Skip to main content

nevisFIDO Configuration

For all use-cases, nevisFIDO needs to be prepared to support FIDO2.

FIDO2 configuration block​

nevisFIDO FIDO2 configuration
/var/opt/nevisfido/<instance>/conf/nevisfido.yml
fido2:
    enabled: true
    rp-name: <relying-party-name>
    rp-id: <relying-party-id>
    origins:
        - "<origin>"
    authorization:
        registration:
            type: sectoken
        authentication:
            type: none

Substitute data into this configuration block:

  • relying-party-name: The name of your organization, for example Siven Chocolate Factory Inc..
  • relying-party-id: The ID of the relying party, to which domain the public key credentials will be scoped to. For example: siven.net.
  • origin: The origin that is associated with the server. Origins are commonly referred to as endpoints and they must contain the rp-id, but they can be for example a subdomain of it: https://chocolate.siven.net:9443.

Prepare the credential repository​

nevisFIDO credential repository configuration
/var/opt/nevisfido/<instance>/conf/nevisfido.yml
credential-repository:
    type: nevisidm
    rest-url: https://<nevisidm-host>:<nevisidm-port>/nevisidm
    keystore: /var/opt/keybox/default/node_keystore.jks
    keystore-passphrase: password
    keystore-type: jks
    truststore: /var/opt/keybox/default/truststore.jks
    truststore-passphrase: password
    truststore-type: jks
    client-id: 100
    user-attribute: loginId
  • Replace nevisidm-host and nevisidm-port according to your environment.
  • Note user-attribute: this signals for nevisFIDO the username the server receives is what identifier attribute of the user, so the FIDO2 Registration Client Javascript and the FIDO2 Authentication Client Javascript must send its username property accordingly.

For more detailed configuration, please visit nevisFIDO Configuration.

note

If everything is configured correctly, the nevisFIDO server should print a line similar to this in the log upon startup:

INFO  thread=main  logger=ch.nevis.auth.fido.application.protocols.ProtocolSupport trace_id= span_id= :: The FIDO2 protocol has been enabled for the server.

This is the log line that confirms the FIDO2 protocol was activated. If UAF is enabled on the same server, a corresponding line is printed for it as well:

INFO  thread=main  logger=ch.nevis.auth.fido.application.protocols.ProtocolSupport trace_id= span_id= :: The FIDO UAF protocol has been enabled for the server.

Note that the earlier Spring The following N profiles are active: "base-context", "idm-credential-repository" line is not the success indicator: those profiles belong to the base context and are the same for both FIDO2 and UAF-based servers.