Error using FIDO U2F: MetadataService must be initialized

[gtbuchanan]

I receive the following error in Event Log when attempting to authenticate with a Yubikey Security Key NFC (FIDO U2F):

MetadataService must be initialized

There is no other information in the log. I couldn't find anywhere in the source code where IMetadataService.Initialize is called so I assume that is the issue when IMetadataService.GetEntry is called later.

Here's my WebAuthN security config:

Here's my Biometrics provider config:

[redhook62]

Hi @gtbuchanan

Yes, this is a bug! and since version 2.5 ...
For our information, can you tell us which device you are using ?
Probably a fix tomorrow, we have some things to check.
An update of the WebAuthN part will take place at the beginning of September to take into account the latest developments of the fido2-net-lib component.

Regards

[gtbuchanan]

@redhook62 Thank you! The device is a Yubico Security Key NFC and I'm running ADFS on Windows Server 2019.

[redhook62]

@gtbuchanan

Ok, a small build today just adding initialization Metadata service...

Regards

[redhook62]

Hi @gtbuchanan

Correctly initialized in version 3.0.2008.2
Let us know, if you have other problems, and if one of the Yubikeys can work with corporate accounts.

Regards

[gtbuchanan]

@redhook62 I'm happy to report I'm now able to successfully authenticate with my Yubikeys in ADFS! I can't thank you all enough for the work you've done on this project. I just came across it this week and It's exciting to be able to use passwordless authentication without a paid service like Azure. I'll be submitting a few more issues about some other things I've noticed but they're very minor. Hopefully, I can become familiar enough with the code to be able to submit some PRs myself. I'm very interested in ultimately using username-less authentication as well.

As an aside, the MMC snap-in now refuses to load after upgrading from 3.0.2008.1 to 3.0.2008.2. It seems to be hanging at "Adding snap-in to console". I've tried reinstalling, restarting, and unregistering but I still can't get it to load and there aren't any errors I can find (unlike #20). Any ideas?

[redhook62]

Hi, @gtbuchanan

We haven't touched the MMC at all; it's exactly the same code as the previous one.
It is not normally required to touch the registry. for .net it is still version 3.0.0.0.
we have not been able to reproduce this problem, no ideas.

For username-less, you must register your device on an MDM. It is also one of our future projects on Git (write an MDM for ADFS and Others)
For password-less you can put the component in primary authentication mode, look at the PowerShell functions for that, but you will still be required to provide a user name. ADFS 2019, does not allow anything else ...

We are very happy that your key is working correctly, before with many Yubico keys we have never been able to register them correctly in Windows (for Windows Hello).
What operating system do you work on and with which browser?

Regards

[gtbuchanan]

@redhook62

we have not been able to reproduce this problem, no ideas.

I'm not sure what's going on either but 3.0.2008.2 just doesn't let me load the MMC module (seems to hang on load indefinitely). I reverted back to 3.0.2008.1 and it started working. Just tried upgrading to 3.0.2008.2 again and the MMC module stopped working again. I've tried a full uninstall/reinstall and the upgrade steps. Is there any adfsmfa data I need to remove manually that isn't handled by UnRegister-MFASystem?

For username-less, you must register your device on an MDM. It is also one of our future projects on Git (write an MDM for ADFS and Others)

Excellent! I look forward to it. This would be a game-changer for self-hosted solutions.

For password-less you can put the component in primary authentication mode, look at the PowerShell functions for that, but you will still be required to provide a user name. ADFS 2019, does not allow anything else ...

I had already gotten this working on 3.0.2008.1 with regular biometrics (facial recognition). It works great.

before with many Yubico keys we have never been able to register them correctly in Windows (for Windows Hello).

I haven't actually figured out how to register it with Windows Hello yet. I don't think you can with domain accounts (without Azure AD) based on everything I've read. I tried seeing if Microsoft was considering adding FIDO2 support to ADDS but they don't seem to care. For now, I'll just be using it with ADFS.

What operating system do you work on and with which browser?

My personal computers are all on Windows 10 Enterprise 2004 and I use Firefox as my primary browser.

[redhook62]

Thanks

We will test again tomorrow,
But only the replacement of the binaries is necessary (Uninstall / Install),
there is no modification of the configuration

[redhook62]

Hi @gtbuchanan

MMC bug confirmed !
A thread locking occurs when loading Providers.
The Biometric provider lock in the initialize method

A new release today

Regards

[gtbuchanan]

@redhook62 The issue has been resolved. Thank you!