Android-Specific Issues

Description

Using an Android device, you are unable to use the sample PIN, Fingerprint or any other ASM that was provided as part of the App SDK.

Steps

1. Review logcat logs and server logs and look for exceptions, errors, and failures.

2. Ensure that the ASM is correctly embedded in the application.

3. Check that the correct metadata for the ASM is present in the Server DB.

4. Check that the AAID for the ASM is present in the server policy.

5. Clear any data that is cached by your app.

6. Verify that you are running a supported OS version, Android 4.4 or newer

7. Verify that the Android device has never been rooted.

8. Verify that your Server has TLS 1.2 support

9. Verify that your Server has a valid certificate and that your Android device trusts the Server certificate.

Description

Using an Android device, you are unable to register or authenticate using an authenticator.

Steps

1. Capture the message flow between individual components and validate the messages for FIDO conformance using the Conformance Tool at https://fidoalliance.org/certification/functional-certification/conformance/.

Message flow should be captured between these components:

• The server and your app

• Your app and the App SDK

• The App SDK and the ASM

2. Verify that your Server has TLS 1.2 support

3. Verify that your Server has a valid certificate, and that your Android device trusts the Server certificate.

Description

Using an Android device, you are unable to register or authenticate using a fingerprint authenticator and the following message appears in the logs:

No peer certificate
Server returned error on getRegistrations

Steps

Verify that the Server has TLSv1.2 support.

Description

Using an Android device, you are unable to register or authenticate using a fingerprint authenticator and the following message appears in the logs:

E/MfaRegisterNewAuthenticator(15867): MFAC returned error
D/AFidoTask(15867): resolveResult ostpResult :APP_NOT_FOUND

Steps

Check if your facet ID is added to the Server facet ID list.

Description

Using an Android device, you cannot register or authenticate using a PIN authenticator and the following message appears in the logs:

E/UafProcessor(18360): com.fido.uaf.ver0100.types.UafException: No Suitable authenticator
V/ClientAPI(18360): fidoStatus=NO_MATCH
E/RegisterAuthenticatorFragment(18360): Client Error: NO_MATCH

Steps

Check that the authenticator metadata has been added to the database and that the AAID has been added to the Server FIDO policy.

Description

Using an Android device, you are unable to get any response from the Server. The following message appears in the logs:

E/HttpClient(23366): javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
E/RegisterAuthenticatorFragment(23366): No response from server. Please check your network settings and try again.

Step

Make sure that the certificate on the Authentication Server is valid and verified by a trusted certificate authority.

Description

The facet ID of the application is determined by the signing key. To allow the version of Tutorial App you build to match the facet ID installed on the evaluation Server, you must configure Android Studio to use the default keystore included in the Android Studio folder.

Steps

1. In the Android studio app level build.gradle file, make sure that the signing key is properly configured.

signingConfigs {
   debug {
       storeFile file("${rootProject.projectDir}/../keystores/default.keystore")
       storePassword "android"
       keyAlias "androiddebugkey"
       keyPassword "android"
   }
}

2. Make sure that the FacetID of the application is added to the server database.

Description

• Tutorial App: The app's package name and SHA256 fingerprints of the app's signing certificate are missing from the file assetlinks.json.

• Tutorial Web App: The web app domain is different from the RP ID configured on the evaluation server.

Steps

• Tutorial App: Check that the app's package name and SHA256 fingerprints of its signing certificate are in assetlinks.json. Refer to section Creating Your Digital Asset Links File.

• Tutorial Web App: Using the Server Admin Console, configure the RP ID to be the domain suffix or equal to the webapp origin on the server. For instructions on using the Admin Console, refer to Assign the RP ID. For more information about RP ID, see Determining an RP ID.

After following the above instructions, add the app using the Admin Console so the Authentication Server properly recognizes it. Refer to Configuring an Android App.

Description

The app is not in the allow list on the Server. This error applies to any app, not just the Tutorial Apps.

Steps

Verify that you added the app using the Server Admin Console. Refer to Configuring an Android App

Description

Builds fail with the error MissingRegistered: Missing registered class.

Steps

Identify the manifest entry that is causing the error, remove, and test. For example this entry in AndroidManifest.xml will cause the error and can be removed:

<activity android:name="com.fido.android.framework.tm.core.SelectFromDialogActivity"

android:screenOrientation="portrait"

android:excludeFromRecents="true">

</activity>

Description

Push notifications require Google Play Services and/or Huawei Mobile Services. Push notifications also require configuring Firebase Cloud Messaging (FCM) and/or Huawei Mobile Services (HMS) as well as the Authentication Server.

Steps

• Install Google Play Services and configure Firebase on the device. See Setting up for Google Play Services and Adding Firebase Configuration in the Android Developer Guide.

• Install and configure Huawei Mobile Services on the device.See Setting up for Huawei Mobile Services and Adding Huawei Mobile Services Configuration in the Android Developer Guide.

• To configure the Auth Server, see Out-of-band.

Description

You did not set both the registration and the authentication URLs for a QR code scan. These URLs override the URLs in the QR code. You must provide both the registration URL and the authentication URL, or both should be null.

Steps

1. Ensure that the OobReceiver.setURLs() method is called correctly.

2. On the Admin Console, navigate to Configuration>Authentication methods>Out-of-band. Check that both the Registration URL and the Authentication URL are set correctly.