{"record":{"id":"89452905d49237c5","repo":"gravitational/teleport","slug":"webauthn-error-code-v-and-syscall-err-v","errorCode":null,"errorMessage":"webauthn error code %v and syscall err: %v","messagePattern":"webauthn error code (.+?) and syscall err: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/auth/webauthnwin/webauthn_windows.go","lineNumber":222,"sourceCode":"\t\t\t\tID:   base64.RawURLEncoding.EncodeToString(credential),\n\t\t\t\tType: string(protocol.PublicKeyCredentialType),\n\t\t\t},\n\t\t\tRawID: credential,\n\t\t},\n\t\tAttestationResponse: wantypes.AuthenticatorAttestationResponse{\n\t\t\tAuthenticatorResponse: wantypes.AuthenticatorResponse{\n\t\t\t\tClientDataJSON: in.jsonEncodedClientData,\n\t\t\t},\n\t\t\tAttestationObject: bytesFromCBytes(out.cbAttestationObject, out.pbAttestationObject),\n\t\t},\n\t}, nil\n}\n\nfunc getErrorNameOrLastErr(in uintptr, lastError error) error {\n\tret := webAuthNGetErrorName(in)\n\tif ret == 0 {\n\t\tif lastError != syscall.Errno(0) {\n\t\t\treturn fmt.Errorf(\"webauthn error code %v and syscall err: %v\", in, lastError)\n\t\t}\n\t\treturn fmt.Errorf(\"webauthn error code %v\", in)\n\t}\n\terrString := windows.UTF16PtrToString((*uint16)(unsafe.Pointer(ret)))\n\treturn fmt.Errorf(\"webauthn error code %v: %v\", in, errString)\n}\n\nfunc isUVPlatformAuthenticatorAvailable() (bool, error) {\n\tvar out bool\n\tret, err := webAuthNIsUserVerifyingPlatformAuthenticatorAvailable(&out)\n\tif err != nil {\n\t\treturn false, getErrorNameOrLastErr(ret, err)\n\t}\n\treturn out, nil\n}\n\n// bytesFromCBytes gets slice of bytes from C type and copies it to new slice\n// so that it won't interfere when main objects is free.","sourceCodeStart":204,"sourceCodeEnd":240,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthnwin/webauthn_windows.go#L204-L240","documentation":"This error comes from Teleport's Windows WebAuthn wrapper (getErrorNameOrLastErr). When a call into the native WebAuthn API (MakeCredential, GetAssertion, or the platform-authenticator availability probe) fails, the wrapper asks webAuthNGetErrorName for a human-readable name for the returned error code; if that lookup returns 0 (unrecognized code) AND the last Win32 syscall error (syscall.Errno) is non-zero, it falls back to reporting the raw code plus the syscall error. It exists so that unrecognized WebAuthn result codes still surface the underlying OS error instead of being silently swallowed.","triggerScenarios":"Any WebAuthn operation (GetAssertion, MakeCredential, isUVPlatformAuthenticatorAvailable) whose returned code is not in webAuthNGetErrorName's known-name table and whose GetLastError() is non-zero — e.g. WebAuthnGetCancellation returns a failure, the authenticator device returns a vendor-specific HRESULT, or the WebAuthn API call fails before setting a documented error name.","commonSituations":"Running on Windows editions/SKUs where the WebAuthn API behaves unexpectedly; security-key unplugged mid-ceremony producing an unmapped HRESULT; Windows Hello or the platform authenticator being disabled mid-operation; older Windows builds whose WebAuthn.dll returns codes this wrapper doesn't map; enterprise policy blocking WebAuthn device access.","solutions":["Inspect the syscall err portion of the message (e.g. 'The device is not connected', ERROR_NOT_FOUND) and fix that underlying Windows condition first.","Update Teleport to a newer release so the WebAuthn error-code table covers the unmapped HRESULT.","Verify Windows Hello / security key state in Windows Settings > Accounts > Sign-in options and re-run the ceremony.","Collect the exact numeric code from the message and check it against Microsoft's WebAuthn HRESULT documentation.","Reproduce with a standard browser WebAuthn test to confirm it is not Teleport-specific."],"exampleFix":"// before (opaque failure at call site)\nassertion, err := GetAssertion(...)\nif err != nil { return err } // \"webauthn error code -2147024894 and syscall err: The system cannot find the file specified.\"\n\n// after (unwrap and branch on the syscall errno)\nassertion, err := GetAssertion(...)\nif err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) && errno == syscall.ERROR_NOT_FOUND {\n        return trace.Wrap(err, \"no authenticator device found; connect a security key or enable Windows Hello\")\n    }\n    return trace.Wrap(err)\n}","handlingStrategy":"try-catch","validationCode":"// Before invoking WebAuthn, confirm a platform authenticator is available and reachable\navailable, err := isUVPlatformAuthenticatorAvailable()\nif err != nil {\n    var errno syscall.Errno\n    if errors.As(err, &errno) {\n        log.Warnf(\"WebAuthn device check failed with errno %d; ensure a security key is connected and Windows Hello is enabled\", errno)\n    }\n    return trace.Wrap(err)\n}\nif !available {\n    return trace.BadParameter(\"no user-verifying platform authenticator available on this machine\")\n}","typeGuard":"// Narrow the wrapped error to extract the syscall errno\nfunc webauthnErrno(err error) (syscall.Errno, bool) {\n    var errno syscall.Errno\n    if errors.As(err, &errno) && errno != 0 {\n        return errno, true\n    }\n    return 0, false\n}","tryCatchPattern":"assertion, err := GetAssertion(ctx, req)\nif err != nil {\n    if errno, ok := webauthnErrno(err); ok {\n        switch errno {\n        case syscall.ERROR_DEVICE_NOT_CONNECTED:\n            return trace.Wrap(err, \"security key disconnected; reconnect and retry\")\n        case syscall.ERROR_CANCELLED:\n            return trace.Wrap(err, \"user cancelled the WebAuthn ceremony\")\n        }\n    }\n    return trace.Wrap(err) // unmapped code: surface raw code + errno to logs\n}","preventionTips":["Check isUVPlatformAuthenticatorAvailable before initiating any ceremony","Prompt users to keep the security key plugged in for the whole ceremony","Pin/test against the Windows version your fleet runs and re-test after Windows updates","Log the full error (code + errno) to build a mapping of unmapped HRESULTs in your environment"],"tags":["windows","webauthn","syscall","hardware","mfa"],"backgroundTag":"webauthn-error-code","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}