Repository navigation
how to disable the pin popup of fido keys #53702
Replies: 1 comment 12 replies
|
thats the user verification setting in the webauthn policy. go to authentication > policies > webauthn passwordless policy (or the webauthn policy tab if its the mfa flow) and set "user verification requirement" to discouraged — that skips the pin/biometric popup entirely. preferred tries uv but falls back silently if the authenticator doesnt support it. required is what forces the popup on every login. one caveat: discouraged drops the assurance level, so only use it if you dont need the aal2 guarantee for compliance. |
|
ok, that second key is a good test and it kills my earlier theory. noalwaysUv means it is not forcing anything, so the pin coming back anyway means the problem was never just the key. here is what fits now: keycloak's default for that setting is "preferred", and with preferred the browser tries verification and your key's pin gets prompted. no alwaysUv needed for that. so if discouraged is not actually reaching the browser, you get exactly what you are seeing, on both keys. i checked the 26.5 source and the chain from policy to browser is intact, so it is not a version bug. the setting is just not applying to your login. two usual causes: you set it on a different realm than the one you are logging into (policies are per realm), or your browser flow does not actually use the passwordless authenticator. check both. fastest proof either way: try the same key on webauthn.io with user verification set to discouraged. no popup there means keycloak is not sending what you configured. popup there too means it is the key or windows, not keycloak. and yes, the account page login uses the realm browser flow, so it is a fine place to test, as long as it is the same realm. |
|
Yes great tool this webauthn.io! Never bothered to look at the settings. But there I do not have the pin popup! So it must be one of my settings. I indeed have a specific realm I am testing in. Currently I am creating/investigating if I can make an mcp that can track down errors in policies and flows. |
|
I have upgraded to 2.8.0 and saw there are some new options to silently use the security key, but still pin is requested. |
|
My local AI found it after adding some more mcp tools!!! Working with this change:
|
|
that aaguid explains it. all zeros means the credential was made by windows hello, not the yubikey, and hello always asks for the pin no matter what uv you set. that's why discouraged did nothing and webauthn.io was fine. fix is to set authenticator attachment to cross-platform in the passwordless webauthn policy, then delete that credential and register the yubikey fresh. the old one is tied to hello and will keep asking. new one on the key itself and discouraged actually works. |
Uh oh!
There was an error while loading. Please reload this page.
I would like to disable the pin popups in fido keys
All reactions