gravitational/teleport · error

%v: %v

Error message

%v: %v

What it means

errorFromStatus on macOS wraps a failure from a Security/framework (LocalAuthentication, CryptoTokenKit) call into a Go error. When a human-readable message (msg) is available, it is formatted as "<prefix>: <msg>". It is the standard error path for Guard, Register, Authenticate, FindCredentials, ListCredentials and DeleteCredential, so this error is just the wrapper — the real cause is in the msg text.

Source

Thrown at lib/auth/touchid/api_darwin.go:437

}

func (touchIDImpl) DeleteNonInteractive(credentialID string) error {
	idC := C.CString(credentialID)
	defer C.free(unsafe.Pointer(idC))

	switch res := C.DeleteNonInteractive(idC); res {
	case 0: // aka success
		return nil
	case errSecItemNotFound:
		return ErrCredentialNotFound
	default:
		return errorFromStatus("non-interactive delete", int(res), "" /* msg */)
	}
}

func errorFromStatus(prefix string, status int, msg string) error {
	if msg != "" {
		return fmt.Errorf("%v: %v", prefix, msg)
	}
	return fmt.Errorf("%v: status %d", prefix, status)
}

View on GitHub (pinned to 1283425b60)

Solutions

1. Read the msg portion of the error to identify the underlying macOS failure and address it accordingly.
2. Prompt the user to retry if the message indicates cancellation (userCanceled is not a real failure).
3. Direct users to enroll biometrics in System Settings if the message says biometry is not available/enrolled.
4. Re-register credentials if the error indicates the Secure Enclave credential or key was deleted or inaccessible.

Example fix

// before (treating every wrapped status as fatal)
if err := api.Register(cc); err != nil { return trace.Wrap(err) }
// after (handle user cancellation gracefully)
if err := api.Register(cc); err != nil {
    if strings.Contains(err.Error(), "canceled") { return nil } // user dismissed prompt
    return trace.Wrap(err)
}

if !IsAvailable() {
    return errors.New("touchid not available on this device; skip Touch ID flows")
}

func isTouchIDUserCancel(err error) bool {
    return err != nil && strings.Contains(strings.ToLower(err.Error()), "cancel")
}

err := api.Authenticate(prompt)
switch {
case err == nil:
    // success
case isTouchIDUserCancel(err):
    // user dismissed the dialog — not a real failure
default:
    // inspect the msg text for the underlying macOS failure
    log.WithError(err).Warn("touchid operation failed")
}

When it happens

Trigger: Any Touch ID operation that returns a non-zero status with an associated error message, e.g. user cancels the Touch ID prompt, biometry is not enrolled, keychain/Secure Enclave key operations fail, or LAContext evaluation fails with a localized error description.

Common situations: User cancels or times out the Touch ID dialog; device has no enrolled biometrics; keychain access is denied or the Secure Enclave key was deleted; macOS version incompatibilities in the token APIs.

Related errors

• %v: status %d
• credential not found
• touch ID not available
• cannot fulfill authenticator attachment %q
• picker returned invalid credential: %#v

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/740e421f0c7adc68. Report an issue: GitHub.