TsgcWSAPIServer_WebAuthn › Events › OnWebAuthnAuthenticationGetCredential
Fires while verifying an assertion when the credential used by the browser is not in the credential list of the ceremony (usernameless sign in and passkey autofill); the application returns the credential record from its own storage.
property OnWebAuthnAuthenticationGetCredential: TsgcWebAuthnOnAuthenticationGetCredential;
// TsgcWebAuthnOnAuthenticationGetCredential = procedure(Sender: TObject; const aCredentialId: String; const aCredentialRecord: TsgcWebAuthn_CredentialRecord; var Found: Boolean) of objectNot assigned.
When the browser answers an authentication ceremony, the server looks for the credential in the credential records of the ceremony, the ones returned by OnWebAuthnAuthenticationOptionsRequest or found in the internal list. In a usernameless sign in or with passkey autofill that list is usually empty, so the server fires this event with the credential id sent by the browser (aCredentialId, base64url).
Look the credential up in your storage, fill aCredentialRecord (for example with ReadJSON and the JSON saved from AsJSON in OnWebAuthnRegistrationSuccessful) and set Found to true. The record must keep its UserId (user handle), which is compared with the userHandle of the response. The sign in fails when Found is false, when the CredentialId of the record is not aCredentialId, or when the ceremony was started with a user name and the Username of the record is different. After this event the assertion is verified with the public key of the record as usual.
See Passkeys for the complete storage pattern.
procedure TForm1.sgcWSAPIServer_WebAuthn1WebAuthnAuthenticationGetCredential(
Sender: TObject; const aCredentialId: String;
const aCredentialRecord: TsgcWebAuthn_CredentialRecord; var Found: Boolean);
var
vJSON: string;
begin
Found := DBFindPasskey(aCredentialId, vJSON);
if Found then
aCredentialRecord.ReadJSON(vJSON);
end;