Your relying party should have a mechanism to present a list of passkey’s that belong to a user. This list could be provided to the client application for use in a “passkey management” screen.
The sample code below demonstrates code that can retrieve the list of passkeys belonging to a user. Our example outputs the entire table entry related to a passkey. Providing the full table entry does not introduce security risks even if the output was received by a hacker, the public key is no good without the corresponding private key on the authenticator.
Also keep in mind that this implementation is specific to our use of AWS Aurora as our data source, but the fundamental logic should remain the same if you are leveraging another database.
Figure 1 demonstrates sample code that can be used to retrieve all of the passkeys belonging to a user.
@Override
public Set<PublicKeyCredentialDescriptor> getCredentialIdsForUsername(String username) {
return getRegistrationsByUsername(username).stream()
.map(registration -> PublicKeyCredentialDescriptor.builder()
.id(registration.getCredential().getCredentialId())
.build())
.collect(Collectors.toSet());
}
@Override
public Collection<CredentialRegistration> getRegistrationsByUsername(String username) {
String keyJsonOutput = gson.toJson(username);
final String SQL = "SELECT registration FROM credentialRegistrations WHERE username = :keyJsonOutput";
return client.forSql(SQL)
.withParamSets(new GetParams(keyJsonOutput))
.execute()
.mapToList(RegistrationDTO.class)
.stream()
.map(r -> gson.fromJson(r.registration, CredentialRegistration.class))
.collect(Collectors.toList());
}