Bug 208357 - [WebAuthn] "Found no credentials on this device" displayed when using roaming authenticator with Safari
Summary: [WebAuthn] "Found no credentials on this device" displayed when using roaming...
Status: RESOLVED WORKSFORME
Alias: None
Product: WebKit
Classification: Unclassified
Component: New Bugs (show other bugs)
Version: Safari Technology Preview
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Nobody
URL:
Keywords: InRadar
Depends on:
Blocks: 181943
  Show dependency treegraph
 
Reported: 2020-02-27 17:09 PST by sweeden
Modified: 2020-03-16 20:31 PDT (History)
2 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description sweeden 2020-02-27 17:09:26 PST
I used Firefox (v74) on Mac to register a FIDO credential with WebAuthn using a couple of different popular USB authenticators (Yubikey 5 and an eWBM GoldenGate). I understand Firefox is probably using CTAP1, and if I use attestation I noticed that a fido-u2f attestation format is returned. Regardless, a public key credential is provided and saved against the user account.

Later, using either generally available Safari 13.0.5 or Safari Tech Preview Release 101, when I try to use this credential in an allowCredentials list to perform an assertion flow, Safari reports in a dialog: "Found no credentials on this device" and I am unable to complete assertion. Both the original FF browser, and Chrome on the same Mac are able to use the credential to complete assertion.
Comment 1 sweeden 2020-02-27 17:20:36 PST
It appears I can actually complete authentication - that part is false in my original statement - however the error message displayed in the dialog is still something that should be addressed.
Comment 2 sweeden 2020-02-27 18:51:30 PST
Actually it doesn't matter what browser is used when the credential was registered - even on Safari itself. This msg "Found no credentials on this device" is displayed all the time. Seems like an odd message to display just because a roaming authenticator was used.
Comment 3 Radar WebKit Bug Importer 2020-02-29 13:06:37 PST
<rdar://problem/59921962>
Comment 4 Jiewen Tan 2020-03-16 20:30:52 PDT
It doesn't reproduce for me on ToT WebKit. Could you try the latest STP again? It will be better if you could specify the exact website you are using and upload a video.