Blog Post

Microsoft Security Community Blog
7 MIN READ

All about FIDO2, CTAP2 and WebAuthn

Pamela Dingle's avatar
Pamela Dingle
Icon for Microsoft rankMicrosoft
Nov 20, 2018
This is a great week to be working in Identity Standards, as we at Microsoft celebrate the release of our first ever WebAuthn Relying Party.  This one relying party enables standards-based passwordle...
Updated May 18, 2023
Version 3.0
identity standards
Greg_Gallagher's avatar
Greg_Gallagher
Copper Contributor
Jun 25, 2019

Hi Pamela Dingle,

I am trying to use the Platform WebAuthn API (in webauthn.dll) on Windows 10 Version 1903, specifically the WebAuthNAuthenticatorGetAssertion function. I am able to successfully call it from a desktop application and I see a Windows Hello dialog pop up, but I also want to call the API from a custom credential provider that runs as local SYSTEM on the logon desktop. In that case, no Windows Hello dialog appears and the call fails with a timeout after several minutes. In contrast, when running on a user desktop, the WebAuthn function launches a CredentialUIBroker.exe process that hosts the Windows Hello dialog. As best as I can tell, the Windows Hello dialog is being invoked by a Microsoft credential provider executing a CredUI scenario.

 

Is it possible for the WebAuthN API be called successfully from a credential provider prior to logon or on a locked desktop?

 

Thanks very much,

Greg