Login without username not working

[pando85]

Discoverable Credentials seems to be failing. We want to be able to login in websites as GitLab or GitHub just pressing the passkey login button.

[pando85]

@forkline could you analyze this? We want the root cause and a proposal fix

[forkline-bot]

Root Cause Analysis

After analyzing the codebase, I found the root cause of the "Login without username not working" issue.

Root Cause

The issue is in the AuthenticatorOptions configuration in cmd/passless/src/authenticator.rs:303-316:

let options = AuthenticatorOptions {
    rk: true,
    up: true,
    uv: Some(true),
    plat: true,
    client_pin: None,              // PROBLEM 1: Should be Some(false)
    pin_uv_auth_token: Some(true),
    cred_mgmt: Some(true),
    bio_enroll: None,
    large_blobs: None,
    ep: None,
    always_uv: Some(true),         // PROBLEM 2: Requires UV but no PIN is set
    make_cred_uv_not_rqd: Some(true),
};

The problem chain:

1. always_uv: Some(true) requires user verification for ALL MakeCredential and GetAssertion operations
2. client_pin: None indicates no PIN support is available
3. The authenticator has no PIN set, so is_protected_by_uv() returns false
4. In soft-fido2-ctap's MakeCredential/GetAssertion handlers (Step 6), when always_uv is true but the authenticator is not protected by UV, it returns StatusCode::OperationDenied
5. This blocks ALL credential operations, including discoverable credential authentication

Why This Breaks Passkey Login

When a user clicks "Sign in with passkey" on GitHub/GitLab:

1. Browser sends GetAssertion without an allowList (discoverable credential flow)
2. The soft-fido2 handler hits the always_uv check in Step 6
3. Since no PIN is set and client_pin is None, OperationDenied is returned
4. Authentication fails before the request_up/request_uv callbacks are even invoked

Proposed Fix

Change the configuration to allow operations without UV when no PIN is set:

let options = AuthenticatorOptions {
    rk: true,
    up: true,
    uv: Some(true),
    plat: true,
    client_pin: Some(false),       // FIX 1: Indicate PIN is supported but not set
    pin_uv_auth_token: Some(true),
    cred_mgmt: Some(true),
    bio_enroll: None,
    large_blobs: None,
    ep: None,
    always_uv: Some(false),        // FIX 2: Don't require UV when no PIN is set
    make_cred_uv_not_rqd: Some(true),
};

Explanation:

• client_pin: Some(false) tells the browser that PIN is a supported feature but not currently configured
• always_uv: Some(false) allows operations to proceed without UV, relying on the notification callback for user presence

The existing request_up callback in passless already handles user verification via desktop notifications, so this change will allow the authentication flow to proceed while still providing user interaction.

Alternative Fix (if UV should be required)

If UV via notification should be required, the fix would be to ensure soft-fido2 recognizes the callback-based UV as a valid UV method. This would require changes in the soft-fido2 library to check has_built_in_uv_enabled() in the always_uv logic.

Would you like me to implement the proposed fix?

[pando85]

@forkline nice catch! prepare a PR, I will test it!

[forkline-bot]

PR created: #158

Changes:

• client_pin: None → Some(false) (PIN supported but not set)
• always_uv: Some(true) → Some(false) (allow operations via notification-based UP)

[pando85]

@forkline that didn't work. Could you make a deeper analysis? probably also check soft-fido

[forkline-bot]

Root Cause Analysis Complete

PR Created: #159

Root Cause

The issue was in the AuthenticatorOptions configuration in cmd/passless/src/authenticator.rs. The combination of:

1. uv: Some(true) - Claimed built-in UV capability (biometrics)
2. always_uv: Some(true) - Required UV for all operations
3. client_pin: None - No PIN support indicated

This caused is_protected_by_uv() in soft-fido2-ctap to return true, but there's an inconsistency:

• GetAssertion has auto-UV logic (Step 5.4) that sets options.uv = true when has_built_in_uv_enabled() is true
• MakeCredential lacks this auto-UV logic - it returns OperationDenied when browser doesn't explicitly request UV

Since passless uses desktop notifications (via request_up callback) rather than true biometric UV, claiming uv: Some(true) was incorrect.

The Fix

let options = AuthenticatorOptions {
    uv: None,                      // Don't claim built-in UV
    client_pin: Some(false),       // PIN supported but not set  
    always_uv: None,               // Don't require UV
    // ... other options unchanged
};

This allows:

• Discoverable credential flows to work via the request_up callback
• No UV requirement checks blocking operations
• User presence still verified via desktop notifications

[pando85]

@forkline-dev[bot] could you analyze soft-fido and see what are we lacking from the specs