Webauthn (Section)#
Path: /profiles/profile/settings/authentication-service/authenticators/authenticator/webauthn
The settings for a WebAuthN authentication provider
Parameters#
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| allow-registration-during-login | boolean | optional | true | Whether or not users should be able to register a device during the login process |
| ask-to-register-additional-platform-device | boolean | optional | true | If enabled, when a user authenticates with a security key and has no built-in device registered for the active browser, they will immediately be asked to register an additional built-in device. |
| platform-device-cookie-name | string (length: 1..9223372036854775807) | optional | webauthn-platform-device | The name of the cookie that keeps track of whether a built-in device has been registered for a particular browser. |
| require-user-to-set-alias | boolean | optional | false | Require the users to set a device alias. This can be useful for users later to help them identify their devices. |
| user-display-name-attribute | string (length: 1..9223372036854775807) | optional | subject | The user authentication subject attribute to use as the display name for the user in the WebAuthN authenticator. If not set, the default is username |
| skip-user-handle-validation | boolean | optional | false | Skip strict user handle validation during authentication. Enable this only if users need to authenticate with credentials registered under a previous username. |
| relying-party-id | union (union (string | string) | string (length: 1..253)) | optional | - | The WebAuthn Relying Party ID (rpId). Defaults to the host of the server’s base URL; must be that host or a registrable domain suffix of it. Changing it invalidates existing credentials. |
| related-origins | multi-value string (length: 1..9223372036854775807) | optional | - | Additional origins, outside the Relying Party ID’s domain, from which WebAuthn ceremonies are accepted, for use with Related Origin Requests (e.g. ‘https://example.co.uk’). Each origin is matched exactly. Requires relying-party-id to be set |
Subsections#
| Name | Type | Description |
|---|---|---|
| account-manager | Section | |
| mode | OneOf | |
| credential-id-attribute | Section | Adds the standard Base64 encoded credential ID used to authenticate to the authentication attributes. |