Biometric auth - Requested value '00000000-0000-0000-0000-000000000000' was not found.

[abctaylor]

Hello, when attempting to enrol a biometric device, this error is seen:

This has been seen on different client endpoints as well as biometric devices. My biometrics config looks like this:

Nothing obvious in Event Viewer. Anything you could suggest I try? Thanks.

[redhook62]

Hi @abctaylor

Is your device compatible with WebAuthN ?
It is not enough to have a biometric device.

Next, check the other WebAuthN settings.
Send us your device type as well as the WebAuthN settings that you will find in the console.
There are no logs, because it is a WebAuthN error generated by the WebAuthN javascript

regards

[abctaylor]

Hi @redhook62 - thanks for the reply. Yes, I confirm the devices support WebAuthn (tested with https://webauthn.me)

One device is Kensington VeriMark ("FIDO U2F Certified, FIDO2 WebAuthn Compatible")

Console settings for WebAuthN:

Best,
Andrew

[abctaylor]

I also have the following Biometrics settings, which I believe are the defaults:

PS C:\Windows\system32> Get-MFAProvider -ProviderType Biometrics


DirectLogin                 : False
Timeout                     : 60000
TimestampDriftTolerance     : 300000
ChallengeSize               : 32
ServerDomain                : adfs.example.com
ServerName                  : Identity Services
ServerIcon                  :
Origin                      : https://adfs.example.com
PinRequirements             : Null
UseNickNames                : False
ForbiddenBrowsers           : ie;samsung;nokia
InitiatedBrowsers           : safari
NoCounterBrowsers           : safari
Enabled                     : True
EnrollWizard                : True
EnrollWizardDisabled        : False
LockUserOnDefaultProvider   : False
ForceWizard                 : Disabled
PinRequired                 : False
IsRequired                  : False
FullQualifiedImplementation :
Parameters                  :

[redhook62]

Hi,

Do your ADFS servers have internet access? Is the fido alliance metadata up to date?
As indicated in the Wiki the url is indicated.
With the GUID displayed {0000...0000} your device is unknown.
Otherwise play with the different settings

regards

[abctaylor]

Hi Redhook, yes the server has Internet access. I read the Wiki but coulnd't find the answer, how would I check if the metadata is up to date? I read the code and see the URL that gets called, how do i invoke an update manually? Thanks.

[redhook62]

Hi @abctaylor

The easiest way is to log in here: https://webauthntest.identitystandards.io/login.html
connect with "Joe",
register your device,
connect with this device.
this will allow me to look at the registration and Logins to understand your problem.

regards

[redhook62]

Hi @abctaylor

Is your device registered in Windows Hello?
Please check at https://webauthntest.identitystandards.io
2 additional device entries that work perfectly with ADFS.

• HP PC internal fingerprint reader
• Yubikey Bio (not windows hello)
  To authenticate the attachment, switch to something else. and disable User verification method (uvm).

Check the config of your device. no more ideas from my side

[redhook62]

adfs.example.com seems to be a wrong domain
Identity Services seems to be a wrong server name