Looks like a security flow in ASCredentialProviderViewController Register a new Passkey on foo.example.com Now iOS 17 (RC) will suggest and permit to select the Passkey to login in bar.example.com, which is agains specs From specs: For example, given a Relying Party whose origin is https://login.example.com:1337, then the following RP IDs are valid: login.example.com (default) and example.com, but not m.login.example.com and not com. Also looks like a bug, in this method: func prepareInterfaceToProvideCredential(for credentialRequest: ASCredentialRequest) If I've registered my Passkey for RP foo.example.com and trying to login to bar.example.com (the bug). In ASCredentialRequest.credentialIdentity.serviceIdentifier.identifier is foo.example.com but I am trying to login to bar.example.com, from this we can't understand on what RP is this Passkey used and can't restrict the use of Passkey in case it is used on a wrong RP. P.S: iCloud Passkeys works as expected.

I suspect this is an issue with Google’s passkey implementation, but it might not be, and if there is a solution I suspect this post will be useful for all other third-party passkey providers encountering the same issue. I have implemented Passkeys in our password manger using the new APIs introduced in iOS17. Passkey attestation and assertion works as expected with every service we’ve tested that supports Passkeys (I.e Webauthn.io, GitHub, etc). However the only service that doesn‘t work is Google. I can create a passkey for Google using iCloud Keychain just fine, but for some reason, although my app successfully creates the passkey, Google is rejecting it. I suspect this is a security measure on Google’s side, but it will be a UX nightmare for users of third-party passkey managers on iOS 17, as they won’t be able to create or sign in with a passkey for Google (which will probably be the number 1 use-case for using passkeys). When using iCloud Keychain to create a passkey, unlike other services, I noticed that Google actually recognises that I’ve used iCloud Keychain to create the Passkey, and labels the Passkey with “iCloud Keychain”. Is Apple sending some additional identifying info in their attestation statement that I’m not sending? If not, how is Google able to identify the passkey provider (in this case “iCloud Keychain”) by name? Could it be that Google has somehow whitelisted iCloud Keychain for Passkey creation, while disallowing third-party providers? Assuming it is the latter, unfortunately there is no way to reach out to Google about this. I suspect Apple would need to advocate on the behalf of third-party providers running on apple platforms, that they be allowed to provide passkeys for Google sign in. Its a shame to hit this type of road block so close to the iOS 17 release candidate.

I have two logins for one website, so two different accounts with different email addresses. For both accounts I have stored a passkey for the login. If I now use the passkey for account 1 and login successfully, account 2 is selected for me the next time I would like to log in and I then have manually to select account 1 in order to log in with it again. To me it would make much more sense if the system would always use/suggest the last used account/passkey. My system: macOS Monterey Version 12.6.8 (21G725) Safari Version 16.6 (17615.3.12.11.3, 17615)

When trying to build an AR app to my Iphone 11 with Xcode (13.2.1) using Mac OS 12.1 the build fails. Codesign wants me to use the Apple Development keychain. No matter which password I use it fails.

It appears that this method from ASCredentialProviderViewController is not being called at all. I am unable to trigger it. Ref func prepareCredentialList(for serviceIdentifiers: [ASCredentialServiceIdentifier], requestParameters: ASPasskeyCredentialRequestParameters) I expected it to be triggered when RP has a list of allowCredentials, but I still get: override func prepareInterfaceToProvideCredential(for credentialRequest: ASCredentialRequest) Am I missing something?

Apple's passkeys page at - https://developer.apple.com/passkeys/ now says - Passkeys can now be synced using external providers What is that supposed to mean and how it can be implemented? Are there any APIs provided by the iOS SDK for the same?

Hi everyone! Will iOS platform authenticator have support for PRF passkeys extension? https://github.com/w3c/webauthn/wiki/Explainer:-PRF-extension As far as I know current implementation doesn't as we don't have access to private part of generated keys to perform some crypto operations

We are trying to implement the new feature that was introduced in iOS 17, Passkeys Autofill Provider. We've created a new 'AutoFill Credential Provider' target and embedded it into our host app. We've implemented the 'CredentialProviderViewController,' which is inherited from 'ASCredentialProviderViewController.' When we go to 'https://webauthn.io' to trigger the passkeys view, everything is working as expected when we press 'Register.' The function 'override func prepareInterface(forPasskeyRegistration registrationRequest: ASCredentialRequest)' is called, but... We know that we need to call 'self.extensionContext.completeRegistrationRequest(using:)' but we don't know how to construct the response. We didn't find any examples or explanations of how to use this API. Can someone help us with this? Thank you.

When passkey authentication failed, we need to use corresponding logic to handle user cancellation and no credential error respectively. Does Apple have a plan to use different errorcodes to distinguish these two types of errors? refer to : https://developer.apple.com/forums/thread/735867?answerId=762182022#762182022

Hi devs!!! Calling createCredentialRegistrationRequestWithChallenge returns the following error: Error Domain=NSCocoaErrorDomain Code=4097 "connection to service named com.apple.AuthenticationServicesCore.AuthenticationServicesAgent" UserInfo={NSDebugDescription=connection to service named com.apple.AuthenticationServicesCore.AuthenticationServicesAgent} What can be the potential reason?

