microg / microg/GmsCore

Hybrid/caBLE: delegate incoming FIDO:/ requests to other Credential Manager providers

Open
#3,698 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Java
Stars
14.6k
Forks
3.2k
Avg merge
12d 11h
Merged PRs (30d)
4

Description

**Is your feature request related to a problem? Please describe.**
Since 0.3.14 microG handles incoming FIDO:/ hybrid (caBLE) requests correctly — the tunnel is established and the flow completes. However, the credential is only sourced from microG's own passkey store.

Passkeys stored in a third-party Credential Manager provider (tested with Proton Pass, set as the system's default passkey provider) are never offered. This makes cross-device authentication unusable for users who keep their passkeys in a syncing password manager, which is arguably the main reason to have a third-party provider at all.

**Describe the solution you'd like**
After the hybrid handshake, query the Credential Manager providers the user has enabled instead of only microG's internal store — ideally via the normal provider selection UI, so any provider works without
per-app support.

**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.

**Additional context**
- This mirrors the limitation of Google Play Services on stock Android; 1Password, Bitwarden and Proton Pass users hit the same wall there. microG is in a position to do better.
- Possible complication: the request is for a foreign relying party, so setOrigin() semantics apply. Per Android's "privileged apps" docs the provider must allowlist the calling app, which may need coordination with provider vendors.
- Related: #2150 (hybrid transport itself, implemented via #3194), #3290 (missing intent handler pre-0.3.14).

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the existing hybrid transport and handshake work from #2150 and #3194, then inspect the intent-handler path added for #3290 and Android Credential Manager provider-selection and setOrigin behavior. Done means an incoming FIDO:/ request can offer enabled third-party providers, including the foreign relying-party case, with provider allowlisting constraints addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
authentication, mobile
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.