Passwordless

[zealous yew]

I am unable to get passwordless login with WebAuthn to work. I have followed the short guide in the documentation but I always get a "denied". It is only the Passwordless flow that gives this issue. The same WebAuthn as part of the default authentication flow works fine.

[fluid forum]

not working for me as well after the latest updates

(It was working before)

2023.1.1 broke them

2023.1.0 works

https://github.com/goauthentik/authentik/issues/4527 I opened an issue here

[tardy pebble]

You were saying? https://github.com/goauthentik/authentik/issues/3847

[fluid forum]

I think that's a different issue

[tardy pebble]

I'm just saying that it hasn't been working for ages. :D

[fluid forum]

in my case it was working perfectly until 2023.1.1 🥲

[tardy pebble]

Did you try 2023.1.2?

[fluid forum]

yep, broken on that too

[tardy pebble]

There were stage changes between those versions...

If only that was handled in a test... to make sure it doesn't break

[fluid forum]

yeah tests are a must to implement in a software like this

[tardy pebble]

There are, but coverage is not the greatest.

@bronze plaza Is this a different issue to mine?

[fluid forum]

in my issue it seems that it's the flow that got broken, there are no console errors (and I'm using macOS/chrome passkeys)

[tardy pebble]

You mean browser console?

[fluid forum]

yep

docker logs do not complain about errors as well (as you can see in the issue)

[tardy pebble]

Maybe check the flow's settings.

[fluid forum]

downgrading to 2023.1.0 makes login via passwordless work again btw

[tardy pebble]

It doesn't.

[fluid forum]

it does in my case

I've been using passwordless login for months

[tardy pebble]

My problem is somehow related to Authentik being unable to properly save the things needed to the key and thus it doesn't detect it properly on login and no, doesn't matter which platform I try on (mac, windows, linux)

[fluid forum]

I think your issue is different than mine

[tardy pebble]

It may be, but similar ish in the aspect that it doesn't work. :D

[fluid forum]

oh that absolutely 😂

[tardy pebble]

And by passkey do you mean what exactly?

[fluid forum]

https://fidoalliance.org/passkeys/

[tardy pebble]

Ah, so the Apple built-in thing.

[fluid forum]

they are not apple exclusive anymore 😛

https://android-developers.googleblog.com/2022/10/bringing-passkeys-to-android-and-chrome.html

(login fails on chrome too, so it's not a client issue)

90% it's a server side problem

[tardy pebble]

Hmm, and the annoying thing is that even troubleshooting these kinds of bugs are beyond frustrating as the API (WebhAuth API that is) will not really tell you much about why it failed.

Hmm, could the issue just be Firefox? :D

[fluid forum]

have you tried with another browser?

[tardy pebble]

Yes, Safari on Mac.

[fluid forum]

also small note: 2fa with passkeys works fine, it's the passwordless login only that does not work

[tardy pebble]

Also Chrome and Safari seems to be the only to ask for my Yubikey's PIN for WebAuth. :D

Oh hey, in Chrome it might work if it actually worked:

:D

[fluid forum]

try to downgrade to the 2023.1.0 version

it should work there

[tardy pebble]

But downgrading is not supported by database migrations.

[fluid forum]

downgrading "works" in this case

or make a backup for testing

[tardy pebble]

Well, cannot downgrade as I need the changes in 2023.1.2 :)

[fluid forum]

ops xD

[bronze plaza]

The fix itself is pretty simple, but it's one of those cases that didn't have full test coverage, so it wasn't obvious when the bug was introduced https://github.com/goauthentik/authentik/commit/68058fb2ae22c04c590fea7c5c5f705f5bb6fc14

[fluid forum]

Thank you for the so much fast fix!!

[bronze plaza]

there's no major new things in the beta currently so it's safe to upgrade to the beta

[tardy pebble]

You were saying?

[bronze plaza]

will be fixed on the next beta build

[tardy pebble]

It seems I had quite a few dupplicate prompts.