no idea how to setup fido2 key with keycloak, maybe bug transport [] #48698

f1-outsourcing · 2026-05-04T19:50:43Z

f1-outsourcing
May 4, 2026

26.5.2

To start with I have a fido2 key that works fine on this site https://webauthn.io/profile

Description:
device-bound passkey
Transports:
["usb"]
Provider Information:
Name: (Unavailable)
AAGUID: 00000000-0000-0000-0000-000000000000

I have copied the default browser flow and just added "Authenticator for Passwordless WebAuthn authentication" to the existing form flow.

I see on the login form this "sign in with passkey" but after clicking that and entering the pin I get "ailed to authenticate by the Passkey."

I have enabled debug logging but don't really see anything significant except maybe this:

2026-05-04 19:46:40,860 WARN [org.keycloak.events] (executor-thread-38) type="LOGIN_ERROR", realmId="a2a87471-45ee-400d-b064-8e51666e337d", realmName="Kempo", clientId="account-console", userId="null", ipAddress="x.x.x.x", error="not_allowed", credential_type="webauthn-passwordless", auth_method="openid-connect", auth_type="code", web_authn_authentication_error="webauthn-error-api-get", redirect_uri="https://xxxxxxxxxxxxxxxxxxxx", code_id="bv3OiKt9FOYcMaOfAUL1I1EE", web_authn_authentication_error_detail="NotAllowedError: The request is not allowed by the user agent or the platform in the current context, possibly because the user denied permission."

mg1986jp · 2026-05-28T02:27:18Z

mg1986jp
May 28, 2026

The empty transport [] thing is a known quirk. When you register a FIDO2 key and the browser/OS doesn't report the transport type (USB, NFC, BLE, etc.), Keycloak stores it as an empty array. It doesn't break functionality — the key still works for authentication, it just means the transport hint wasn't provided during registration.

For actually setting up FIDO2 in Keycloak:

Go to Authentication → Flows, and either create a new browser flow or copy the default one. Add "WebAuthn Authenticator" as a required step after the username/password form. Then under Realm Settings → WebAuthn Policy, configure your requirements (user verification, attestation conveyance, etc.).

For the user-facing side, users register their FIDO2 key through Account Console → Signing In → Security Key. Or you can make it a required action so users are prompted to register a key on next login.

If you're hitting specific errors during registration or authentication, sharing the browser console output and KC server logs would help debug further — the error messages around WebAuthn can be pretty cryptic.

0 replies

Navigation Menu

Repository navigation

no idea how to setup fido2 key with keycloak, maybe bug transport [] #48698

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

no idea how to setup fido2 key with keycloak, maybe bug transport [] #48698

Uh oh!

f1-outsourcing May 4, 2026

Replies: 1 comment

Uh oh!

mg1986jp May 28, 2026

f1-outsourcing
May 4, 2026

mg1986jp
May 28, 2026