Skip to main content

Manage Passkey/FIDO2 authenticators

Users can use a Passkey/FIDO2 token as a second-factor authenticator for User ID sign-in or for passkey sign-in. During authentication, IDaaS sends a challenge to the token. The token signs the challenge with the private key associated with the application, and IDaaS verifies the signature before signing in the user.

Users register their FIDO2 token on their My Profile page.

For User ID sign-in, the application resource rule must allow Passkey/FIDO2 authentication. See Create and manage resource rules.

When passkey is enabled for an application, users see a Passkey button on the sign-in page. Users can select that option to bypass password sign-in and use the token registered to their device to sign in to IDaaS or a protected application. Passkey sign-in is independent of the Passkey/FIDO2 authentication settings in resource rules.

You can also configure tenant-level Passkey/FIDO2 settings, including timeout, minimum authentication level for self-management, registration policy, attestation preference, and custom app origins.

To manage Passkey/FIDO2 token authentication, you need User Passkey/FIDO2 Token Management permissions.

Before you deploy Passkey/FIDO2 broadly, confirm which applications will use passkey sign-in, which will use User ID plus Passkey/FIDO2 as a second factor, and which user groups are in scope.

Browser support​

Passkey/FIDO2 authentication is available using the latest versions of Chrome, Microsoft Edge, Firefox, and Safari.

Limitations​

  • Passkey/FIDO2 authentication is only supported for authentication to the following:
    • IDaaS Administrator Portal
    • User Portal
    • SAML applications
    • OIDC and OAuth applications
  • RADIUS applications and Entrust Identity Enterprise integrations do not support Passkey/FIDO2 authentication.
  • All resource rules created using Identity as a Service 4.3 or later automatically have Passkey/FIDO2 authentication enabled for User ID login. For all resource rules created prior to Identity as a Service 4.3, you must enable Passkey/FIDO2 authentication.
  • Passkey/FIDO2 authentication must be enabled by an administrator.
  • Passkey/FIDO2 must be configured in the authentication flow used by the resource rule.

Topics in this section​