Bitwarden Breaks Keycloak's Webauthn Support

[abueide]

Steps To Reproduce

1. Setup keycloak as an idp
2. Enable webauthn in one of your authentication / registration flows
3. Try to register a key with & without the bitwarden extension installed. Without, it works fine. With bitwarden extension you get this error:

Expected Result

Able to register passkeys via keycloak's webauthn api when using keycloak as an idp

Actual Result

Get an error

Security key registration result is invalid.
TypeError: Cannot read properties of undefined (reading 'authenticatorAttachment')

Screenshots or Videos

Additional Context

No response

Operating System

Windows, Linux

Operating System Version

No response

Web Browser

Chrome, Firefox, Brave

Browser Version

No response

Build Version

2023.10.2

Issue Tracking Info

• I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

[NovaSilentium]

Hello there!

I was able to reproduce this issue myself, and I have flagged this to our engineering team.

If you wish to add any further information/screenshots/recordings etc., please feel free to do so at any time - our engineering team will be happy to review these.

Thanks once again!

[trmartin4]

Hi @abueide! We have addressed this problem in #6799, which is scheduled to be in our next release of the browser extension.

[abueide]

Hi @abueide! We have addressed this problem in #6799, which is scheduled to be in our next release of the browser extension.

Awesome thanks for the update

[oxytu]

@djsmith85 @trmartin4 sorry, this issue is not resolved with release 2023.12. Still happens for my Keycloak instance with the same error as initially reported.

[agross]

@oxytu Confirmed to be broken with 2023.12.0 here, too.

[beposec]

@trmartin4 thanks for your work. But as the others say, its still broken. Can you try to reproduce this again?

[oxytu]

@djsmith85 merry christmas, first of all. Have you noticed the other comments above? The issue is still closed.

[oxytu]

@agross @beposec "Workaround" I found: just set a value for Authentication Attachment in your Keycloak Realm / Authentication settings / Webauthn.

Best regards

[agross]

@oxytu Thank you, it seems to be working with this setting. I set <Realm> | Authentication | Policies | Webauthn Passwordless Policy | Authenticator attachment to Cross platform and the Bitwarden dialog popped up during the registration process.

[djsmith85]

@djsmith85 merry christmas, first of all. Have you noticed the other comments above? The issue is still closed.

@oxytu Merry Christmas to you too. Changes from #6799 are going to be included in the 2024.1-release scheduled for mid next month.