WebAuthn

The WebAuthn authenticator implements the WebAuthn specification to enable strong, public key-based credentials for user authentication. CIS supports most types of authenticator devices. Device communication is handled by the browser, so supported devices depend on browser support. Current support can be found on the Fido Alliance Browser Support page.

The WebAuthn authenticator implements the WebAuthn specification to enable strong, public key-based credentials for user authentication. CIS supports most types of authenticator devices. Device communication is handled by the browser, so supported devices depend on browser support. Current support can be found on the Fido Alliance Browser Support page.

Relying Party ID#

The relying-party-id setting controls the WebAuthn Relying Party ID (rpId) a credential is bound to. The Passkeys and WebAuthn authenticators behave identically here, so it is documented once: see Relying Party ID on the Passkeys page.

The related-origins setting extends a credential’s reach to origins on other registrable domains, and requires relying-party-id to be set alongside it. The Passkeys and WebAuthn authenticators implement this identically, so it is documented once: see Related Origin Requests on the Passkeys page for when the feature applies, the configuration format, the document published for the browser, and the security implications.

Reporting the credential ID#

By default, nothing in a delegation says which credential produced it. Enabling the optional credential-id-attribute setting makes the authenticator add the credential ID used in the WebAuthn assertion to the authentication attributes:

  • name — the name of the attribute. Defaults to credentialId.
  • location — subject-attributes (the default) or context-attributes.

The value is the standard Base64 encoded WebAuthn credential ID.

Was this helpful?