Android-Specific Error Encountered in Passkey Registration Process

[yakirbitan]

Hello,

I'm currently integrating this library into my React Native application to enable passkey functionality. I have followed all the configuration steps outlined in the README.md, including setting up the associated domain and other relevant settings.

The implementation works flawlessly on iOS (version 17.2), where the passkey creation and usage are functioning as expected. However, I am encountering a problem on the Android platform. Despite a successful build and the appearance of the passkey creation popup on Android, an error occurs during the registration process. The error message is as follows:

{
  "error": "Native error",
  "message": "androidx.credentials.exception.CreateCredentialCustomException:"
}

This issue is puzzling, as it seems to be specific to the Android environment, and I'm unsure of the underlying cause. I would greatly appreciate any insights or suggestions on what might be leading to this error. Could there be a step I'm missing, or is it potentially a bug within the library when used on Android?

Thank you in advance for your assistance and guidance. 🙏

[f-23]

Hi @yakirbitan,

Thank you for reporting this! I don't recall ever encountering this error during development, so I'm happy to look into it for you.
I just need some further clarification:

• What Android version are you using?
• Can you give me an example passkey request that triggers this error?
• Please double check if you've set up Digital Asset Links correctly!

[yakirbitan]

Hi @yakirbitan,

Thank you for reporting this! I don't recall ever encountering this error during development, so I'm happy to look into it for you. I just need some further clarification:

• What Android version are you using?
• Can you give me an example passkey request that triggers this error?
• Please double check if you've set up Digital Asset Links correctly!

@f-23 Thanks for your motivation to help 🙏

Android Version: 14
Device: Pixel 7 API 34
Model: sdk_gphone64_arm64

Passkey Request:

{
  "attestation": null,
  "authenticatorSelection": {
    "requireResidentKey": false,
    "residentKey": "discouraged",
    "userVerification": "preferred"
  },
  "challenge": "kpPEPXgP7D1wjV6MlRBPSUz+nCtJisjOD+vywQMJkL8=",
  "excludeCredentials": [],
  "extensions": {
    "credProps": true
  },
  "pubKeyCredParams": [
    {
      "alg": -7,
      "type": "public-key"
    },
    {
      "alg": -257,
      "type": "public-key"
    }
  ],
  "rp": {
    "id": "localhost",
    "name": "Rewire"
  },
  "timeout": 1800000,
  "user": {
    "displayName": "Passkey Test",
    "id": "2HzoHm_hY0CjuEESY9tY6-3SdjmNHOoNqaPDcZGzsr0",
    "name": "Passkey Test"
  }
}

I double-checked everything in the Digital Asset Links in Android:

  GET https://<mydomain>/.well-known/assetlinks.json

[
  {
    "relation": [
      "delegate_permission/common.handle_all_urls",
      "delegate_permission/common.get_login_creds"
    ],
    "target": {
      "namespace": "android_app",
      "package_name": "com.rewire.app",
      "sha256_cert_fingerprints": [
        SHA_HEX_VALUE // this was replaced with the real SHA_HEX_VALUE
      ]
    }
  }
]

Moreover, this is the popup:

The error came from line 34 (link):

val result = currentActivity?.let { credentialManager.createCredential(it, createPublicKeyCredentialRequest) }

This is the information I got from the debugger with Android Studio:

It shows that there is an error related to Google Password Manager but without an explanation of what causes it.

[yakirbitan]

@f-23,

I appreciate your willingness to help with the issue I've encountered. To facilitate a more detailed investigation, I've created a simplified React Native project that replicates the issue using your library. Unfortunately, the same error persists, hindering the passkey functionality on Android devices. The project is available at: https://github.com/yakirbitan/passkey

Error encountered:

{
  "error": "Native error",
  "message": "androidx.credentials.exception.CreateCredentialCustomException:"
}

I have verified the assetlinks.json configuration thoroughly, ensuring it aligns with the expected setup. The verification command outputs confirm that the digital asset links are correctly associated:

Copy code
➜ passkey git:(main) adb shell pm get-app-links com.google.credentialmanager.sample
com.google.credentialmanager.sample:
  ID: 1def815a-7fb5-4d00-8098-c20220144ef3
  Signatures: [FA:C6:17:45:DC:09:03:78:6F:B9:ED:E6:2A:96:2B:39:9F:73:48:F0:BB:6F:89:9B:83:32:66:75:91:03:3B:9C]
  Domain verification state:
    www.glitch.me: 1024
    passkeys-codelab.glitch.me: 1024

