Add passkey registration support for WebView, Fixes AB#3385532 #2769

p3dr0rv · 2025-09-23T01:33:36Z

AB#3385532
https://identitydivision.visualstudio.com/DevEx/_git/AuthLibrariesApiReview/pullrequest/20357

This PR implements passkey registration support for MSAL/Broker/OneAuth on Android WebView through a WebMessageListener bridge. It extends the existing authentication-only passkey functionality to include full registration capabilities, leveraging the standard Android Credential Manager.

🎯 Key Features
Protocol Version Update

Current: x-ms-PassKeyAuth: 1.0/passkey (authentication only)
New: x-ms-PassKeyAuth: 1.1/passkey (registration + authentication)

Passkey and Credential Manager Integration:

Added new CredentialManagerHandler class to encapsulate passkey creation and retrieval using the Android Credential Manager API, including version checks and logging. This simplifies and centralizes interactions with the credential APIs.
Introduced PasskeyReplyChannel class to standardize communication of WebAuthn responses (success and error) back to JavaScript via JavaScriptReplyProxy, with detailed error mapping to DOMException types per the WebAuthn specification.

Protocol Version Handling:

Updated protocol version validation in FidoChallengeField to accept both 1.0 and 1.1 as supported passkey protocol versions, improving compatibility with newer protocol versions.

Dependency Management:

Added androidx.webkit:webkit as a dependency to support enhanced WebView and JavaScript interaction features.

Telemetry will be added in following PR

github-actions · 2025-09-23T01:33:46Z

❌ Work item link check failed. Description does not contain AB#{ID}.

Click here to Learn more.

…age handling

- Set project-level archives name in build.gradle - Improve PasskeyWebListener to set up WebView message listener - Refactor WebViewAuthorizationFragment to handle console messages with logging levels - Update request headers management in WebViewAuthorizationFragment for passkey protocol - Clean up WebViewMessageListener by removing unused default listener

…dling

…oved script handling and logging; add JsScriptRecord for script management; update CommonFlight to disable passkey feature by default.

…rieval logging; streamline credential request handling.

… organization

- Added PasskeyReplyChannel for communication between JavaScript and native code. - Updated CredentialManagerHandler to create and retrieve passkeys. - Enhanced PasskeyWebListener to handle WebAuthn requests and responses. - Introduced js-bridge.js for JavaScript integration with WebAuthn. - Created unit tests for PasskeyReplyChannel to ensure correct message formatting and error handling. - Removed unnecessary logging statements and improved error handling.

…r handling and message formatting; enhance test coverage for success and error scenarios.

…te Logger class to disable Logcat logging by default; improve logging conditions in Logger.java; ensure proper newline at end of files in CredentialManagerHandler and JsScriptRecord.

…d clean up request headers

…nstructions for modifying js-bridge.js

…ract Passkey protocol header injection logic into a separate method for improved readability and maintainability.

… with project property for better version management. Refactor FidoChallengeField to support multiple Passkey protocol versions; improve error handling for unsupported versions. Clean up CredentialManagerHandler by removing unnecessary exception handling; streamline credential creation and retrieval logic. Add unit tests for PasskeyWebListener; cover message handling, credential flows, and error scenarios. Add webkitVersion variable in versions.gradle for centralized version management.

…abled by default.

…ent; streamline logic for injecting headers based on flight feature and broker requests.

github-actions · 2025-10-23T06:33:41Z

✅ Work item link check complete. Description contains link AB#3385532 to an Azure Boards work item.

…dler for improved readability; format code for better clarity.

…ureAD/microsoft-authentication-library-common-for-android into pedroro/passkey-reg-prototype

- Introduced a set of supported passkey protocol versions in FidoConstants. - Updated throwIfInvalidProtocolVersion method to validate against the new set.

Copilot

Pull Request Overview

This PR extends the existing passkey authentication functionality to include passkey registration support in Android WebView through a new WebMessageListener bridge. The implementation leverages the Android Credential Manager API and introduces protocol version 1.1 to differentiate between authentication-only (1.0) and authentication+registration (1.1) capabilities. Key changes include new handler classes for credential operations, JavaScript bridge injection for WebAuthn API interception, and flight-controlled feature rollout.

Key changes:

Introduced protocol version 1.1 for passkey registration alongside existing 1.0 authentication
Added CredentialManagerHandler, PasskeyWebListener, and PasskeyReplyChannel classes to manage WebAuthn flows
Injected JavaScript bridge to intercept navigator.credentials.create/get calls in WebView

