-
Notifications
You must be signed in to change notification settings - Fork 26
Test item GetAssertionEmptyUserIdTest #90
Comments
Thanks for opening the specification issue. We can follow up here after the discussion on the specification. |
Another question, shouldn't this test case (i.e. GetAssertionEmptyUserIdTest ) use rk=true in makeCred command or normal authenticator (w/o force to create rk) won't return any user data in getAssert response. |
Good point, |
For this test case after related information from ctap2/webauth, I think the exepected reuslts should be
|
I can only change this test to the changed behaviour after confirming it doesn't break Windows support. At the moment, this tool is used to test firmware releases, so I have to test what actually works, even if it contradicts the specification. |
WebAuthn adapted just now: |
I didn't test so many fido2 test servers which are for test purpose only. At least I didn't encounter this issue on mainstream websites and main test server webauthntest.azurewebsites.net I used. So I'm still thinking if authenticators do need to apply this kind of workaround behavior for this issue (i.e. not return user info with empty user.id). |
May I ask you to test on https://webauthn.me/ on a Windows 10, with UV being turned on? |
I don't see any problem when testing on https://webauthn.me/ and this doesn't use empty user.id in create(). |
I wanted to get an ATKey.pro to get to the bottom of this, but Amazon doesn't ship it to Europe it seems. I assume this is one of the device I could use to reproduce? Any other way to get one of them? |
We can send you one to Europe, please contact jenny.hsu@authentrend.com with your address and I have notify her this request from @kaczmarczyck. But if the issue you want to reproduce is "Cannot make credential with an empty user ID." I can also reproduce this behavior with Yubikeys and the log here also show this error. |
Thanks, email is out! Just making sure, and for documentation porpuses: For reproducing on https://webauthn.me/, you have to be on Windows 10 and your authenticator needs to be set up with UV. |
I test on Windows 10 20H2(19042.685) with MS Edge 87.0.664.60, I use my authenticator with built-in UV and I don't see any problem or and special parts related to this issue. Do you mean under https://webauthn.me/debugger ? But the user.id here still can't be set to empty or any else. |
I'll debug locally (after Christmas) and come back to you. Thanks so far for the detailed information! |
Update: We still have the same behaviour for OpenSK on Windows for webauthn.me with UV. We can leave this issue open for tracking, but I think it currently a good compromise between specification and working in the real world. |
https://github.com/fido-alliance/fido-2-specs/pull/963
Although fido2 spec says empty account identifier is valid
but can't be returned in get()
, this case makes authenticator need to save some useless data...Supplement on Nov-25
I can't find the string to say
but can't be returned in get()
in spec.The text was updated successfully, but these errors were encountered: