Skip to main content

Register a FIDO2 authenticator

In this process, you are registering a new FIDO2 authenticator. If the user does does not exist yet, a new user is created. In the registration process, WebAuthn credentials must be created. For the credential creation our JavaScript solution can handle the communication between the WebAuthn API and the Authentication Cloud API.

The following diagram shows the end-to-end sequence of an registration operation for a FIDO2 authenticator. The steps that must be performed to integrate the Authentication Cloud into your application are in bold. Some steps are included in the JavaScript solution.

Send an HTTP request to the registration endpoint​

For detailed information on the HTTP request parameters and response fields, see the Registration endpoint page of the API reference documentation.

Send the POST https://{instance}.mauth.nevis.cloud/api/v1/users/enroll call with your instance ID, and configure the HTTP request as follows:

  1. Send your access key or intent token in the Authorization Bearer token header. For more information on the intent token, see Intent endpoint.
  2. Set the channel parameter to fido2.
  3. Set the username and displayName parameters. The displayName parameter is a human-readable name of the user. The length is limited to 64 bytes.

    Use unique static information for the username parameter. To link a user to your internal systems, you might use, for example, an internal customer ID or employee ID, and provide that as a username in the user registration request. It is important to use information that does not change over the life cycle of a user.

    Do not use a username with any Personally Identifiable Information (PII). For example, an email address is not recommended because it is not only PII data, but it also might change over the lifecycle of a user.

    Preventing User Impersonation

    To prevent impersonation, ensure you only link users to your backend records after strongly authenticating them first.

  4. Optionally, set the fido2Options parameters. These parameters change the default registration settings. The following parameters can be configured:
    • userVerification: Use this parameter to customize the requirement for user verification. The default value is preferred.
    • authenticatorAttachment: Use this parameter to select the preferred authentication attachment modality.
    • requireResidentKey: Set the value to true only if residentKey is required. This parameter is retained for backwards compatibility with WebAuthn Level 1.
    • residentKey: Set the value to required to enable autofill UI. This creates a client-side discoverable credential.
    • attestation: Use this parameter to customize the attestation conveyance preference. The default value is none.

HTTP request example​

cURL code sample for registration using custom FIDO2 options
curl "https://$instance.mauth.nevis.cloud/api/v1/users/enroll" \
  -XPOST \
  -H "Authorization: Bearer $access_key"  \
  -H 'Content-Type: application/json;charset=utf-8'   \
  -d "{ \"username\":\"$username\",
        \"channel\":\"fido2\",
        \"displayName\":\"$displayName\",
        \"fido2Options\": {
            \"authenticatorSelection\": {
                \"userVerification\":\"required\",
                \"authenticatorAttachment\":\"platform\",
                \"requireResidentKey\":false,
                \"residentKey\":\"discouraged\"
            },
            \"attestation\":\"none\"
        }
      }"

HTTP response example​

201 Created: Register FIDO2 device

{
  "authenticators": [],
  "createdAt": "2022-03-04T11:04:51.523566769Z",
  "enrollment": {
      "credentialCreationOptions": {
          "attestation": "none",
          "authenticatorSelection": {
              "authenticatorAttachment": "platform",
              "requireResidentKey": false,
              "residentKey": "discouraged",
              "userVerification": "required"
          },
          "challenge": "h6U-j...PUrw",
          "excludeCredentials": [],
          "pubKeyCredParams": [
              {
                  "alg": -65535,
                  "type": "public-key"
              },
              ...
              {
                  "alg": -36,
                  "type": "public-key"
              }
          ],
          "rp": {
              "id": "your-nevis-dev.mauth.nevis.cloud",
              "name": "NEVIS Authentication Cloud: your-nevis-dev"
          },
          "timeout": 60000,
          "user": {
              "displayName": "John Doe",
              "id": "ZmY0Mj...1YTky",
              "name": "u_12654"
          }
      },
      "statusToken": "eyJh...9.eyJh...ZQI-MuCQ",
      "transactionId": "e7bf20-...-56b6683"
  },
  "phones": [],
  "recoveryCodes": null,
  "status": "new",
  "updatedAt": "2022-03-04T11:04:51.523567669Z",
  "userId": "ff4-a...d5a92",
  "username": "u_12654"
}

Forward the credentialCreationOptions object​

The WebAuthn API requires the credentialCreationOptions object to create a new credential. This object can be found in the registration response. To create a new credential, your application backend has to pass the credentialCreationOptions to the frontend or to the native mobile app.

Create a WebAuthn credential with the JavaScript solution​

Once the credentialCreationOptions is forwarded to the browser, apply the Authentication Cloud JavaScript template to create a new WebAuthn credential. The frontend of the relying party must include a JavaScript solution to connect to the Authentication Cloud API.

The template includes the following WebAuthn calls:

  1. Using the @github/webauthn-json client-side Javascript library which is a convenience wrapper for the WebAuthn API.
  2. Checking if WebAuthn is supported by the browser.
  3. Creating the registerOptions object that will be needed by the @github/webauthn-json library.
  4. Calling the @github/webauthn-json library to create a new WebAuthn credential. As a result, a serverPublicKeyCredential object is returned.
    note

    After this step, a native browser dialog prompts the user to perform an authorization gesture. The dialog prompts differ depending on the available and connected authenticators. Once a user has given consent by performing the gesture, the authenticator generates a public and private credential key pair, and returns the public key as part of the response.

  5. Extending ServerPublicKeyCredential with the following attributes to provide Authentication Cloud with vital information:
    • userFriendlyName: the name of the new authenticator
    • userAgent: used by the backend for logging and audit purposes
  6. Sending the updatedServerPublicKeyCredential to your application backend.
  7. Handling the success or failure response, based on the attestation endpoint response.

JavaScript template​

JavaScript template for creating a new credential
// 0
import {
  create,
  parseCreationOptionsFromJSON,
  get,
  parseRequestOptionsFromJSON,
} from "https://unpkg.com/@github/[email protected]/dist/esm/webauthn-json.browser-ponyfill.js";

...

function defaultHeaders() {
  return {
    'Accept': 'application/json',
    'Content-Type': 'application/json;charset=utf-8',
  };
}

function isWebAuthnNotSupportedByTheBrowser() {
  if (window.PublicKeyCredential === undefined || typeof window.PublicKeyCredential !== 'function') {
    let errorMessage = 'Oh no! This browser doesn\'t currently support WebAuthn.';
    if (window.location.protocol === 'http:' && (window.location.hostname !== 'localhost' && window.location.hostname !== '127.0.0.1')){
      errorMessage = 'WebAuthn only supports secure connections. For testing over HTTP, you can use the origin "localhost".';
    }
    console.log(errorMessage);
    return true;
  } else {
    return false;
  }
}

// 1
if (isWebAuthnNotSupportedByTheBrowser()) {
  // case when the browser does not support WebAuthn
}

// 2
const registerOptions = {
  publicKey: credentialCreationOptions
};

// 3
const parsedCredentialCreationOptions = parseCreationOptionsFromJSON(registerOptions);
const serverPublicKeyCredential = (await create(parsedCredentialCreationOptions)).toJSON();

// 4
serverPublicKeyCredential.userFriendlyName = "The authenticator name can be customized";
serverPublicKeyCredential.userAgent = navigator.userAgent;

// 5
const response = await fetch(
      'https://<your-backend-url>', {
        method: 'POST',
        credentials: 'same-origin',
        headers: defaultHeaders(),
        body: JSON.stringify(updatedServerPublicKeyCredential),
      });
const result = await response.json();

// 6
if (result.status === 'ok') {
  // handle success
} else {
  // handle failure, you can find more details in result.errorMessage
}

Forward the authentication response to the attestation endpoint​

Send the authentication response to the Authentication Cloud attestation API endpoint. This endpoint does not require a token.