Skip to main content

FIDO2 (Passkey) Use Cases

This section shows how to configure each FIDO2 passkey use case with nevisAdmin 4 patterns, for a relying party built with nevisAuth.

The central FIDO2 pattern: nevisFIDO FIDO2 Instance​

Every use case on this page relies on the same nevisFIDO backend: a nevisFIDO FIDO2 Instance pattern, which deploys nevisFIDO and holds the Relying Party and metadata settings that apply across use cases.

One instance per virtual host

If you create more than one nevisFIDO FIDO2 Instance, connect each one to a different Virtual Host.

The URLs that nevisFIDO allocates on a virtual host are fixed, that is, they always start with /nevisfido/, and they map to exactly one nevisFIDO backend. A second instance on the same virtual host would claim the same URLs. nevisAdmin 4 rejects such a configuration during validation.

Settings that apply to more than one use case​

A few settings do not belong to any single use case. They are configured once on the nevisFIDO FIDO2 Instance pattern and then gate several of the flows below, which is why a use case can be configured completely and still not work.

SettingWhat depends on itIf it is not set
Relying Party ID and Relying Party OriginsEvery registration and authentication ceremonyThe browser cannot bind the passkey to your domain, and the ceremony fails
User NameWhich nevisIDM attribute a use case pattern's username refers to (extId or loginId)Onboarding and authentication resolve the wrong user, or fail to resolve one at all
Metadata Location, together with Metadata Service URL(s) or Local MetadataAuthenticator allow-listingAll authenticators are allowed regardless of vendor, unless you explicitly restrict them

Set these before configuring the individual use cases.

Credential lifecycle​

These use cases create and use a FIDO2 credential (a passkey) on the user's authenticator.

  • Registration - register a new passkey for a user who is already authenticated.
  • Authentication - authenticate a user with a registered passkey, either as the only factor, a second factor, or a step-up for a specific operation.

Signing in without a username: passkey autofill​

Restricting which authenticators are allowed​

Using the same passkey on multiple domains​

  • Passkeys Across Multiple Domains - let a passkey registered on one domain be used to authenticate on a related domain, for example a country-specific or brand-specific variant of your site.