Hybrid/caBLE: delegate incoming FIDO:/ requests to other Credential Manager providers
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 14.6k
- Forks
- 3.2k
- Avg merge
- 12d 11h
- Merged PRs (30d)
- 4
Description
**Is your feature request related to a problem? Please describe.**
Since 0.3.14 microG handles incoming FIDO:/ hybrid (caBLE) requests correctly — the tunnel is established and the flow completes. However, the credential is only sourced from microG's own passkey store.
Passkeys stored in a third-party Credential Manager provider (tested with Proton Pass, set as the system's default passkey provider) are never offered. This makes cross-device authentication unusable for users who keep their passkeys in a syncing password manager, which is arguably the main reason to have a third-party provider at all.
**Describe the solution you'd like**
After the hybrid handshake, query the Credential Manager providers the user has enabled instead of only microG's internal store — ideally via the normal provider selection UI, so any provider works without
per-app support.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
- This mirrors the limitation of Google Play Services on stock Android; 1Password, Bitwarden and Proton Pass users hit the same wall there. microG is in a position to do better.
- Possible complication: the request is for a foreign relying party, so setOrigin() semantics apply. Per Android's "privileged apps" docs the provider must allowlist the calling app, which may need coordination with provider vendors.
- Related: #2150 (hybrid transport itself, implemented via #3194), #3290 (missing intent handler pre-0.3.14).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the existing hybrid transport and handshake work from #2150 and #3194, then inspect the intent-handler path added for #3290 and Android Credential Manager provider-selection and setOrigin behavior. Done means an incoming FIDO:/ request can offer enabled third-party providers, including the foreign relying-party case, with provider allowlisting constraints addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java
- Domain
- authentication, mobile
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100