Reviewed Changes

Copilot reviewed 15 out of 15 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
`gradle/versions.gradle`	Added androidx.webkit dependency version
`common4j/src/main/com/microsoft/identity/common/java/flighting/CommonFlight.java`	Renamed flight from ENABLE_PASSKEY_FEATURE to ENABLE_PASSKEY_REGISTRATION
`common4j/src/main/com/microsoft/identity/common/java/constants/FidoConstants.kt`	Added protocol version 1.1 constants and supported versions set
`common/src/test/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyWebListenerTest.kt`	Comprehensive unit tests for PasskeyWebListener
`common/src/test/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyReplyChannelTest.kt`	Unit tests for PasskeyReplyChannel error handling
`common/src/main/java/com/microsoft/identity/common/internal/ui/webview/JsScriptRecord.kt`	New record class for managing injected JavaScript scripts
`common/src/main/java/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java`	Added onPageStarted override to inject scripts and script management
`common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/js-bridge.js`	JavaScript bridge for intercepting WebAuthn API calls
`common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java`	Integrated PasskeyWebListener setup and protocol header injection
`common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyWebListener.kt`	Core WebMessageListener implementation for WebAuthn flows
`common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyReplyChannel.kt`	Channel for communicating WebAuthn responses to JavaScript
`common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/CredentialManagerHandler.kt`	Handler for Android Credential Manager API operations
`common/src/main/java/com/microsoft/identity/common/internal/fido/FidoChallengeField.kt`	Updated protocol version validation to support both 1.0 and 1.1
`common/build.gradle`	Added webkit dependency and increased dependency size limit
`changelog.txt`	Added changelog entry for passkey registration feature

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

…Channel, PasskeyWebListener, and WebViewAuthorizationFragment

p3dr0rv · 2025-10-23T21:35:57Z

Assemble consumers will fail because webkit version is not defined in those libraries yet.

common4j/src/main/com/microsoft/identity/common/java/flighting/CommonFlight.java

...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java

.../src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyWebListener.kt

...src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyReplyChannel.kt

melissaahn · 2025-10-24T05:27:29Z

common/src/main/assets/js-bridge.js

+window.PublicKeyCredential = (function () { });
+window.PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable =
+    function () {
+        return Promise.resolve(false);


Just double checking my understanding: this part controls if the passkey option is visible correct? By always returning false here, this ensures that we can control the visibility with webauthn=1 instead?

This JS method basically tells the webpage whether the current device has a built-in (platform) authenticator — like a fingerprint sensor, Face ID, or passkey support, so this by default is false in WebView is false, https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCredential/isUserVerifyingPlatformAuthenticatorAvailable_static.

In our case, since we’re implementing the credential manager integration, we could actually return true. I believe ESTS skips this validation, which is why it worked before, but it makes more sense to explicitly return true here.

I will double check with Suresh

from Suresh:

…ving error handling, and updating WebView authorization logic

Copilot

Pull Request Overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 9 comments.

...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java

...src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyReplyChannel.kt

...ava/com/microsoft/identity/common/internal/ui/webview/AzureActiveDirectoryWebViewClient.java

...va/com/microsoft/identity/common/internal/providers/oauth2/WebViewAuthorizationFragment.java

.../src/main/java/com/microsoft/identity/common/internal/providers/oauth2/PasskeyWebListener.kt

common/src/main/java/com/microsoft/identity/common/internal/fido/FidoChallengeField.kt

common/src/main/assets/js-bridge.js

common/src/main/java/com/microsoft/identity/common/internal/providers/oauth2/js-bridge.js

…aintainability

…oviders/oauth2/PasskeyReplyChannel.kt Co-authored-by: Copilot <[email protected]>

…do/FidoChallengeField.kt Co-authored-by: Copilot <[email protected]>

…oviders/oauth2/js-bridge.js Co-authored-by: Copilot <[email protected]>

…ugging

Co-authored-by: Copilot <[email protected]>

…esolution

Add passkey support with CredentialManager and WebView integration

2f6fc36

p3dr0rv changed the title ~~Add passkey support with CredentialManager and WebView integration~~ [WIP] Add passkey support with CredentialManager and WebView integration Sep 23, 2025

p3dr0rv added 20 commits September 23, 2025 12:55

debug

a43bfef

Log success response in PasskeyWebListener and update JavaScript mess…

a02b892

…age handling

Merge branch 'dev' into pedroro/passkey-reg-prototype

963d700

Merge branch 'dev' into pedroro/passkey-reg-prototype

7e2e2f3

Refactor Passkey protocol handling and enhance WebView integration

ef52c35

Add passkey registration flight control and update WebView header han…

150aea2

…dling

Refactor PasskeyWebListener and WebViewAuthorizationFragment for impr…

89e0f50

…oved script handling and logging; add JsScriptRecord for script management; update CommonFlight to disable passkey feature by default.

Refactor CredentialManagerHandler to improve passkey creation and ret…

a6ec873

…rieval logging; streamline credential request handling.

Refactor imports in CredentialManagerHandler for improved clarity and…

83b9c49

… organization

Refactor PasskeyReplyChannel and related components for improved erro…

5c8bdbb

…r handling and message formatting; enhance test coverage for success and error scenarios.

Refactor build.gradle to set project archivesBaseName correctly; upda…

036fd39

…te Logger class to disable Logcat logging by default; improve logging conditions in Logger.java; ensure proper newline at end of files in CredentialManagerHandler and JsScriptRecord.

