[MacOS] Determining whether user already has passkey for given domain

Question

Created Oct ’24

Replies 1

Boosts 1

Participants 2

Hi, I'm leveraging ASAuthorizationSecurityKeyPublicKeyCredentialProvider to authenticate users to an internal service using security keys or passkeys. I'm not using Sign in with Apple - registration is done in another internal service. We're using associated domains. This is on MacOS only.

I'm wondering whether I can programatically determine whether the user has a passkey enrolled with our super-secret-internal-service.com domain already?

The reason I'm asking is simply better UX - if the user doesn't have a passkey enrolled, I'd like to avoid offering them an option to use a platform authenticator and only offer them to tap their security key. We can assume that all users already have their security keys enrolled already.

So something like the following:


  let securityKeyProvider = ASAuthorizationSecurityKeyPublicKeyCredentialProvider(relyingPartyIdentifier: options.rpId)
  let securityKeyRequest = securityKeyProvider.createCredentialAssertionRequest(challenge: options.challenge.data(using: .utf8) ?? Data())

  let platformProvider = ASAuthorizationPlatformPublicKeyCredentialProvider(relyingPartyIdentifier: options.rpId)
  let platformKeyRequest = platformProvider.createCredentialAssertionRequest(challenge: options.challenge.data(using: .utf8) ?? Data())

  var authRequests: [ASAuthorizationRequest] = [securityKeyRequest]
  if (userHasPasskeyForDomain("super-secret-internal-service.com")) { // TODO how do I check this??
    authRequests.append(platformKeyRequest)
  }
  let authController = ASAuthorizationController(authorizationRequests: [platformKeyRequest, securityKeyRequest])

Many thanks!

Boost

Answer 1

Systems Engineer OP

Apple

2w

There isn't a way to do quite what you asked for, but you can get close using the preferimmediatelyavailablecredentials option. When you pass this option with a passkey request, the system will only show UI when a passkey is available on the current device. This option doesn't work with security key requests though, so you'd likely want to make two separate requests.

For example, you could:

Make a passkey-only request with preferimmediatelyavailablecredentials.
- If that request succeeds, you're done.
- If that request returns an error, either the user doesn't have any passkeys (in which case no UI is shown and you get the error callback immediately), or the user saw the passkey picker and declined to use their passkey. In either case, now you can make a security key request.

0