Skip to main content

FIDO2 (Passkey) Authentication

Once a user has registered a passkey, the FIDO2 Authentication pattern authenticates them with it. The same pattern covers three situations: a standalone login step, a second factor after a legacy login, and a step-up re-authentication before a sensitive operation.

This page assumes a passkey has already been registered; see Registration.

Configuring the FIDO2 Authentication pattern​

Add a FIDO2 Authentication pattern as an authentication step and fill in its fields:

  • nevisFIDO FIDO2: assign the nevisFIDO FIDO2 Instance pattern that provides the FIDO2 services.
  • User Name: choose extId or loginId, matching the User Name setting on the nevisFIDO FIDO2 Instance pattern.
  • On Success: the step to continue with once the passkey ceremony succeeds.
  • On Cancel: optional, assign a step to let the user fall back to another authentication means.
  • User Verification: unspecified, preferred or required, defaulting to unspecified.
  • Authentication Level: the level set on success, from 1 to 9, defaulting to 2.
Reference guide correction pending

The Pattern Reference Guide currently lists discouraged, preferred and required for User Verification on this pattern, and does not mention recommended as a value of AuthState Class below. Both are documentation defects in the generated reference (tracked as PAT-1178 and PAT-1179): the values described on this page are verified directly against the nevisAdmin4-plugins source and are what the pattern actually accepts.

AuthState Class​

This advanced field selects how the browser talks to the backend during the ceremony:

  • ScriptState routes every request through nevisAuth, which relays them to nevisFIDO. No nevisFIDO endpoint needs to be exposed on the nevisProxy virtual host.
  • Fido2AuthState sends FIDO2 requests directly to nevisFIDO, which must then expose /nevisfido/fido2/attestation/options, /nevisfido/fido2/assertion/result and /nevisfido/fido2/status on the virtual host, most easily via a nevisFIDO FIDO2 REST Service pattern.
  • recommended is the actual default value of this field, and despite its name it is a third, distinct selectable option rather than just descriptive text; it behaves exactly like Fido2AuthState. If you pick ScriptState instead, note that Fido2AuthState (and by extension recommended) is the direction this pattern is moving toward.

Using FIDO2 authentication as a second factor (MFA)​

Assign the pattern as the target for FIDO2 Authenticator in a nevisIDM Second-Factor Selection pattern to offer passkey login as one of several second factors in a multi-factor authentication (MFA) flow, alongside password-based ones.

Using FIDO2 authentication for step-up re-authentication​

The same pattern can be reused mid-flow, for example immediately before a sensitive operation, rather than only at the start of a session. Assign it as a step in a step-up authentication flow the same way any other authentication step is reused; the pattern detects that it is running as a step-up step on its nevisAuth Realm and adjusts its generated state accordingly. Set Authentication Level higher than the level granted by the user's original login, so the step-up genuinely raises the session's authentication level.

There is no separate Transaction Confirmation pattern for FIDO2 the way there is for Mobile Authentication; reusing FIDO2 Authentication as a step-up step is the FIDO2 equivalent.

To learn how the authentication ceremony works at the protocol level, and for a JavaScript client to adapt if you are integrating a custom relying party instead, see Authentication in the Concept and Integration Guide.

Next steps​