Bug 249751
| Summary: | WebAuthn PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable() does not account for iCloud Keychain sync enterprise policy | ||
|---|---|---|---|
| Product: | WebKit | Reporter: | Matthew Miller (Cisco) <matthew> |
| Component: | WebKit Misc. | Assignee: | Nobody <webkit-unassigned> |
| Status: | NEW | ||
| Severity: | Normal | CC: | pascoe, webkit-bug-importer |
| Priority: | P2 | Keywords: | InRadar |
| Version: | Safari 16 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
Matthew Miller (Cisco)
A customer of ours using a MacBook Pro running macOS Ventura 13 has iCloud Keychain sync disabled via enterprise policy. When they attempted to register the platform authenticator using WebAuthn, with `"authenticatorAttachment": "platform"` specified in the options passed to `navigator.credentials.create()`, Safari shows the expected, "you must enable iCloud Keychain sync to use the platform authenticator" prompt. The customer was using a managed device, though, and had no option to enable iCloud Keychain sync. They could not continue with registration.
The issue I want to report here is that the only reason we allowed the customer to attempt to perform platform authenticator registration is because we queried `PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()` to see if a platform authenticator was available, and was told "yes, a UV platform authenticator is available." However, according to enterprise policy and platform authenticator restrictions introduced in macOS 13, the platform authenticator is NOT available because iCloud Keychain sync had been disabled. I believe `PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable()` should take this into account, and return `false` when the platform authenticator CANNOT be used due to platform authenticator prerequisites not being fulfilled due to enterprise policy, user preference, etc...
And to clarify, I'm not suggesting that `isUVPAA()` say _why_ it's returning false, just to be willing to return `false` for situations in which the platform authenticator is in absolute terms present but is not truly available.
| Attachments | ||
|---|---|---|
| Add attachment proposed patch, testcase, etc. |
Radar WebKit Bug Importer
<rdar://problem/103747379>