AWS IAM Identity Center (SSO) fails when a user tries to register a built-in MFA device

Question

IAM IdentityCenter fails when a user tries to register a built-in MFA device.
Since a few weeks, all users who try to register an MFA device with the built-in method (Windows Hello or TouchID) get the error:
>"It's not you, it's us.
>
>We couldn't complete your request right now. Please try again later."

The workflow worked fine before and the problem is given on all browsers.

From the CloudTrail a json parse error is tracked:
>"[...]
>
>"eventSource": "sso-directory.amazonaws.com",
>
>"eventName": "CompleteWebAuthnDeviceRegistration",
>
>[...]
>
>"errorCode": "RegistrationFailedException",
>
>"errorMessage": "PublicKeyCredentialJSON could not be parsed."
>
>[...]"

Registration with other methods, e.g. Authenticator app, works fine.

Identity source is "Identity Center directory".

Has anyone come across this situation and have an steps for resolution?
Could this be an IAM Identity center bug?

Bard Lan · Answer

Hi Dan, 
According to the document (https://docs.aws.amazon.com/singlesignon/latest/userguide/mfa-types-keys.html), the built-in authenticator for TouchID or Windows Hello will use FIDO2 WebAuthn, but not all operating systems/browser versions support WebAuthn. 
Could you have a check to confirm your browser and operating system are supported by FIDO2 WebAuthn? Based on the link (https://www.w3.org/TR/webauthn-2/#sctn-sample-registration-with-platform-authenticator), you can try 2 functions on browser developer console to see if WebAuthn works:
- window.PublicKeyCredential => is a function
- PublicKeyCredential.isUserVerifyingPlatformAuthenticatorAvailable().then(console.log) => show "true"

According to my current test, I successfully register my Touch ID of IAM Identity Center on my macOS Ventura with Chrome browser, and I don't see the error:
> "eventSource": "sso-directory.amazonaws.com",
> 
> "eventName": "CompleteWebAuthnDeviceRegistration",
> 
> ...
> 
> "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36",
> 
>    "requestParameters": {
> 
>         "deviceId": "XXXXXXXXXXXXX",
> 
>         "publicKeyCredentialJSON": "HIDDEN_DUE_TO_SECURITY_REASONS"
> 
> ...

daniele · Answer

HI Bard Lan, yes you are saying right!

I don't have a support plan and it's hard for me to afford it.

However, I went deeper into the matter and compared the webauthn payloads between a working device (yes, I found one) with a broken one, and I notice that the 'attestationObject' attribute in json responses have totally different lengths, longer in the second case.

I believe at this point that the device uses an algorithm/format not yet supported by the AWS identity pool.

Also, the key is returned by the OS (TouchID or Windows Hello) so I think it mainly depends on the OS. At this point I think in the last period some update has been released that changes the behavior in the webauthn handshake.

AWS IAM Identity Center (SSO) fails when a user tries to register a built-in MFA device

Relevant content