Skip to main content

nevisFIDO Setup

Every Nevis Mobile Authentication use case needs FIDO UAF services, which the nevisFIDO component provides. This page describes how to configure it with nevisAdmin 4.

This page assumes you already have a working project with nevisProxy, nevisAuth and nevisIDM. If you are starting from an empty project, work through the Web access management walkthrough first, which builds that base configuration step by step.

FIDO UAF​

Nevis Mobile Authentication is based on the FIDO UAF protocol. To learn more about it, see:

The protocol is implemented by nevisFIDO, which is represented by the nevisFIDO UAF Instance pattern.

note

nevisAdmin 4 also offers a nevisFIDO FIDO2 Instance pattern for passwordless FIDO2 use cases. The Mobile Authentication use cases described here all use the nevisFIDO UAF Instance pattern.

Configuring a nevisFIDO UAF Instance​

Add a nevisFIDO UAF Instance pattern to your project. The sections below describe its most important settings. For the complete field reference, see the pattern in the Patterns Reference.

Basic Settings tab​

Frontend Address​

Frontend Address defines the address where the nevisProxy endpoints are available to clients.

If you have a proxy or gateway in front of nevisProxy, such as NGINX or F5, make sure the frontend address reflects the address that clients actually reach.

Push tab​

To send push notifications, upload your Google service account in the Firebase Push Configuration field. Push notifications are the default channel for out-of-band mobile authentication.

For the Access App side of push, including the difference between a Nevis-managed and a self-managed Firebase project, see Push Support.

If the browser and the Access App run on the same mobile device, a QR code cannot be used and the out-of-band payload is handed over by a link instead. The Link Type, Deep Link, Deep Link Host, Deep Link Resources and Custom URI Link settings on this tab configure that scenario.

For the full walkthrough, see Mobile-Only Operations with Deep Links and Custom URIs.

FIDO UAF tab​

If you use the standard Nevis Access App, you can leave the FIDO UAF tab at its defaults.

If you use a custom-built app, adjust the tab accordingly:

For ready-made policy examples, see Policy configuration examples.

nevisIDM tab​

Nevis Mobile Authentication uses nevisIDM to store the mobile authentication credentials of your users.

  • If nevisIDM is set up by the same nevisAdmin 4 project, assign the nevisIDM Instance pattern to the nevisIDM field.
  • If nevisIDM is deployed by a different project, assign a nevisIDM Connector pattern instead.

nevisFIDO connects to nevisIDM using 2-way TLS. That connection needs a client certificate and a technical user in nevisIDM, which the remaining sections describe.

note

You can skip the rest of this page if all of the following apply:

  • you are deploying to Kubernetes,
  • and you have assigned a nevisIDM Instance,
  • and that instance uses a nevisIDM Database pattern for its database connection.

In this case nevisAdmin 4 sets up the connection for you.

Create the key material​

nevisFIDO needs a private key whose matching certificate is present in both:

  • the nevisIDM frontend trust store, and
  • nevisIDM itself, as the certificate credential of the nevisfido technical user.

The following command creates example key material:

Run this command in a terminal
openssl req -x509 -sha256 -nodes -subj '/CN=nevisfido,OU=auth,O=nevis,C=ch' -days 3650 -newkey rsa:2048 -keyout nevisfido-key.pem -out nevisfido-cert.pem
  • nevisfido-key.pem contains the private key. It is referred to as the nevisFIDO private key below.
  • nevisfido-cert.pem contains the public certificate. It is referred to as the nevisFIDO certificate below.
caution

This key material is self-signed and is meant for testing only. For production, obtain properly signed key material from a certificate authority.

Configure the nevisfido technical user in nevisIDM​

nevisFIDO needs a technical user to contact nevisIDM. Deploy the project, open the nevisIDM Administration GUI and create it.

The name of the user does not matter, but naming it nevisfido is recommended. What matters is that:

  • the user owns the SoapTechAccess role, and
  • the nevisFIDO certificate is added to the user as a certificate credential.

Upload the key material into the nevisAdmin 4 project​

Configure the patterns to use the key material you created:

  • upload the nevisFIDO private key into a PEM Key Store pattern, and assign it to the Key Store field of the nevisFIDO UAF Instance pattern.
  • upload the nevisFIDO certificate into a PEM Trust Store pattern, and assign it to the Frontend Trust Store field of the nevisIDM Instance pattern, so that nevisIDM trusts the incoming client certificate.

For details on how these patterns handle key material, see PEM-Based Key Management.

Different key material per stage

If you need different key material per environment, for example DEV and PROD, do not paste the key material into the pattern. Create a variable instead, then upload the key material per inventory as an inventory file attachment.

Configuring nevisFIDO without nevisAdmin 4

If you configure nevisFIDO manually instead of through nevisAdmin 4, the equivalent client TLS and nevisIDM property setup is described in nevisIDM Configuration in the nevisFIDO Reference Guide.

Next steps​

You are now ready to configure the actual use cases. Continue with Mobile Authentication Use Cases.