Hello. Does WKWebView on Mac support FIDO2(webauthn)? We need to implement this in our app and ASWebAuthenticationSession API comes up in searches all the time as the only solution. Is this still the case? From my experiments ASWebAuthenticationSession on Mac doesn't provide best user experience - too much fiddling and odd behavior for an end user. F.e. user needs to click Open button from the browser window to pass token to the very same app which initiated the window and this is not very logical considering all the efforts to setup applink. Would appreciate an advice.

We are working on implementing FIDO2 with passkeys and its works fine in the consumer with Apple ID. On the Enterprise level we can't able to make it because corp device don't have option to enable Apple ID and its disabled by MDM as per policy. is there any alternate approach where corp device can use FIDO authentication without using Apple ID? thanks

I'm implementing passkeys by following the example from the Food Truck sample project. I have nearly everything working, but there's one problem. I'm using the AuthorizationController environment value and passing that to my login and register functions, but when I call authorizationController.performAutoFillAssistedRequest, I don't see or know of any way to cancel it, so if the user tries to type in their username instead of use the autofill suggestion, the second (non-autofill) request throws the error, The operation couldn’t be completed. Request already in progress for specified application identifier. I know that ASAuthorizationController has a cancel() function, but is there any way to do this with AuthorizationController?

I'm trying to implement passkeys in my app. I successfully get to the dialog in iOS simulator to register with a Passkey and I can also read the result and see all the right things in credentialRegistration.rawClientDataJSON. The one thing that's not working is when decoding the rawAttestationObject (which should be CBOR as I understand), I find all data defined in the spec (aaguid, credentialIdLength, credentialId) except for the credentialPublicKey! The rawAttestationObject basically ends after the credentialId. I see this both when decoding the rawAttestationObject manually as well as when using WebAuthn libraries on the server, which will give me an "Unexpected end of CBOR data" error. Any ideas why the rawAttestationObject does not contain the public key? For reference, here is the initialization of the Passkey request: let publicKeyCredentialProvider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: options.domain) let registrationRequest = publicKeyCredentialProvider.createCredentialRegistrationRequest(challenge: challenge, name: name, userID: userID) let authController = ASAuthorizationController(authorizationRequests: [ registrationRequest ]) authController.performRequests() And here is how I handle the result: case let credentialRegistration as ASAuthorizationPlatformPublicKeyCredentialRegistration: let rawAttestationObject = credentialRegistration.rawAttestationObject!.base64EncodedString() let credentialID = credentialRegistration.credentialID.base64EncodedString() let rawClientDataJSON = credentialRegistration.rawClientDataJSON.base64EncodedString() let response: PasskeysResponse = [ "attestationObject": rawAttestationObject, "credentialId": credentialID, "clientDataJson": rawClientDataJSON, ] Here is an example for a decoded attestation object: { "rpIdHash": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViYmW4=", "flags": { "userPresent": false, "userVerified": false, "backupEligibility": true, "backupState": true, "attestedCredentialData": true, "extensionData": false }, "signCount": 425116148, "aaguid": "20318e2d-77fa-f54d-bed7-ba15ccd3fade", "credentialId": "1B1KJf6uYF0AAAAAAAAAAAAAAAAAAAAAAAAAAAAUQW65BAqkeKqu97vbc0Se5R1F3Y+lAQIDJiABIVggtdSX2ZAHsBxU4ja1xP6hCZGUXgUCb6Ipau3stU8rrz4iWCBwhOBWOgwT4yKRnU1hA11thC8+CvjmrCkfq//648cwHg==", "credentialPublicKey": "" } As you can see, it looks all good except for the "credentialPublicKey": "" part.

I tried to use preferImmediatelyAvailableCredentials option in my sign in via Passkey process and expected to see this logic: If passkey isn’t available (for some reason, for example, user deleted it) the sign up modal sheet appears. But instead of this I got ‘Choose how you’d like in sign in’ sheet. As I understand, preferImmediatelyAvailableCredentials should allow me to fallback to sign up and skip this step but it doesn’t. My code is: func signIn(credId: String) { currentAuthController?.cancel() let securityKeyProvider = ASAuthorizationSecurityKeyPublicKeyCredentialProvider(relyingPartyIdentifier: domain) let publicKeyCredentialProvider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: domain) let assertionRequest = publicKeyCredentialProvider.createCredentialAssertionRequest(challenge: challengeData) let securityKeyRequest = securityKeyProvider.createCredentialAssertionRequest(challenge: challengeData) if let data = Data(base64urlEncoded: credId) { let cred = ASAuthorizationPlatformPublicKeyCredentialDescriptor(credentialID: data) assertionRequest.allowedCredentials = [cred] } let requests = [assertionRequest, securityKeyRequest] let authController = ASAuthorizationController(authorizationRequests: requests) authController.delegate = self authController.presentationContextProvider = self currentAuthController = authController authController.performRequests(options: .preferImmediatelyAvailableCredentials) }

Hi, so I'm trying to use security key authentication using physical keys via the native APIs documented on Apple's developer website but am running into errors I don't understand. The application runs on MacOS. The application is signed with an entitlement that contains the associated domain like so: <key>com.apple.developer.associated-domains</key> <array> <string>webcredentials:example.com?mode=developer</string> </array> I have tried with and without ?mode=developer. Here is the error I get: {"error":"The operation couldn’t be completed. The calling process does not have an application identifier. Make sure it is properly configured."} My application identifier is also configured in the .entitlements file. Here is a rough overview of what I'm trying to do (basically, the auth server I'm contacting provides a challenge, and I want to create an assertion and send it back for verification). Trying to replicate the example from the official docs. let options = try! JSONDecoder().decode(Request.self, from: options.data(using: .utf8)!).publicKey let securityKeyProvider = ASAuthorizationSecurityKeyPublicKeyCredentialProvider(relyingPartyIdentifier: options.rpId) let securityKeyRequest = securityKeyProvider.createCredentialAssertionRequest(challenge: options.challenge.decodeBase64Url()!) let platformProvider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: options.rpId) let platformKeyRequest = platformProvider.createCredentialAssertionRequest(challenge: options.challenge.decodeBase64Url()!) securityKeyRequest.userVerificationPreference = ASAuthorizationPublicKeyCredentialUserVerificationPreference(rawValue: options.userVerification ?? "preferred") securityKeyRequest.allowedCredentials = [] for credential in (options.allowCredentials ?? []) { let id = credential.id.decodeBase64Url()! let transports = ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor.Transport.allSupported let descriptor = ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor(credentialID: id, transports: transports) securityKeyRequest.allowedCredentials.append(descriptor) } securityKeyRequest.allowedCredentials = [] let authController = ASAuthorizationController(authorizationRequests: [platformKeyRequest, securityKeyRequest]) return run(authController: authController) Happy to provide more context if necessary. Thanks in advance!