Discoverable Credentials viewing added#417
Discoverable Credentials viewing added#417AdityaMitra5102 wants to merge 4 commits intoNitrokey:mainfrom
Conversation
robin-nitrokey
left a comment
There was a problem hiding this comment.
Thank you for the PR! Unfortunately it does not work for me with my Nitrokey Passkey:
8761 ERROR nitrokeyapp.settings_tab.worker Failed to enumerate discoverable credentials
Traceback (most recent call last):
File "/home/robin/reps/nitrokey-app2/nitrokeyapp/settings_tab/worker.py", line 82, in run
rp_list= list(cred_man.enumerate_rps())
~~~~~~~~~~~~~~~~~~~~~~^^
File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/credman.py", line 166, in enumerate_rps
first = self.enumerate_rps_begin()
File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/credman.py", line 148, in enumerate_rps_begin
return self._call(CredentialManagement.CMD.ENUMERATE_RPS_BEGIN)
~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/credman.py", line 127, in _call
return self.ctap.credential_mgmt(**kwargs)
~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/base.py", line 508, in credential_mgmt
return self.send_cbor(
~~~~~~~~~~~~~~^
cmd,
^^^^
args(sub_cmd, sub_cmd_params, pin_uv_protocol, pin_uv_param),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/base.py", line 273, in send_cbor
raise CtapError(status)
fido2.ctap.CtapError: CTAP error: 0x33 - PIN_AUTH_INVALID
I think the PIN token is missing the credential management permission.
The authenticator verifies that the pinUvAuthToken has the cm permission and no associated permissions RP ID. If not, return CTAP2_ERR_PIN_AUTH_INVALID.
You can refer to the implementation of the nitropy fido2 list-credentials command in pynitrokey for an example, especially the permissions argument for get_pin_token:
Co-authored-by: Robin Krahl <robin@nitrokey.com>
|
Thanks for the review. I have modified the implementation to match that of 'nitropy fido list-credentials'. Removed direct accessing of the RP ID hash and user objects with CBOR indexes and now using the abstractions provided in the CredMan module. Added Credman permissions for pin token. The problem arose in the last commit because the key I am using to test (not exactly a Nitrokey) still allows the deprecated/superseded getPinToken function without the permissions. |
Partially tested due to the unavailability of a Nitrokey with me.
Also passkey icon added from https://www.streamlinehq.com/icons/download/passkey--30000. Please check licenses before merging.