FIDO2
FIDO2 Authentication
Plugin: nevisadmin-plugin-fido2
Use FIDO2 for passwordless authentication.
This step may be assigned for FIDO2 Authenticator in nevisIDM Second-Factor Selection.
Renders a Gui with name fido2_auth.
This Gui name is handled by the default Login Template (in js_end.vm) by including JavaScript.
The JavaScript then triggers authentication using the WebAuthn protocol.
You may allow users to opt out by assigning a step to On Cancel.
nevisFIDO FIDO2
Assign a nevisFIDO FIDO2 Instance.
On Success
Assign an authentication step to continue with after successful authentication.
On Cancel
If assigned a button with label 'cancel.button.label' will be added.
Use to provide an alternative to the user when the user decides to cancel the authentication or the authentication fails and the error cannot be handled.
User Verification
User verification is a crucial step during WebAuthn authentication process as it confirms that the person attempting to authenticate is indeed the legitimate user.
This setting allows to configure the user verification requirements for authentication.
Allowed values:
unspecifiedpreferredrequired
The default is unspecified.
User Name
The username is used by nevisFIDO to look up the user in nevisIDM.
Depending on how the nevisFIDO FIDO2 Instance is configured, either the extId or the loginId have to be used.
AuthState Class
Select one of the following implementations: ScriptState, Fido2AuthState, or recommended.
recommended is the default and behaves like Fido2AuthState.
When ScriptState is selected, all requests sent by JavaScript are directed towards nevisAuth.
The script takes care of the communication with the nevisFIDO component, and thus you can restrict access to nevisFIDO.
There is no need to expose any nevisFIDO APIs on the nevisProxy Virtual Host.
When Fido2AuthState is selected, configuration for Fido2AuthState is generated.
FIDO2 related requests are sent to nevisFIDO instead. This requires that the following nevisFIDO APIs
are exposed on the nevisProxy Virtual Host:
/nevisfido/fido2/attestation/options/nevisfido/fido2/assertion/result/nevisfido/fido2/status
The easiest way to ensure this is to add a nevisFIDO FIDO2 REST Service pattern to your project.
It is recommended to select the Fido2AuthState implementation as it is a more pragmatic solution whereas
the ScriptState is likely to be decommissioned.
This pattern is experimental and likely to change in future releases.
Authentication Level
Authentication level that is set on success.
FIDO2 Management Demo
Plugin: nevisadmin-plugin-fido2
DEMO/TESTING ONLY - NOT FOR PRODUCTION USE
Serves a simple HTML page with JavaScript to register a FIDO2 authenticator.
This is a simple and bare-bone example for demonstration and testing purposes and not intended for production use. It works only when the extId is used as username. Provide your own version adapted to your integration scenario.
For instance, use Hosting Service to deploy your HTML and JavaScript on a nevisProxy Virtual Host
or Generic Authentication Step when the registration shall be done within an authentication flow.
Visit the official WebAuthn Guide for further information on how to do FIDO2-based registration and authentication.
The nevisFIDO FIDO2 Instance must be exposed on the same Virtual Host
using nevisFIDO FIDO2 REST Service pattern.
In the nevisFIDO FIDO2 Instance pattern Relying Party ID and Relying Party Origins must be set correctly,
to allow AJAX calls from the JavaScript.
The client certificate used by nevisFIDO FIDO2 Instance must be uploaded as a certificate credential
for the nevisfido technical user. This should be done automatically in Kubernetes deployments but best double-check.
The credential type 23 must be allowed in the nevisIDM unit policy so that a FIDO2 Authenticator credential can be created for the authenticated user.
Virtual Host(s)
Assign a Virtual Host which shall serve as entry point.
Frontend Path
Enter the path where this example shall be exposed on the nevisProxy Virtual Host.
Authentication Realm
Optionally assign a realm to protect this application or service.
Additional Settings
Assign add-on patterns to customize the behavior of this service.
Example use cases:
Authorization Policyto enforce roles or an authentication level.URL Handlingto redirect or forward requests.HTTP Header Customizationto add, replace, or remove HTTP headers in requests or responses.
FIDO2 Onboarding
Plugin: nevisadmin-plugin-fido2
Use for onboarding when the user has no FIDO2 credential in nevisIDM.
