microg / microg/GmsCore

At least one fingerprint must be enrolled to create keys requiring user authentication for every use

Open Beginner friendly
#1,820 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

🔐 FIDO / WebAuthN / Passkeys confirmed enhancement
Dominant language
Java
Stars
14.6k
Forks
3.2k
Avg merge
12d 11h
Merged PRs (30d)
4

Description

This error:
java.security.InvalidAlgorithmParameterException: java.lang.IllegalStateException: At least one fingerprint must be enrolled to create keys requiring user authentication for every use
isn't displayed in the graphical interface and it is treated as unknown error.
It would be nice to have a better error message if possible.

Relevant line: https://github.com/microg/GmsCore/blob/304c3522e992a3db641411fd21df4088db579dad/play-services-fido-core/src/main/kotlin/org/microg/gms/fido/core/transport/screenlock/ScreenLockCredentialStore.kt#L42

Logcat:

11-09 13:43:10.850 29369 29369 D FidoLockStore: Creating key for [hidden]
11-09 13:43:10.877 29369 29369 V FingerprintManager: FingerprintManagerService was null
11-09 13:43:10.878 29369 29369 W FingerprintManager: getAuthenticatorId(): Service not connected!
11-09 13:43:10.903 29369 29369 W FidoUi  : 
11-09 13:43:10.903 29369 29369 W FidoUi  : java.security.InvalidAlgorithmParameterException: java.lang.IllegalStateException: At least one fingerprint must be enrolled to create keys requiring user authentication for every use
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.initialize(AndroidKeyStoreKeyPairGeneratorSpi.java:351)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:669)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at java.security.KeyPairGenerator.initialize(KeyPairGenerator.java:418)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.transport.screenlock.ScreenLockCredentialStore.createKey(ScreenLockCredentialStore.kt:42)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.transport.screenlock.ScreenLockTransportHandler.register(ScreenLockTransportHandler.kt:120)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.transport.screenlock.ScreenLockTransportHandler.start(ScreenLockTransportHandler.kt:235)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.ui.AuthenticatorActivity$startTransportHandling$1.invokeSuspend(AuthenticatorActivity.kt:255)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:106)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.EventLoop.processUnconfinedEvent(EventLoop.common.kt:69)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.internal.DispatchedContinuationKt.resumeCancellableWith(DispatchedContinuation.kt:376)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.intrinsics.CancellableKt.startCoroutineCancellable(Cancellable.kt:30)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.intrinsics.CancellableKt.startCoroutineCancellable$default(Cancellable.kt:25)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.CoroutineStart.invoke(CoroutineStart.kt:110)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.AbstractCoroutine.start(AbstractCoroutine.kt:126)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.BuildersKt__Builders_commonKt.launch(Builders.common.kt:56)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.BuildersKt.launch(Unknown Source)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.BuildersKt__Builders_commonKt.launch$default(Builders.common.kt:47)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at kotlinx.coroutines.BuildersKt.launch$default(Unknown Source)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at androidx.lifecycle.LifecycleCoroutineScope.launchWhenResumed(Lifecycle.kt:113)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.ui.AuthenticatorActivity.startTransportHandling(AuthenticatorActivity.kt:252)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.ui.AuthenticatorActivityFragment.startTransportHandling(AuthenticatorActivityFragment.kt:31)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.ui.TransportSelectionFragment.onCreateView$lambda-3(TransportSelectionFragment.kt:34)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.ui.TransportSelectionFragment.$r8$lambda$b5DX8sOwQmKYJ6OcP_fi_uyfcVg(TransportSelectionFragment.kt)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at org.microg.gms.fido.core.ui.TransportSelectionFragment$$ExternalSyntheticLambda2.onClick(D8$$SyntheticClass)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.view.View.performClick(View.java:5637)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.view.View$PerformClick.run(View.java:22433)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.os.Handler.handleCallback(Handler.java:751)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.os.Handler.dispatchMessage(Handler.java:95)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.os.Looper.loop(Looper.java:154)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.app.ActivityThread.main(ActivityThread.java:6186)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at java.lang.reflect.Method.invoke(Native Method)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:889)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:779)
11-09 13:43:10.903 29369 29369 W FidoUi  : Caused by: java.lang.IllegalStateException: At least one fingerprint must be enrolled to create keys requiring user authentication for every use
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.security.keystore.KeymasterUtils.addUserAuthArgs(KeymasterUtils.java:117)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	at android.security.keystore.AndroidKeyStoreKeyPairGeneratorSpi.initialize(AndroidKeyStoreKeyPairGeneratorSpi.java:345)
11-09 13:43:10.903 29369 29369 W FidoUi  : 	... 33 more
11-09 13:43:10.909 29369 29369 D FidoUi  : Finish with error: java.lang.IllegalStateException: At least one fingerprint must be enrolled to create keys requiring user authentication for every use (UNKNOWN_ERR)
11-09 13:43:10.978 27171 27171 I WebAuthnFeature: Received activity result with code: 11 and original request code: 11
11-09 13:43:10.979 27171 27171 E WebAuthnTokenManager: errorCode.name: UNKNOWN_ERR
11-09 13:43:10.979 27171 27171 E WebAuthnTokenManager: errorMessage: java.lang.IllegalStateException: At least one fingerprint must be enrolled to create keys requiring user authentication for every use
11-09 13:43:11.023  2370  2370 D ZenLog  : intercepted: 0|android|[hidden]|null|1000,alarmsOnly
11-09 13:43:11.025  2370  2370 V NotificationService: pkg=android canInterrupt=false intercept=true
11-09 13:43:11.032 29369 29389 D OpenGLRenderer: endAllActiveAnimators on 0x4ea97b00 (RippleDrawable) with handle 0x4e2dee70
11-09 13:43:11.298  2370  2380 I art     : Background sticky concurrent mark sweep GC freed 56060(2MB) AllocSpace objects, 1(20KB) LOS objects, 14% free, 22MB/26MB, paused 2.797ms total 185.755ms
11-09 13:43:11.403 29347 29408 I TransportRuntime.CctTransportBackend: Status Code: 200
11-09 13:43:11.404 29347 29408 I TransportRuntime.CctTransportBackend: Content-Type: application/json; charset=UTF-8
11-09 13:43:11.404 29347 29408 I TransportRuntime.CctTransportBackend: Content-Encoding: gzip
11-09 13:43:11.478 27171 27311 I FirefoxAccountStateMachine: Processing event 'mozilla.components.service.fxa.manager.Event$Account$Start@4aa71e3' for state Idle(accountState=NotAuthenticated). Next state is Active(progressState=Initializing)
11-09 13:43:11.478 27171 27311 I FirefoxAccountStateMachine: Ran 'mozilla.components.service.fxa.manager.Event$Account$Start@4aa71e3' side-effects for state Active(progressState=Initializing), got successive event mozilla.components.service.fxa.manager.Event$Progress$AccountNotFound@679cdcd
11-09 13:43:11.478 27171 27311 I FirefoxAccountStateMachine: Processing event 'mozilla.components.service.fxa.manager.Event$Progress$AccountNotFound@679cdcd' for state Active(progressState=Initializing). Next state is Idle(accountState=NotAuthenticated)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in play-services-fido-core/src/main/kotlin/org/microg/gms/fido/core/transport/screenlock/ScreenLockCredentialStore.kt at the referenced createKey line, then trace how its exception reaches the FIDO graphical interface. Use the supplied logcat to identify the fingerprint-enrollment failure and its current UNKNOWN_ERR handling. Done means this condition is shown as a specific, understandable error rather than an unknown error.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.