{"action":"created","issue":{"url":"https://api.github.com/repos/eBay/UAF/issues/5","repository_url":"https://api.github.com/repos/eBay/UAF","labels_url":"https://api.github.com/repos/eBay/UAF/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/eBay/UAF/issues/5/comments","events_url":"https://api.github.com/repos/eBay/UAF/issues/5/events","html_url":"https://github.com/eBay/UAF/issues/5","id":118504809,"number":5,"title":"AppID/FaceID handling on client app side","user":{"login":"levangongPayPal","id":10441380,"avatar_url":"https://avatars.githubusercontent.com/u/10441380?v=3","gravatar_id":"","url":"https://api.github.com/users/levangongPayPal","html_url":"https://github.com/levangongPayPal","followers_url":"https://api.github.com/users/levangongPayPal/followers","following_url":"https://api.github.com/users/levangongPayPal/following{/other_user}","gists_url":"https://api.github.com/users/levangongPayPal/gists{/gist_id}","starred_url":"https://api.github.com/users/levangongPayPal/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/levangongPayPal/subscriptions","organizations_url":"https://api.github.com/users/levangongPayPal/orgs","repos_url":"https://api.github.com/users/levangongPayPal/repos","events_url":"https://api.github.com/users/levangongPayPal/events{/privacy}","received_events_url":"https://api.github.com/users/levangongPayPal/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-11-24T00:23:34Z","updated_at":"2016-04-29T14:43:32Z","closed_at":null,"body":"From the UAF protocol spec (section 3.1.3.1 \"Dictionary OperationHeader Members\"), the appID should be handled as follows:\r\n- If the element is missing or empty in the request, the FIDO UAF Client must set it to the FacetID of the caller.\r\n- If the appID present in the message is identical to the FacetID of the caller, the FIDO UAF Client must accept it.\r\n- If it is an URI with HTTPS protocol scheme, the FIDO UAF Client must use it to load the list of trusted facet identifiers from the specified URI. The FIDO UAF Client must only accept the request, if the facet identifier of the caller matches one of the trusted facet identifiers in the list returned from dereferencing this URI.\r\n\r\nI propose to bring the behaviour of the Android client closer to the above.\r\nIn particular, the getUafMsgRegRequest( ) method (in Reg.java) will need some edits since, right now, it erases the incoming value (from the server) to put its FacetID.\r\nI'll create some code proposal to discuss this."},"comment":{"url":"https://api.github.com/repos/eBay/UAF/issues/comments/215740484","html_url":"https://github.com/eBay/UAF/issues/5#issuecomment-215740484","issue_url":"https://api.github.com/repos/eBay/UAF/issues/5","id":215740484,"user":{"login":"emersonmello","id":9929199,"avatar_url":"https://avatars.githubusercontent.com/u/9929199?v=3","gravatar_id":"","url":"https://api.github.com/users/emersonmello","html_url":"https://github.com/emersonmello","followers_url":"https://api.github.com/users/emersonmello/followers","following_url":"https://api.github.com/users/emersonmello/following{/other_user}","gists_url":"https://api.github.com/users/emersonmello/gists{/gist_id}","starred_url":"https://api.github.com/users/emersonmello/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/emersonmello/subscriptions","organizations_url":"https://api.github.com/users/emersonmello/orgs","repos_url":"https://api.github.com/users/emersonmello/repos","events_url":"https://api.github.com/users/emersonmello/events{/privacy}","received_events_url":"https://api.github.com/users/emersonmello/received_events","type":"User","site_admin":false},"created_at":"2016-04-29T14:43:32Z","updated_at":"2016-04-29T14:43:32Z","body":"Hi,\r\n\r\nA simple idea about that (just the first 4 lines). These trustedIDs URLs are statically defined in `facets()` method in `org.ebayopensource.fidouaf.res.FidoUafResource` class ([FIDO UAF Demo Server](https://github.com/eBay/UAF/tree/master/fidouaf)). So, Android developers need to be aware to put their application signature there.\r\n\r\n ```\r\nString urlFacetIds = ((JSONObject) reg.get(0)).getJSONObject(\"header\").getString(\"appID\");\r\nString trustedFacets = this.getTrustedFacets(urlFacetIds); // i.e. Curl.getInSeparateThread(url)\r\nboolean appIdIsATrustedFacet = trustedFacets.toLowerCase().contains(appId.toLowerCase());\r\nif (appIdIsATrustedFacet){\r\n  ((JSONObject) reg.get(0)).getJSONObject(\"header\").put(\"appID\", appId);             \r\n  JSONObject uafMsg = new JSONObject();\r\n  uafMsg.put(\"uafProtocolMessage\", reg.toString());\r\n  return uafMsg.toString();\r\n}\r\n```"}}