FIDO Passwordless Authentication Step
Description
Step to identify and authenticate a user with a FIDO authenticator. This step is passwordless meaning that the user is not required to input a username nor a password in a previous step.
Passwordless authentication requires the use of resident key, where the key material is stored on the FIDO authenticator. This needs to be enforced at registration by ensuring that "Require Resident Key" in "FIDO Settings" is enabled. Please refer to the documentation for more details about the requirements of FIDO passwordless authentication. Furthermore, transports cannot be restricted in passwordless mode.
May be used by
Authentication Flow Selection Step for Public Self-Service Selection Step for User Self-Registration One-Shot Authentication Flow Selection Step for Self-Service Simple Migration Selection Option Advanced Migration Selection Option Migration Selection Step Migration Selection Step Selection Step Selection Option Flow Step Sequence
Properties
FIDO Settings (
fidoSettings) Description
Settings for FIDO.
Attributes
Plugin-Link
Mandatory
Assignable plugins
On Failure Gotos (
onFailureGotos) Description
If the step fails (no retry) and a goto target for the error code is defined here, the flow does not fail and instead a "goto" to the specified target step is executed. Note that even when the "goto" is executed, any error codes that are considered a failed factor attempt will still increment the "failed attempts" counter, and may lead to the user being locked. Therefore, this may still result in a failed flow.
This step can return the following error codes:
FIDO_AUTHENTICATION_FAILED: The FIDO authentication failed for unspecified reasons (either in the browser/client or during server-side verification).FIDO_AUTHENTICATION_TIMEOUT: The response from the browser/client has timed out.FIDO_AUTHENTICATION_ABORTED: The authentication has been aborted in the browser/client.FIDO_AUTHENTICATION_NOT_ALLOWED: The browser/client did not allow authentication with the given credentials.FIDO_WEB_AUTHN_NOT_AVAILABLE: The client/browser is not capable of performing WebAuthn/FIDO authentication.
Attributes
Plugin-Map
Optional
Assignable plugins
Interactive Goto Targets (
interactiveGotoTargets) Description
Manually selectable Goto targets. These are steps to which the user can chose to jump when this is the current flow step.
Attributes
Plugin-List
Optional
Assignable plugins
Dynamic Step Activations (
dynamicStepActivations) Description
Steps that can be dynamically activated while in this step.
Attributes
Plugin-List
Optional
Assignable plugins
Skip Condition (
skipCondition) Description
If this condition is configured and fulfilled, the step is skipped and the flow execution continues with the subsequent step.
Attributes
Plugin-Link
Optional
Assignable plugins
Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)
Pre Condition (
preCondition) Description
This step is executed only if the configured pre condition is fulfilled. If the condition is not fulfilled, the step and flow execution fail immediately. The step is not initialized and no step method can be called. If no condition is configured, the behavior is that of a fulfilled pre condition.
Attributes
Plugin-Link
Optional
Assignable plugins
Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)
Requires Activation (
requiresActivation) Description
If enabled, this step is only executed if it has been dynamically activated from a previous step. If it has not been activated, the step is skipped (equivalent to when the skip condition is fulfilled).
Attributes
Boolean
Optional
Default value
false
Tags On Success (
tagsOnSuccess) Description
This step grants these tags if it completes successfully.
Attributes
Plugin-List
Optional
Assignable plugins
Step ID (
stepId) Description
ID of this step. This is only needed if this step is the target of a goto action or if this step requires activation.
Attributes
Plugin-Link
Optional
Assignable plugins
Custom Response Attributes (
customResponseAttributes) Description
A list of custom attributes that are returned in the REST response in addition to the standard attributes the step already returns. The custom attributes defined here are only returned if the step result does not lead to an error response.
Custom attributes are added to the response when a step is initialized and when actions are executed on the step. They will therefore be available in the response leading to this step, and in any responses from endpoints specific to this step. For non-interactive steps, custom attributes are accumulated and added to the response leading to the next interactive step.
Custom attributes are not returned for 'retrieve' endpoints.
Attributes
Plugin-List
Optional
Assignable plugins
Additional Password Check Attribute Map Airlock 2FA Authentication Data Map Airlock 2FA Login ID Parameter Authentication Data Map Conditional Value Map Provider Context Data Map Edited Context Data Map Generic Session Attribute Value Map Provider HTTP Request Information Map OAuth 2.0 Credential Context Data Map OAuth 2.0 Tokens Map Roles Provider SSI Verification Data Provider SSO Ticket Context Data Provider Script Execution Result Value Map Provider Transaction Approval Parameters Map Transforming Value Map Provider User Identity Map User Passwords Map User Statistics Map Value Provider Map mTAN Token Flow Value Map
Custom Failure Response Attributes (
customFailureResponseAttributes) Description
A list of custom attributes that are added to the REST response in case of a step failure during step execution. Unexpected failures leading to HTTP response status code 500 do not contain these attributes.
Attributes
Plugin-List
Optional
Assignable plugins
Additional Password Check Attribute Map Airlock 2FA Authentication Data Map Airlock 2FA Login ID Parameter Authentication Data Map Conditional Value Map Provider Context Data Map Edited Context Data Map Generic Session Attribute Value Map Provider HTTP Request Information Map OAuth 2.0 Credential Context Data Map OAuth 2.0 Tokens Map Roles Provider SSI Verification Data Provider SSO Ticket Context Data Provider Script Execution Result Value Map Provider Transaction Approval Parameters Map Transforming Value Map Provider User Identity Map User Passwords Map User Statistics Map Value Provider Map mTAN Token Flow Value Map
YAML Template (with default values)
type: FidoPasswordlessAuthenticationStep
id: FidoPasswordlessAuthenticationStep-xxxxxx
displayName:
comment:
properties:
customFailureResponseAttributes:
customResponseAttributes:
dynamicStepActivations:
fidoSettings:
interactiveGotoTargets:
onFailureGotos:
preCondition:
requiresActivation: false
skipCondition:
stepId:
tagsOnSuccess: