WebAuthn

The WebAuthn authenticator implements the WebAuthn specification to enable strong, public key-based credentials for user authentication. CIS supports most types of authenticator devices. Device communication is handled by the browser, so supported devices depend on browser support. Current support can be found on the Fido Alliance Browser Support page.

Relying Party ID#

By default the authenticator derives the WebAuthn Relying Party ID (rpId) from the hostname of the request’s base URL (for example iam.example.com). A registered credential is bound to that exact host and can only be used on it.

The optional relying-party-id setting lets an administrator set the rpId explicitly. Per the WebAuthn specification the value must be a registrable domain suffix of (or equal to) the origin the ceremony runs on. For example, a server running on iam.example.com may set it to example.com. When configured this way, a credential registered through the Curity Identity Server becomes usable across the parent domain and all of its subdomains (app.example.com, account.example.com, and so on). When the setting is left empty, the previous host-based behavior is preserved.