1893629 - Infinite loop when trying to log into Okta with a key that has a PIN

Status: RESOLVED DUPLICATE of bug 1908603

(Core :: DOM: Web Authentication, defect, P3)

Description

[msirringhaus]

I am not sure this is a bug on Firefox-side, but I'm filing this issue to have a paper trail. And maybe we'll need a workaround anyways.

What happens on Linux with Okta (I only have access to one instance, not sure if this happens on Okta in general):

1. Register security key with a PIN (works fine)
2. Log out and try logging back in
3. Enter Username and PW
4. Firefox prompts to connect a security key
5. Plug it in, then Firefox prompts to enter the PIN
6. Enter PIN, hit Ok
7. Firefox prompts for the PIN again, and Okta says "operation aborted" in the background
8. Repeat as long as you want

From my initial investigation, it seems to me that the operation gets aborted, before the finalized GetAssertion-command is sent back to the device.
The PIN is getting successfully used to establish the PinUvAuthToken, however the following GetAssertion-command returns with Error issuing command: CommandError: Unexpected code: KeepaliveCancel.
The abort seems to stem from another login-request that causes the ongoing request to cancel and restart the whole process.

Maybe the PIN-prompt, which sets the webpage 'inactive', causes the login-page to re-issue the sign-request, once it becomes active again, thus causing the ongoing request to stop.

Comment 1

[msirringhaus]

Forgot to mention: Logging in with a key (even the same key) without PIN-protection works fine.

Comment 2

[John Schanck [:jschanck]]

Can you get a regression range with mozregression?

Comment 3

[msirringhaus]

This has been broken ever since auth-rs landed CTAP2.0/PIN support.

In older versions, it doesn't run into an infinite loop, though. It only aborts the operation after entering the PIN (same as the newer versions, but it doesn't restart the PIN-prompt).

Also, if the operation gets aborted, and I hit the "Retry"-button on the webpage, it all of a sudden works. On newer versions with the infinite loop, I have to click "Cancel" in the PIN-dialog and then hit the "Retry"-button, to make it work. Which makes me think it's mostly a problem on the JS-side of the webpage itself.

Question is, if we should handle this differently, as Chromium works fine.

Comment 4

[John Schanck [:jschanck]]

I wasn't able to reproduce this on the Okta instance that I have access to.

Comment 5

[msirringhaus]

Bug 1908603 pinpointed the underlying problem. Closing in favor of that one.