This step may be used as a follow-up of Not Found in nevisIDM Second-Factor Selection.
This step renders Guis with name fido2_onboard.
This Gui name is handled by the default Login Template (in js_end.vm) by including JavaScript files:
base64.jsfido2_utils.jsfido2_onboard.js
The JavaScript triggers device onboarding using the WebAuthn protocol when the Continue or Try Again button is clicked.
These buttons have a special name onclick which is handled in the logrend template by adding onClick.
You may allow users to opt out by assigning a step to On Cancel.
nevisFIDO FIDO2
Assign a nevisFIDO FIDO2 Instance.
On Success
Assign an authentication step to continue with after successful FIDO2 onboarding.
On Unsupported
Assign a step to continue with when the browser does not support FIDO2 WebAuthn.
On Cancel
If assigned a skip button will be added.
Use to provide an alternative to the user.
The button is defined by the label info.signup.passwordless.skip and looks like a link.
Translations for this label must include a button with name cancel-bottom. Example:
<button name="cancel-bottom" type="submit" value="true" class="btn btn-link link-primary">Skip for now</button>
User Name
The username is used by nevisFIDO to look up the user in nevisIDM.
Depending on how the nevisFIDO FIDO2 Instance is configured, either the extId or the loginId have to be used.
Display Name
Enter a 1 line Groovy statement to determine the displayName
included in the call to the Registration Options Service.
The statement must produce a String.
The displayName is required by nevisFIDO
and may be shown to the user by some devices.
Examples:
"${session['ch.nevis.idm.User.firstName']}_${session['ch.nevis.idm.User.name']}"
Authenticator Type
Describes the authenticators' attachment modalities.
Allowed values:
any- does not set a specific value accepting the standard's defaultplatform- indicates a platform authenticator, such as Windows Hellocross-platform- indicates a roaming authenticator, such as a security key
Resident Key
WebAuthn enables high assurance multi-factor authentication with a passwordless login experience. One of the things that enables this is what is called Discoverable Credentials, also referred to as resident keys. This property specifies the extent to which the Relying Party desires to create a client-side discoverable credential.
Allowed values:
unspecifieddiscouragedpreferredrequired
User Verification
User verification is a crucial step during WebAuthn authentication process as it confirms that the person attempting to authenticate is indeed the legitimate user.
This setting allows to configure the user verification requirements for onboarding.
Allowed values:
unspecifiedpreferredrequired
The default is unspecified.
Attestation
Define the preference for attestation conveyance.
You can configure if you want an attestation statement.
none- no attestation statement required.direct- receive an attestation statement as produced by the authenticator.indirect- requests an attestation statement but allows the client to modify what has been received from the authenticator (e.g. for anonymization).
Welcome Screen Button(s)
Configure to add a dispatcher button to the welcome screen.
The button may have a special Button Name to render in a nice way by a customized Login Template.
For instance, Identity Cloud uses this mechanism to add a button which looks like a back arrow. This button takes the user to a previous step.
This is an advanced setting. Use only when you understand the concept.
Failed Screen Button(s)
Configure to add a dispatcher button to the failed screen.
The button may have a special Button Name to render in a nice way by a customized Login Template.
For instance, Identity Cloud uses this mechanism to add a button which looks like a back arrow. This button takes the user to a previous step.
This is an advanced setting. Use only when you understand the concept.
Button Order
Choose primary to show the primary button before any additional buttons.
Choose reverse to display the primary button last.
nevisFIDO FIDO2 REST Service
Plugin: nevisadmin-plugin-fido2
Set up access to a nevisFIDO FIDO2 Instance on a nevisProxy Virtual Host.
This pattern will be adapted depending on the requirements of upcoming FIDO 2 use case patterns.
Virtual Host(s)
Assign a Virtual Host which shall serve as entry point.
nevisFIDO FIDO2
Assign a nevisFIDO FIDO2 Instance.
Additional Settings
Assign add-on patterns to customize the behavior of this service.
Example use cases:
Authorization Policyto enforce roles or an authentication level.URL Handlingto redirect or forward requests.HTTP Header Customizationto add, replace, or remove HTTP headers in requests or responses.