I'm trying to implement passkeys in my app. I successfully get to the dialog in iOS simulator to register with a Passkey and I can also read the result and see all the right things in credentialRegistration.rawClientDataJSON. The one thing that's not working is when decoding the rawAttestationObject (which should be CBOR as I understand), I find all data defined in the spec (aaguid, credentialIdLength, credentialId) except for the credentialPublicKey! The rawAttestationObject basically ends after the credentialId. I see this both when decoding the rawAttestationObject manually as well as when using WebAuthn libraries on the server, which will give me an "Unexpected end of CBOR data" error. Any ideas why the rawAttestationObject does not contain the public key? For reference, here is the initialization of the Passkey request: let publicKeyCredentialProvider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: options.domain) let registrationRequest = publicKeyCredentialProvider.createCredentialRegistrationRequest(challenge: challenge, name: name, userID: userID) let authController = ASAuthorizationController(authorizationRequests: [ registrationRequest ]) authController.performRequests() And here is how I handle the result: case let credentialRegistration as ASAuthorizationPlatformPublicKeyCredentialRegistration: let rawAttestationObject = credentialRegistration.rawAttestationObject!.base64EncodedString() let credentialID = credentialRegistration.credentialID.base64EncodedString() let rawClientDataJSON = credentialRegistration.rawClientDataJSON.base64EncodedString() let response: PasskeysResponse = [ "attestationObject": rawAttestationObject, "credentialId": credentialID, "clientDataJson": rawClientDataJSON, ] Here is an example for a decoded attestation object: { "rpIdHash": "o2NmbXRkbm9uZWdhdHRTdG10oGhhdXRoRGF0YViYmW4=", "flags": { "userPresent": false, "userVerified": false, "backupEligibility": true, "backupState": true, "attestedCredentialData": true, "extensionData": false }, "signCount": 425116148, "aaguid": "20318e2d-77fa-f54d-bed7-ba15ccd3fade", "credentialId": "1B1KJf6uYF0AAAAAAAAAAAAAAAAAAAAAAAAAAAAUQW65BAqkeKqu97vbc0Se5R1F3Y+lAQIDJiABIVggtdSX2ZAHsBxU4ja1xP6hCZGUXgUCb6Ipau3stU8rrz4iWCBwhOBWOgwT4yKRnU1hA11thC8+CvjmrCkfq//648cwHg==", "credentialPublicKey": "" } As you can see, it looks all good except for the "credentialPublicKey": "" part.

As the description in the demo, if there is no credentials, will receive the same error code (ASAuthorizationErrorCanceled) as if the user canceled. In this case, Is there a way to distinguish whether the error is canceled by the user or no credentials? if authorizationError.code == .canceled { // Either the system doesn't find any credentials and the request ends silently, or the user cancels the request. // This is a good time to show a traditional login form, or ask the user to create an account. } else { // Another ASAuthorization error. // Note: The userInfo dictionary contains useful information. logger.error("Error: \((error as NSError).userInfo)") } }

I initiated the Passkey CTAP process after establishing an internet connection on my smartphone (authentication device) using Wi-Fi. Once the client PC and the smartphone established a TCP connection and were in the midst of the CTAP process, I attempted to switch the internet connection to a different Wi-Fi network or transition to mobile data. As a result, I was unable to log in with the Passkey. (There was no observable change on the client PC screen; it did not transition to a success/failure screen, leading me to believe that no packets were transmitted.) I initially thought that performing a network handover after the TCP connection might have caused the connection to be severed, resulting in the absence of packet transmission. However, I discovered that if I established the authentication device's internet connection using mobile data and then, in the middle of the CTAP process, turned off the mobile data to automatically switch back to Wi-Fi, the Passkey login process succeeded. What is the reason behind this outcome? Can you explain the technical factors that contribute to this behavior?

We are working on implementing FIDO2 with passkeys and its works fine in the consumer with Apple ID. On the Enterprise level we can't able to make it because corp device don't have option to enable Apple ID and its disabled by MDM as per policy. is there any alternate approach where corp device can use FIDO authentication without using Apple ID? thanks

Hi, Is it possible to use top level domain registered passkey(example.com) to authenticate against the subdomains (my.example.com)?

I'm implementing passkeys by following the example from the Food Truck sample project. I have nearly everything working, but there's one problem. I'm using the AuthorizationController environment value and passing that to my login and register functions, but when I call authorizationController.performAutoFillAssistedRequest, I don't see or know of any way to cancel it, so if the user tries to type in their username instead of use the autofill suggestion, the second (non-autofill) request throws the error, The operation couldn’t be completed. Request already in progress for specified application identifier. I know that ASAuthorizationController has a cancel() function, but is there any way to do this with AuthorizationController?

I keep getting the following error when trying to run Passkey sign in on macOS. Told not to present authorization sheet: Error Domain=com.apple.AuthenticationServicesCore.AuthorizationError Code=1 "(null)" The same piece of code is working as expected on iOS. Some more info: The association file and entitlements are correct and validated as everything is working on iOS. The app is built on SwiftUI and use the same codebase for macOS and iOS Validated that the presentation anchor is also correct on macOS because other SSO login works with the same presentation anchor. Not sure where the problem is. Followed https://developer.apple.com/documentation/authenticationservices/public-private_key_authentication/supporting_passkeys/ to get the integration.

For MacOS user accounts, can Passkey be used to login to desktop systems (i.e systems wo biometrics authentication; iMac, Mac mini, Studio, Pro ) accounts? If not available, is this part of the future roadmap?

I understand that during the CTAP process with a Passkey, a key agreement takes place when scanning the QR code and sending Bluetooth advertisements. Is the Diffie-Hellman algorithm used for the key agreement during this process?

Hi everyone, I guess this is a long shot but I thought I might ask. Is it possible for app clips to invoke Passkey Auth? In this example I'm designing a POC for a checkout flow where the 3DS challenge is triggering the Bank App Clip and allows the user to authenticate using passkey. Much appreciated!