How to use the WebAuthn authentication extension
Logging in
Before it is possible to login with a WebAuthn Security Key the server administrator need to register the key and connect it to the user account (see below). It is not possible for users to register the key by themselves. Depending on the capabilities of the security key, the administrator may enable password-less authentication.
Basic WebAuthn
In the basic mode, the user has to specify the login and password and then verify the login by touching the security key.
- Start by entering the Login and Password information in the form.
- Press ENTER or click on the Login button.
- The browser should ask you to insert the security into an USB port (unless it is already inserted).
- Press the button on the security key (do not click on the Cancel button).
- You should now be logged in.
The exact prompts and dialogs that the browser displays vary by the browser and operating system you are using. Below are some examples:
Newer Firefox, Chrome and Edge 101 on Windows 10
Step 3: Prompting you for inserting a key | Step 4: Prompting you for touching the key |
Older Firefox
Step 3 and 4: Prompting you for inserting and touching the key |
Password-less authentication
If the security key supports it, the administrator may enable password-less authentication. For example, this is possible with the newer YubiKey 5 models. This mode also requires that the security key is protected with a PIN.
- Start by selecting the WebAuthn (password-less) login metod
- Click on the Login button.
- The browser should ask you to insert the security into an USB port (unless it is already inserted).
- Enter the PIN and press the button on the security key (do not click on the Cancel button).
- You should now be logged in.
Step 1: Password-less login | Step 4: Enter a PIN |
Assigning security keys to users
- To assign a WebAuthn security to a user, the BASE administrator should locate that user in the Administrate->Users list and open the edit dialog.
- Switch to the WebAuthn tab. This should state that no security key is enabled for the account.
- Insert the security key into an USB port.
- Decide if password-less login should be enabled or not and click on the Register button.
- Press the button on the security for verification. If password-less login has been enabled, the user must also enter the PIN. If the security doesn't support password-less login, the browser should display an error message and the registration need to be re-started without the password-less login option.
- If the registration is successful the dialog should switch to reflect the fact that the account is now WebAuthn-enabled. Take out the key and enter the serial number into the Serial # field (optional). Save!
Unassign a security key
Click on the Remove in the WebAuthn tab in the Edit user dialog. Save!
Notes!
- It is possible to assign the same security key to more than one user account. This might be practical for persons that have one regular account for daily usage and one account for administrative needs.
- The administrator may allow other authentication methods.
Attachments (5)
-
insert-key.png
(10.2 KB
) - added by 2 years ago.
Insert key
-
touch-key.png
(8.6 KB
) - added by 2 years ago.
Touch key
-
older-firefox.png
(15.1 KB
) - added by 2 years ago.
Older Firefox
-
password-less-login.png
(34.2 KB
) - added by 2 years ago.
Password-less login form
-
enter-pin.png
(13.1 KB
) - added by 2 years ago.
Enter PIN
Download all attachments as: .zip