FIDO Alliance tests

[ranierimazili]

Hello,

The Open Finance Brasil (the biggest Open Finance ecosystem in the world) has approved the usage of FIDO protocol to authorize payments directly on wallet.
Google Wallet is the first use case already approved and you can see a demo on the GIF below:

But, the banks can use only FIDO Alliances approved providers.
The only open source provider that's already approved I could see is line server and it's a Java alternative.

To pass the FIDO tests, is necessary to create a REST project, providing some API's that uses the fido server.
I'm thinking on start this project, but first would like to see if anyone has started it before to not duplicate the efforts.

Thanks

[JamesCullum]

That sound's like a great idea! Maybe there is an OpenAPI spec that we can use, and implement via our backend?

[ranierimazili]

Yes, there's: https://github.com/fido-alliance/conformance-test-tools-resources/blob/main/docs/FIDO2/Server/Conformance-Test-API.md#registration

I started the implementation and I just passed the the first block (of total of 6 blocks).

I'll need some help to solve protencial bugs that maybe the tests will find because unfortunatelly I still don't understand the FIDO protocol so deply to solve it myself.
For each problem, do you prefer that I create a new issue or can I post all of them directly on this thread?

In a future comment (maybe today) on this thread I'll post the instructions to perform the tests and the repo where I'm building the conformance suite to fido2-lib.

[JamesCullum]

Maybe it's the easiest to simply do a fork where you implement this, and we link to it? Depending on how much overhead we need to make this testable for the compliance.

Then we can do the tracking in the issue tracker of the fork.