1505106 - Implement ReauthenticateUser method for TouchID-enabled MacOS devices

Status: RESOLVED FIXED

(Core :: Security: PSM, enhancement, P1)

Description

[Matthew N. [:MattN]]

The intention was to support TouchID but from testing by coworkers it seems like only a password is supported.

Comment 1

[J.C. Jones [:jcj] (he/they)]

Confirmed, doing the authentication [1] test in the browser console doesn't work.

[1] https://searchfox.org/mozilla-central/source/security/manager/ssl/tests/unit/test_osreauthenticator.js#14

Comment 2

[J.C. Jones [:jcj] (he/they)]

Correct, only a password is supported. We'll need to write a separate implementation feature-gated on TouchID to get that support, as it's a separate API.

This will appear as another method in OSReauthenticator.cpp [1] that gets called if XP_MACOSX and we detect TouchID at runtime.

[1] https://searchfox.org/mozilla-central/rev/6e0e603f4852b8e571e5b8ae133e772b18b6016e/security/manager/ssl/OSReauthenticator.cpp#266

Comment 3

[J.C. Jones [:jcj] (he/they)]

Taking this.

Comment 4

[J.C. Jones [:jcj] (he/they)]

Attachment: Bug 1505106 - Support TouchID/FaceID for Reauthentication r?spohl

In Bug 1499846 we added support for OSX to do Keychain-based reauthentication.
On newer versions of OSX, it's possible to instead do TouchID/FaceID for bio-
metric reauthentication, with a fallback to Keychain.

This implements that functionality. There's no C++ interface to access the
LocalAuthentication framework, so it adds an Objective-C method called by the
existing OSReauthenticator methods to perform its work.

Comment 5

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/2b2777f72b09
Support TouchID/FaceID for Reauthentication r=spohl

Comment 6

[Razvan Maries]

https://hg.mozilla.org/mozilla-central/rev/2b2777f72b09

Comment 7

[Hani Yacoub, Desktop QA]

I am not sure how to verify bugs with Touch ID, we don't have any MacBook with Touch ID.

Comment 8

[J.C. Jones [:jcj] (he/they)]

I suppose one could verify no regressions w/o Touch ID. Otherwise I'd guess we need to accept no QA verification and leave that up to Web Payments if that is OK.

MattN: Thoughts?

Comment 9

[Matthew N. [:MattN]]

I think it's fine to rely on J.C.'s testing and bug reports for this.

Comment 10

[Gyula Palko[:gpalko]]

Removing the qe-verify flag, based on the previous comments.