PassKey/Biometric Authentication does not work with WSS Agent or ESA Agent on macOS devices

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Users access internet sites via Cloud SWG using WSS Agents on Windows and macOS devices.

As part of a security review, a subset of users were required to do MFA using biometric or passkey step up.

Windows users had no issues with this, but macOS devices failed to get the additional biometric or passkey challenge within the Webview popup window and could not complete the authentication.

A number of macOS devices were upgraded to ESA Agents, but the behaviour remained.

Users could workaround the issue using Symantec VIP, but this is a less transparent user experience compared to the planned approach.

Environment

Endpoint Security Agent (ESA).

WSS Agent.

SAML.

Biometric authentication.

Cause

Webview on macOS doesn’t support biometrics.

Webview on windows supports it. 

Resolution

Enable Web AUTH (ephemeral or non-ephemeral) on macOS devices (The “supports plugins” row of the linked table explains the different auth mechanisms).