User Identification with FIDO Authentication Step
User identifying flow step with integrated FIDO authentication.
This step identifies users only by their username, thus it should only be integrated into flows where either a trusted, authenticated entity acts on behalf of the user, or further authentication steps verify the user's identity.
Additionally, this step directly integrates FIDO passwordless authentication by supporting Webauthn conditional UI. When accessing the page, the user is automatically presented with FIDO credential selection dialog if it is supported by the browser, and allows the user to authenticate directly.
Caution: This step allows user enumeration attacks. Such attacks cannot be prevented, even if "Prevent User-Enumeration" is enabled on the "Authentication Flow".
tagsOnUserIdentifySuccess) tagsOnFidoAuthSuccess) onFailureGotos) If the step fails (no retry) and a goto target for the error code is defined here, the flow does not fail and instead a "goto" to the specified target step is executed. Note that even when the "goto" is executed, any error codes that are considered a failed factor attempt will still increment the "failed attempts" counter, and may lead to the user being locked. Therefore, this may still result in a failed flow.
A typical application of this feature is switching to an alternative authentication factor step, if an external service (e.g. Futurae server, SMS gateway) is not available (error code EXTERNAL_SERVICE_UNAVAILABLE with "Strict Counting" disabled, which will not increment the "failed attempts" counter). Other error codes can be found in the IAM REST documentation, in both the general "Error Codes" section and in the documentation of specific endpoints.
This step can return the following error codes:
USER_NOT_FOUND: The user with the specified identity cannot be found.FIDO_AUTHENTICATION_FAILED: The FIDO authentication failed for unspecified reasons (either in the browser/client or during server-side verification).FIDO_AUTHENTICATION_TIMEOUT: The response from the browser/client has timed out.FIDO_AUTHENTICATION_ABORTED: The authentication has been aborted in the browser/client.FIDO_AUTHENTICATION_NOT_ALLOWED: The browser/client did not allow authentication with the given credentials.FIDO_WEB_AUTHN_NOT_AVAILABLE: The client/browser is not capable of performing WebAuthn/FIDO authentication.
fidoSettings) interactiveGotoTargets) dynamicStepActivations) skipCondition) If this condition is configured and fulfilled, the step is skipped and the flow execution continues with the subsequent step.
preCondition) requiresActivation) stepId) customResponseAttributes) A list of custom attributes that are returned in the REST response in addition to the standard attributes the step already returns. The custom attributes defined here are only returned if the step result does not lead to an error response.
Custom attributes are added to the response when a step is initialized and when actions are executed on the step. They will therefore be available in the response leading to this step, and in any responses from endpoints specific to this step. For non-interactive steps, custom attributes are accumulated and added to the response leading to the next interactive step.
Custom attributes are not returned for 'retrieve' endpoints.
customFailureResponseAttributes)
type: UserIdentifyingFidoStep
id: UserIdentifyingFidoStep-xxxxxx
displayName:
comment:
properties:
customFailureResponseAttributes:
customResponseAttributes:
dynamicStepActivations:
fidoSettings:
interactiveGotoTargets:
onFailureGotos:
preCondition:
requiresActivation: false
skipCondition:
stepId:
tagsOnFidoAuthSuccess:
tagsOnUserIdentifySuccess: