Bug: AASA file not fetched on app install

Question

Created Jun ’24

Replies 6

Boosts 3

Participants 6

~5% of our users when downloading the iOS application from the Apple Store for the first time are unable to enrol a Passkey and experience an error saying the application is not associated with [DOMAIN].

The error message thrown by the iOS credentials API is "The operation couldn't be completed. Application with identifier [APPID] is not associated with domain [DOMAIN]"

We have raised this via the developer support portal with case id: 102315543678

Question: Why does the AASA file fail to fetch on app install and is there anything that can be done to force the app to fetch the file?

Can this bug be looked at urgently as it is impacting security critical functionality?

Other Debugging Observations We have confirmed that our AASA file is correctly formatted and hosted on the Apple CDN. Under normal circumstances the association is created on install and Passkey enrolment works as intended.

We have observed that when customers uninstall/reinstall the app this often, but not always, resolves the issue. We also know this issue can resolve itself overtime without any intervention.

We have ruled out network (e.g VPN) issues and have reproduced the issue across a number of different network configurations.

We have ruled out the Keychain provider and have reproduced it across a variety of different providers and combinations of.

We observed this across multiple versions of the iOS operating system and iPhone hardware including the latest hardware and iOS version.

Answered by Systems Engineer in 800769022

This should be significantly better starting in iOS 18 beta 4. This specific issue only affects sign-in attempts that happen immediately after install, before the AASA file has been verified. In general the AASA file is verified within seconds, but of course it's affected by many factors.

Starting in beta 4, the system will detect this state and provide extra time for AASA verification. If it still hasn't been verified in that time, a new error message will be returned indicating that the request can be retried shortly. If you're still seeing this new error frequently in beta 4 or later, please file new feedbacks as the logs will be very helpful :)

Boost

Answer 1

Systems Engineer OP

Apple

Jun ’24

There is an issue we're aware of where sometimes the Associated Domains file isn't fetched immediately after install. Unfortunately there's not much you can do besides trying again in a little bit, as it usually resolves itself within a minute or so.

We completely understand that this is an important issue :)

0

Answer 2

tamtran OP

Jun ’24

Hi @Apple Designer is this issue being addressed? Perhaps the passkey implementation can fallback AASA file hosted against the domain?

1

Answer 3

Audarth OP

Jun ’24

How long does it usually take before the AASA is re-fetched?

It kind of sucks for the users if they don't know how long to wait before they can try creating a passkey again

1

Answer 4

EthanTheAppInnovator OP

Aug ’24

My team is also experiencing this issue. Submitted a support ticket with case ID 102371908508. We integrated passkeys recently and are also seeing ~5% of users encountering this failure reason. I'm able to recreate occasionally by deleting the app, reinstalling, and then quickly attempting to log in with a passkey.

@Apple Designer Is this issue still being worked on? It is present even in the latest iOS 18 betas.

0

Answer 5

Systems Engineer OP

Apple

Aug ’24

Recommended

This should be significantly better starting in iOS 18 beta 4. This specific issue only affects sign-in attempts that happen immediately after install, before the AASA file has been verified. In general the AASA file is verified within seconds, but of course it's affected by many factors.

Starting in beta 4, the system will detect this state and provide extra time for AASA verification. If it still hasn't been verified in that time, a new error message will be returned indicating that the request can be retried shortly. If you're still seeing this new error frequently in beta 4 or later, please file new feedbacks as the logs will be very helpful :)

1

Answer 6

resetko OP

Aug ’24

This specific issue only affects sign-in attempts that happen immediately after install

We've encountered an issue that affects sign-in attempts right after installing our app. Our onboarding flow typically requires creating a passkey, and we've noticed that sometimes users are unable to complete this step immediately after installation.

In some cases, the issue resolves itself, but it can take up to 72 hours after the app is installed. This has led to a few App Store review rejections, as reviewers also encountered this error during onboarding. Unfortunately, the only current workaround is to retry the sign-in process.

0