Skip to main content

FIDO2 Authenticator Allow-listing

By default, any authenticator that satisfies the requirements of the registration or authentication ceremony is accepted. Allow-listing restricts this further, to a specific set of authenticators identified by metadata, for example only security keys from one vendor.

Passkeys are not supported for allow-listing

Allow-listing is based on each authenticator's Authenticator Attestation Global Unique Identifier (AAGUID) and attestation root certificate, both of which require an attestation format containing an X.509 certificate. Passkeys do not provide attestation, so they cannot be allow-listed; this feature is only meaningful for dedicated security keys.

Configuring metadata on the FIDO2 Instance​

The nevisFIDO FIDO2 Instance pattern controls which metadata source is used to validate authenticators:

  • Metadata Location: choose remote to fetch from an online metadata service, local to upload your own metadata file, none to skip metadata validation entirely, or compat to fall back between the two depending on whether Local Metadata is set.
  • Metadata Service URL(s): required when Metadata Location is remote. In most cases this is the official FIDO Alliance metadata endpoint.
  • Metadata Service Trust Store: required alongside Metadata Service URL(s) whenever it uses HTTPS, which it does for the official endpoint. Assign a trust store holding the CA certificate of that endpoint.
  • Local Metadata: upload a JSON file containing only the metadata statements of the authenticators you want to allow, when Metadata Location is local. At minimum, each entry needs aaguid and attestationRootCertificates.
  • Restrict Authenticators: set to enabled to actually reject authenticators that are not in the metadata. Without this, metadata is fetched but nothing is enforced.

If you set Restrict Authenticators to enabled, use Local Metadata rather than the full remote metadata set, so only the authenticators you intend to allow are ever recognized.

Requiring attestation during registration​

Allow-listing only works if the authenticator actually sends its attestation during registration. On the FIDO2 Onboarding step used for the authenticators you want to restrict, set Attestation to direct. The values none and indirect either withhold the attestation or allow the client to alter it, and neither can be matched against metadata.

Authentication does not need a separate setting: the attestation captured at registration time is what gets validated on every later authentication, since the client no longer sends it during authentication.

Next steps​