Skip to main content

FIDO2 WebAuthn

FIDO2 WebAuthn is a W3C standard that utilizes public-key cryptography and digital signatures to eliminate password-based vulnerabilities. EmpowerID leverages this technology to enable:

  1. Multi-Factor Authentication (MFA) – Username + Password + FIDO2 credential
  2. Passwordless Login – Username + FIDO2 credential + PIN or biometric
  3. Usernameless Login – FIDO2 resident key + PIN or biometric (no username entry)
⚠️FIDO2 Support Required

User security keys must support FIDO2.

System Configuration​

Configure System Settings​

  1. Navigate to: Infrastructure Admin > EmpowerID Servers and Settings > EmpowerID System Settings

  2. Search and configure the following settings:

    System SettingDescription
    FIDO2UsernamelessLoginEnabledEnables the Usernameless login option on the login screen.
    OathTokenIssuerNameSets the FIDO2 server name (e.g., ClientName-Dev, ClientName-UAT).
    MaximumRegisteredAssetsPerPersonPerTypeLimits the number of FIDO2 credentials a user can register. Default: 3.

Policy Configuration​

Enable WebAuthn on Password Manager Policies​

  1. Go to: Password Management > Password & Login Policies
  2. In the Policies tab, search for the desired policy.
  3. Click the Display Name link for that policy.
  4. On the policy View page, click Edit.
  5. Select the appropriate WebAuthn capability under the Authentication Settings tab in the Default FIDO2 Registration Capability field.
  6. Click Save to apply changes.

Device Management​

Manage Registered FIDO2 WebAuthn Tokens​

  1. Navigate to: Apps and Authentication > MFA Devices
  2. Search for FIDO2 to display registered devices.
  3. Expand a token using the dropdown arrow.
  4. Choose one of the following actions:

Assign Token to Person​

  1. Click Assign Token To Person.
  2. Search for and select the user.
  3. Click Submit.

Delete Token​

  1. Click Delete Asset.
  2. Confirm deletion.

User Experience​

MFA FIDO2​

Flow: Username + Password + FIDO2 Credential

💡MFA FIDO2 Usage

When MFA FIDO2 is enabled, the authenticator can only be used as a second factor.

  • First Login (Registration):
    • Security Key: User touches the key.
    • Laptop/PC: User enters PIN or biometric (fingerprint, FaceID).
  • Subsequent Logins:
    • Security Key: Touch required.
    • Laptop/PC: PIN or biometric required.

      Sign-In Flow Experience

PasswordlessLogin FIDO2​

Flow: Username + FIDO2 Credential + PIN/Biometric

💡PasswordlessLogin FIDO2 Usage

When enabled, this capability supports both passwordless login and second-factor usage.

  • First Login (Registration):
    • Security Key: Touch + PIN/Biometric.
    • Laptop/PC: PIN/Biometric.
  • Login Workflow:
    • Enter username.
    • Complete authenticator action.

      PasswordlessLogin Flow Experience

UsernamelessLogin FIDO2​

Flow: FIDO2 Credential (Resident Key) + PIN/Biometric

💡UsernamelessLogin FIDO2 Usage

Supports UsernamelessLogin, PasswordlessLogin, and second-factor authentication.

  • First Login (Registration):
    • Security Key: Resident key is generated and linked to domain (e.g., sso.empoweriam.com); user touches key + enters PIN/biometric.
    • Laptop/PC: Resident credential is generated; user enters PIN/biometric.
  • Next Login:
    • Device prompts automatically for PIN/biometric.

Special Features / Use Cases​

  1. A single FIDO2 Authenticator device can be associated with more than one identity.
  2. A single identity can have a maximum of MaximumRegisteredAssetsPerPersonPerType FIDO2 devices.
  3. If a FIDO2 authenticator associated with more than one identity is presented, EmpowerID will prompt the user to choose the identity for login.
  4. Users can run the RegisterFido2Authenticator workflow to register additional devices.

Security and Compliance Notes​

  • Audit Logs: All registration and assignment actions are logged.
  • Key Material: Private keys are never stored; only public keys are retained securely.
  • Revocation: Deleting a token immediately revokes its authentication ability.
  • Biometric Privacy: Biometric data is stored locally on the device and never transmitted.