StrongKey / fido2

Open-source FIDO server, featuring the FIDO2 standard. https://demo4.strongkey.com/getstarted/#/openapi/fido
202 stars 59 forks source link

I have a problem with iOS15. FIDO2 Example #233

Closed Saebyeol98 closed 1 year ago

Saebyeol98 commented 1 year ago

Hello Strongkey Fido2 Developer @push2085 @arshadnoor

I am implementing fido2 with your skfs v4.8.0 server. I made Apple IOS FIDO2 Authenticator from your example

It's works very good in IOS16 However, if I build the same code in ios15 and use it, the error occurs as below.

[Authorization] ASAuthorizationController credential request failed with error: Error Domain=com.apple.AuthenticationServices.AuthorizationError Code=1004 "(null)" Error Description: The operation couldn’t be completed. Syncing platform authenticator must be enabled to register a platform public key credential; this can be enabled in Settings > Developer. Error: ["NSLocalizedFailureReason": Syncing platform authenticator must be enabled to register a platform public key credential; this can be enabled in Settings > Developer.]

In the example that you posted, I saw that it says it's okay with iOS15. image

However, under the current code, it is not available to the public and can only be used on devices with developer mode enabled. Is there any solution to this?

I look forward to your help. Thank you.

mansibudhiraja commented 1 year ago

Hi @Saebyeol98,

While StrongKey iOS Demo does work on iOS 15 and up, the Passkey API which it relies on is only available to the general public from iOS 16 and up and that's why it works for iOS16 for the end users.

For iOS 15 and less, passkeys were enabled for browser based applications. However, for native apps in iOS 15 and less, you need to enable Passkey by enabling the developer mode in order to use them in your applications.

However, StrongKey FIDO Server(SKFS) can still be used on iOS 15 and less native apps through the browser. For that you will have to use a ASWebAuthenticationSession API to open a browser sheet in your app, complete the FIDO Authentication and return the JWT from SKFS to your application using a callback URL.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">

iOS 15 and less iOS 16 and above
Native apps Browser based applications Both browser and native apps
Passkey: enabled only in developer mode
Attestation: None
Passkey: enabled
Attestation: Apple Attestation
Passkey : enabled
Attestation: None
Security Key Security key: whatever attestation that security key provides Security key: whatever attestation that security key provides

Hope this helps !