BLE Sample code fails to pair after unpairing

[jthmp]

We are running some sample code on the nrf54l15 mcu, specifically:
/modules/lib/memfault-firmware-sdk/examples/nrf-connect-sdk/nrf5/memfault_demo_app

We can connect and pair successfully (with the nRF Memfault iOS app) but then when we unpair on the mobile phone and try to connect again, we get a pairing failure. If we catch this and then call bt_unpair in the pairing_failed callback then after the second connection attempt pairing works. But this is not desirable for the user experience.

shell output with pairing failure debug message:

shell:~$ Connected 73:A8:B8:B1:B2:C5 (random)
Connected: 73:A8:B8:B1:B2:C5 (random)
Remote LMP version 5.3 (0x0c) subversion 0x0276 manufacturer 0x000f
LE Features: 0x000000000001792d 
[00:00:39.548,118] <wrn> bt_l2cap: Ignoring data for unknown channel ID 0x003a
shell:~$ Security changed: 73:A8:B8:B1:B2:C5 (random) level 2
Security changed: 73:A8:B8:B1:B2:C5 (random) level 2
Identity resolved 73:A8:B8:B1:B2:C5 (random) -> AC:86:A3:07:32:F5 (public)
shell:~$ Pairing completed: AC:86:A3:07:32:F5 (public), bonded: 1
LE conn param updated: int 0x0024 lat 0 to 42
shell:~$ Disconnected, reason 0x13 
Disconnected: AC:86:A3:07:32:F5 (public) (reason 0x13)
shell:~$ Connection object available from previous conn. Disconnect is complete!
Advertising successfully started
Connected AC:86:A3:07:32:F5 (public)
Connected: AC:86:A3:07:32:F5 (public)
Remote LMP version 5.3 (0x0c) subversion 0x0276 manufacturer 0x000f
LE Features: 0x000000000001792d 
[00:01:10.565,274] <wrn> bt_l2cap: Ignoring data for unknown channel ID 0x003a

------ this the failure
shell:~$ Security failed: AC:86:A3:07:32:F5 (public) level 1 err 4 BT_SECURITY_ERR_AUTH_REQUIREMENT
Security failed: AC:86:A3:07:32:F5 (public) level 1 reason: Authentication requirements (4)
shell:~$ Pairing failed conn: AC:86:A3:07:32:F5 (public), reason 4 BT_SECURITY_ERR_AUTH_REQUIREMENT
-----------

---------- this is where we catch the failure and call bt_unpair
Clearing bond and retrying...
Disconnected, reason 0x16 
Disconnected: AC:86:A3:07:32:F5 (public) (reason 0x16)
shell:~$ Connection object available from previous conn. Disconnect is complete!

------ if we try to connect a second time it will work now
Advertising successfully started

Is there away to avoid this issue?

[maryproven]

Hello, you have a stale bond on the device while the phone has deleted it, so pairing fails with BT_SECURITY_ERR_AUTH_REQUIREMENT. Calling bt_unpair() works because it clears that mismatch—but you can handle it automatically instead of forcing a retry.

[jthmp]

Makes sense, how can I handle it automatically?

[jthmp]

Hi Maryproven,
We tried this

CONFIG_BT_SMP_ALLOW_UNAUTH_OVERWRITE=y
which seems to help, but we notice that re-connecting after pairing is very finicky and often we need to disconnect and then reconnect again. 
This only happens after unpair / repair.

[tesc]

Hi,

A separate way to solve the issue, is to have some mechanism on the device for deleting old bonds (for instance through using bt_unpair()). For instance a button on the device, a long press on an existing button, or some other form of input. This would allow the user to reset the device to a state where it will accept connections and bonds to any device. With that solution, you do not need to set the ckonfig option. Setting the option may have security implications, see CONFIG_BT_SMP_ALLOW_UNAUTH_OVERWRITE.

Regards,
Terje

[jthmp]

ok, good to know! I guess we might need to have our mobile app send some kind of unpair request first (the button idea might not work for us).