Bug 249751 – WebAuthn PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() does not account for iCloud Keychain sync enterprise policy

• Status: NEW
• Component: WebKit Misc.

A customer of ours using a MacBook Pro running macOS Ventura 13 has iCloud Keychain sync disabled via enterprise policy. When they attempted to register the platform authenticator using WebAuthn, with `"authenticatorAttachment": "platform"` specified in the options passed to `navigator.credentials.create()`, Safari shows the expected, "you must enable iCloud Keychain sync to use the platform authenticator" prompt. The customer was using a managed device, though, and had no option to enable iCloud Keychain sync. They could not continue with registration.

The issue I want to report here is that the only reason we allowed the customer to attempt to perform platform authenticator registration is because we queried `PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()` to see if a platform authenticator was available, and was told "yes, a UV platform authenticator is available." However, according to enterprise policy and platform authenticator restrictions introduced in macOS 13, the platform authenticator is NOT available because iCloud Keychain sync had been disabled. I believe `PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()` should take this into account, and return `false` when the platform authenticator CANNOT be used due to platform authenticator prerequisites not being fulfilled due to enterprise policy, user preference, etc...

And to clarify, I'm not suggesting that `isUVPAA()` say _why_ it's returning false, just to be willing to return `false` for situations in which the platform authenticator is in absolute terms present but is not truly available.

[Radar WebKit Bug Importer]

<rdar://problem/103747379>