1907531 - Can't create a passkey in a password manager on Android if resident key is not required

Status: RESOLVED FIXED

(Core :: DOM: Web Authentication, defect, P3)

Description

[Carlos]

I have tried to test the support for Passkeys on the latest Firefox Build. More specifically I'm interested in the support for Third Party Password Managers.

Scenario:

1. Make sure a third party password manager is set up as an autofill provider and passkey provider in the system (Phone Settings).
2. Open the Firefox browser.
3. Navigate to https://webauthn.io
4. Try to register a passkey.

Expectations:

• The CredentialManager calls the default Credential provider (third party password manager) and allows to generate a passkey.

What happened:

• The Google Password Manager appears.

However, if I try to authenticate with a passkey, then the proper credential provider is invoked.

I have been able to replicate this behaviour with many password managers (Proton Pass, 1Password...)
Tested in Firefox Stable 128 and Firefox Beta 128.0b9, both in an Android 14 emulator, a Pixel 7a with Android 14, and on a Samsung Galaxy A14 with Android 14.

Comment 1

[florian]

I can confirm the same issue with Firefox Stable 128 on Samsung S24 Ultra.

Comment 2

[David]

Pixel 7 Pro - same behaviour

Comment 3

[Makoto Kato [:m_kato]]

Current implementation is that we use Credential manager when "Discoverable Credential" is required. Default of webauthn.io is preferred.

Comment 4

[[e-mail]]

I can confirm on Firefox nightly 130.0a1.

Comment 5

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:jschanck, could you have a look please?

For more information, please visit BugBot documentation.

Comment 6

[Gunnar André Saxvik-Lilleaasen]

(In reply to Makoto Kato [:m_kato] from comment #3)

Current implementation is that we use Credential manager when "Discoverable Credential" is required. Default of webauthn.io is preferred.

When it's set to preferred, I get the "old" dialog which only supports Google Password Manager and not third-party applications. I assume this is a bug, and that preferred should use the Credential Manager the same way as if it is set to required?

Comment 7

[dofficialgman]

Same issue here. I hope this bug can be resolved soon as many users will be switching over to firefox from chromium based browsers due to manifest v2 removal.

Comment 8

[yoyo930021]

I try to test about this.

1. Maybe this checker need to change from !authenticatorSelection.getString("residentKey", "").equals("required") to authenticatorSelection.getString("residentKey", "").equals("discouraged")
   https://hg.mozilla.org/integration/autoland/file/7095d3bca694f62a308c408848f706b7a1e9a8d2/mobile/android/geckoview/src/main/java/org/mozilla/gecko/WebAuthnCredentialManager.java#l139

2. In Chromium, it will have two default provider.
   https://chromium.googlesource.com/chromium/src/+/refs/heads/main/components/webauthn/android/java/src/org/chromium/components/webauthn/cred_man/GpmCredManRequestDecorator.java#58

Comment 9

[Michel Le Bihan]

@m_kato why are you only using Credential Manager when residentKey is set to required instead of always attempting to use it and falling back to GMS if it is not available?

Comment 10

[Makoto Kato [:m_kato]]

When implementing CM support, most 3rd party providers aren't available yet. So I didn't know whether these providers supported "preferred".
(First version of some credential managers crashes with some unknown parameters. So I thought it was better to disable without required.) But I guess that we can allow CM even if "preferred" now.

Comment 11

[Michel Le Bihan]

Do you remember which versions were affected by this issue?

Comment 12

[Makoto Kato [:m_kato]]

Although I don't know why you ask version (Android? Firefox?), I doesn't have strong reason not to allow "preferred" for credential manager provider support.

Comment 13

[Makoto Kato [:m_kato]]

(And when we had implemented credential manager support in GeckoView, Chrome's support was completed yet. But Chrome supports it now. So I think that 3rd party provider has better credential manager support.)

Comment 14

[Michel Le Bihan]

Attachment: Bug 1907531 - Also use Credential Manager on Android when RK is preferred. r=jschanck,m_kato

Comment 15

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/19d5b3f77f42
Also use Credential Manager on Android when RK is preferred. r=jschanck,m_kato,geckoview-reviewers

Comment 16

[Cristina Horotan [:chorotan]]

https://hg.mozilla.org/mozilla-central/rev/19d5b3f77f42