Add WebView support for Passkey functionality; update dependencies an…

8304ba5

…d clean up request headers

Update minified JavaScript code in PasskeyWebListener; add detailed i…

8b31fd0

…nstructions for modifying js-bridge.js

Merge branch 'dev' into pedroro/passkey-reg-prototype

6f5e568

Refactor request header handling in WebViewAuthorizationFragment; ext…

1fc5328

…ract Passkey protocol header injection logic into a separate method for improved readability and maintainability.

Remove passkey feature flight toggle; set passkey registration to dis…

f172ccb

…abled by default.

Enhance Passkey protocol header handling in WebViewAuthorizationFragm…

d87a5cc

…ent; streamline logic for injecting headers based on flight feature and broker requests.

p3dr0rv changed the title ~~[WIP] Add passkey support with CredentialManager and WebView integration~~ Add passkey registration support with CredentialManager and WebView integration Oct 23, 2025

p3dr0rv changed the title ~~Add passkey registration support with CredentialManager and WebView integration~~ Add passkey registration support for WebView Oct 23, 2025

Merge branch 'dev' into pedroro/passkey-reg-prototype

0c0cbfc

github-actions bot changed the title ~~Add passkey registration support for WebView~~ Add passkey registration support for WebView, Fixes AB#3385532 Oct 23, 2025

p3dr0rv added 2 commits October 23, 2025 12:23

Refactor createPasskey and getPasskey methods in CredentialManagerHan…

f206ee5

…dler for improved readability; format code for better clarity.

Merge branch 'pedroro/passkey-reg-prototype' of https://github.com/Az…

2fb63ad

…ureAD/microsoft-authentication-library-common-for-android into pedroro/passkey-reg-prototype

p3dr0rv added 3 commits October 23, 2025 12:25

Add passkey registration support for WebView in changelog

7117010

Update default dependencies size to 16 MB in build.gradle

8e13fde

Add support for dynamic passkey protocol version validation

6c20ed8

- Introduced a set of supported passkey protocol versions in FidoConstants. - Updated throwIfInvalidProtocolVersion method to validate against the new set.

p3dr0rv marked this pull request as ready for review October 23, 2025 20:00

p3dr0rv requested review from a team as code owners October 23, 2025 20:00

Copilot AI review requested due to automatic review settings October 23, 2025 20:00

Copilot AI reviewed Oct 23, 2025

View reviewed changes

Refactor code for improved readability and formatting in PasskeyReply…

8bbf3d4

…Channel, PasskeyWebListener, and WebViewAuthorizationFragment

This was referenced Oct 23, 2025

Add WebAuthn version support in configuration, Fixes AB#3385532 AzureAD/microsoft-authentication-library-for-android#2393

Open

Add webkitVersion 1.14.0 to project dependencies AzureAD/azure-activedirectory-library-for-android#1829

Open

melissaahn approved these changes Oct 24, 2025

View reviewed changes

melissaahn reviewed Oct 24, 2025

View reviewed changes

Enhance passkey functionality by adding span context retrieval, impro…

d611ac0

…ving error handling, and updating WebView authorization logic

shahzaibj requested a review from Copilot October 29, 2025 16:29

Copilot AI reviewed Oct 29, 2025

View reviewed changes

p3dr0rv and others added 8 commits October 29, 2025 09:55

Refactor WebViewAuthorizationFragment for improved code clarity and m…

49c9101

…aintainability

Update common/src/main/java/com/microsoft/identity/common/internal/pr…

2b1088d

…oviders/oauth2/PasskeyReplyChannel.kt Co-authored-by: Copilot <[email protected]>

Update common/src/main/java/com/microsoft/identity/common/internal/fi…

7c0d8ec

…do/FidoChallengeField.kt Co-authored-by: Copilot <[email protected]>

Update common/src/main/java/com/microsoft/identity/common/internal/pr…

be46370

…oviders/oauth2/js-bridge.js Co-authored-by: Copilot <[email protected]>

update WebViewAuthorizationFragment logging methods for improved privacy

999011b

Add WebAuthn JavaScript bridge and enhance PasskeyWebListener for deb…

12a2d84

…ugging

Update common/src/main/assets/js-bridge.js

d4c5cf3

Co-authored-by: Copilot <[email protected]>

Update WebAuthn interface name and modify user verification promise r…

2bf51b7

…esolution

Add passkey registration support for WebView, Fixes AB#3385532 #2769

Are you sure you want to change the base?

Add passkey registration support for WebView, Fixes AB#3385532 #2769

Uh oh!

Conversation

p3dr0rv commented Sep 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Sep 23, 2025

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

p3dr0rv commented Oct 23, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

melissaahn Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

p3dr0rv Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

p3dr0rv Oct 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

p3dr0rv commented Sep 23, 2025 •

edited

Loading

p3dr0rv Oct 24, 2025 •

edited

Loading