Passkey Autofill (Usernameless Authentication)
With a discoverable passkey, a user can sign in without typing a username first: the browser prompts the user to pick a saved passkey, and nevisAuth resolves who they are from the credential itself. This is usernameless authentication, also called passwordless and usernameless login, or passkey autofill.
It takes two things working together: a nevisIDM User Lookup pattern configured for autofill, and passkeys that were registered as discoverable credentials in the first place. Configuring only one of the two leaves the login page showing an empty autofill prompt.
Registering discoverable passkeys
A passkey is only offered for autofill if it was created as a discoverable credential. When configuring the FIDO2 Onboarding step for users who should be able to sign in usernameless, set:
- User Verification to
required. - Resident Key to
required.
A passkey registered with Resident Key left unspecified still authenticates normally through Authentication, it simply never appears in the autofill prompt.
Enabling passkey autofill on the login page
Add or configure a nevisIDM User Lookup pattern and fill in these fields:
- Authentication Mode: set to
interactive, since a login page must actually be rendered for the browser to attach the autofill prompt to it. - Passkey Autofill: set to
enabled. - nevisFIDO FIDO2: assign the nevisFIDO FIDO2 Instance pattern that provides the FIDO2 services.
- On Passkey Success: assign the step to continue with after a successful passkey authentication. If left unassigned, the pattern's standard On Success exit is used instead.
Passkey Autofill requires the User Name setting on the nevisFIDO FIDO2 Instance pattern to be set to extId. With loginId selected instead, autofill does not work.