Additional details for your reference:

1. React Native version: v18.19.0
2. NPM version: v10.2.3
3. Note: Java home might need to be configured to match your system. Example path: "org.gradle.java.home=/Users/yakirbitan/Library/Java/JavaVirtualMachines/corretto-17.0.9/Contents/Home"

I conducted a test on an Android platform without React Native. I "implemented" a passkey feature using a different repository recommended in the Android documentation (https://github.com/android/identity-samples/tree/main/CredentialManager). This implementation was successful on the same device and with the same assetlinks.json configuration, suggesting the issue may lie within your library.

I'm eager to resolve this as quickly as possible and would greatly appreciate any further insights or suggestions you might have. Could there be a specific aspect of the library's integration with Android that I'm overlooking, or might there be an underlying issue within the library itself?

Thank you for your continued support and guidance.

[f-23]

@yakirbitan Thank you! Unfortunately I'm having a hard time fully reproducing your setup on my end, so I wasn't able to reproduce this issue either.

On another note, is there a reason why your request contains attestation: null instead of attestation: 'none'?

[ManuGowda]

@yakirbitan Thank you! Unfortunately I'm having a hard time fully reproducing your setup on my end, so I wasn't able to reproduce this issue either.

On another note, is there a reason why your request contains attestation: null instead of attestation: 'none'?

@f-23 we are also facing the exact same issue.

We also tried to apply your suggestion attestation: null instead of attestation: 'none' but it resulted in same error.

[r-n-o]

@f-23 also running into this error and I made some progress: I tracked it down to be (in my case at least) caused by a "bad" userId field: Android requires this to be a valid base64-encoded string (like you have here for example). The error I was getting before (same error as the one posted by OP):

{
  "error": "Native error",
  "message": "androidx.credentials.exception.CreateCredentialCustomException:"
}

I looked at Android debug logs with Android Studio and spotted the following line:

[CreateRemotePasskeyOperation] Operation failed. [CONTEXT service_id=68 ] eibg: java.lang.IllegalArgumentException: bad base-64

I fixed this with tkhq/passkeyapp@ff75582. Now it's working and I can create passkeys just fine! 🎉 🎉 🎉

[r-n-o]

Notes which may help future readers of this thread:

• If you are using Expo, make sure to configure expo to build an APK and sign it with a debug keystore (see this on how to create a debug keystore):

  "android":  {
    "buildType": "apk",
    "credentialsSource": "local"
  }
  

• If you are testing on a simulator you need to log into a Google account on the simulator and configure PIN encryption to test passkey functionality. A good test to see if your simulator is set up correctly: visit webauthn.io from the Chrome browser and try to sign up / sign in with a passkey before testing your APK
• If you are testing on a real device, enable developer mode and pair your device with Android Studio (see this) to get debug logs via LogCat. That's really helpful to figure out what's going on.

[ManuGowda]

@f-23 also running into this error and I made some progress: I tracked it down to be (in my case at least) caused by a "bad" userId field: Android requires this to be a valid base64-encoded string (like you have here for example). The error I was getting before (same error as the one posted by OP):

{
  "error": "Native error",
  "message": "androidx.credentials.exception.CreateCredentialCustomException:"
}

I looked at Android debug logs with Android Studio and spotted the following line:

[CreateRemotePasskeyOperation] Operation failed. [CONTEXT service_id=68 ] eibg: java.lang.IllegalArgumentException: bad base-64

I fixed this with r-n-o/passkeyapp@ff75582. Now it's working and I can create passkeys just fine! 🎉 🎉 🎉

Great work @r-n-o

Your fix helped us to resolve our issue and now its working on Android 🙏🏼

[armeo]

And

"androidx.credentials:credentials-play-services-auth:1.2.2"
"androidx.credentials:credentials:1.2.2"

updated androidx credentials version, it's fixed for me.

[sirkostya009]

May I also add that CredentialManager actually expects a base64url encoding on fields like challenge. You can see it in the docs.

[f-23]

This should be fixed in version 3. It also includes improved error logging which could potentially make it easier to track down issues like this in the future.