Skip to content

Discoverable Credentials viewing added#417

Open
AdityaMitra5102 wants to merge 4 commits intoNitrokey:mainfrom
AdityaMitra5102:main
Open

Discoverable Credentials viewing added#417
AdityaMitra5102 wants to merge 4 commits intoNitrokey:mainfrom
AdityaMitra5102:main

Conversation

@AdityaMitra5102
Copy link
Copy Markdown

Partially tested due to the unavailability of a Nitrokey with me.

Also passkey icon added from https://www.streamlinehq.com/icons/download/passkey--30000. Please check licenses before merging.

Copy link
Copy Markdown
Member

@robin-nitrokey robin-nitrokey left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the PR! Unfortunately it does not work for me with my Nitrokey Passkey:

8761      ERROR nitrokeyapp.settings_tab.worker Failed to enumerate discoverable credentials
Traceback (most recent call last):
  File "/home/robin/reps/nitrokey-app2/nitrokeyapp/settings_tab/worker.py", line 82, in run
    rp_list= list(cred_man.enumerate_rps())
                  ~~~~~~~~~~~~~~~~~~~~~~^^
  File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/credman.py", line 166, in enumerate_rps
    first = self.enumerate_rps_begin()
  File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/credman.py", line 148, in enumerate_rps_begin
    return self._call(CredentialManagement.CMD.ENUMERATE_RPS_BEGIN)
           ~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/credman.py", line 127, in _call
    return self.ctap.credential_mgmt(**kwargs)
           ~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^
  File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/base.py", line 508, in credential_mgmt
    return self.send_cbor(
           ~~~~~~~~~~~~~~^
        cmd,
        ^^^^
        args(sub_cmd, sub_cmd_params, pin_uv_protocol, pin_uv_param),
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    )
    ^
  File "/home/robin/reps/nitrokey-app2/.venv/lib/python3.13/site-packages/fido2/ctap2/base.py", line 273, in send_cbor
    raise CtapError(status)
fido2.ctap.CtapError: CTAP error: 0x33 - PIN_AUTH_INVALID

I think the PIN token is missing the credential management permission.

The authenticator verifies that the pinUvAuthToken has the cm permission and no associated permissions RP ID. If not, return CTAP2_ERR_PIN_AUTH_INVALID.

https://fidoalliance.org/specs/fido-v2.2-rd-20230321/fido-client-to-authenticator-protocol-v2.2-rd-20230321.html#enumeratingRPs

You can refer to the implementation of the nitropy fido2 list-credentials command in pynitrokey for an example, especially the permissions argument for get_pin_token:

https://github.com/Nitrokey/pynitrokey/blob/2a6c60380490da721317041fec2c770af3b519c3/pynitrokey/cli/fido2.py#L111

Comment thread nitrokeyapp/settings_tab/worker.py
Co-authored-by: Robin Krahl <robin@nitrokey.com>
@AdityaMitra5102 AdityaMitra5102 marked this pull request as draft March 18, 2026 02:24
@AdityaMitra5102
Copy link
Copy Markdown
Author

Thanks for the review. I have modified the implementation to match that of 'nitropy fido list-credentials'. Removed direct accessing of the RP ID hash and user objects with CBOR indexes and now using the abstractions provided in the CredMan module. Added Credman permissions for pin token.

The problem arose in the last commit because the key I am using to test (not exactly a Nitrokey) still allows the deprecated/superseded getPinToken function without the permissions.

@AdityaMitra5102 AdityaMitra5102 marked this pull request as ready for review March 18, 2026 03:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants