSpan Maximum time to wait before embedded metadata fallback.

Previous Next