Repository navigation
Replies: 5 comments 10 replies
|
I have some impression that when we added initial WebAuthn support to the Keycloak, it worked in a similar way, which you propose in this design. Despite the fact that there were checkboxes and user was able to select one ore more WebAuthn keys. AFAIR we decided to skip that and check all the WebAuthn keys due the better usability for the user... IMO it can be useful if user can see all the available WebAuthn authenticators. I am not 100% sure if it is good to limit him to be able to select just one of them. However I am not usability expert and not sure what is best and most intuitive for the users... |
|
If we can check all webauthn authenticators and there's no negative side-effects than it seems it should stay that way? |
|
Actually just as I typed that I realised that the user has to take an action for the check to happen in the first place, so I'm kinda on the fence, perhaps leaning towards what @mabartos is suggesting. I definitively hate the checkboxes idea though ;) |
|
@mabartos I would also choose the same design that we created for the auth selector screen in order to make UX as uniform as possible. I remember that we got inspired by the official PatternFly4 design proposals, which seems to remain the same since then: Therefore +1 for the proposed designs. Thanks Martin! |
|
@mabartos Basically, I agree with your UI proposal. As @mposolda mentioned, I'm also not sure which is better, allowing a user to choose only one authenticator or multiple authenticators.
For users registered multiple authenticators, I'm afraid that there is the case that the user cannot tell which authenticator displayed on keycloak's UI is the one the user tries to use. |
|
IMO the user label may help to differentiate between multiple WebAuthn keys? It should be the user responsibility to use the nice label, so he can differentiate between multiple WebAuthn keys (EG. "My Yubikey" VS "My mobile key") However I agree it can be good that user will be able to select either one authenticator or all of them. I am not sure how to do that, so the screen won't become over-complicated to understand... We can have the button at the bottom of the screen like "Sign in 10BC8 with any Security Key", but not sure if that is good regarding usability and won't cause the screen to become "too complex" for the average user... |
|
Yes, we need to avoid "too complex" UI. It might be preferable to take the not complex UI from average user. |
|
@stianst @mposolda @tnorimat @Pepo48 Thanks guys for your valuable points. Just one another approach for that. And when there's only one registered authenticator, show the info about the authenticator: |
|
@mposolda You're right. It's not the right way, I forgot about the alternate executions. Regarding the 'Available Security Keys', the functionality is now included in the WebAuthn Error page in this form: Is it the thing, what you meant? |
|
Yes, I meant something like this, but will be nice is design includes the nice "Key" pictures and "Created" label as shown in your screenshots. |
|
@mposolda Agree. Just nitpick for consideration: It'd be good to solve an issue with multiple authenticators (like two cols or sth; maybe like for IdPs). |
|
@mabartos Yes, however not sure about priority of this. I guess typical user would have 1-2 authenticators or 3 at max? More than 3 is probably very rare. But maybe I am wrong here? |
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Hello!
I'm currently working on WebAuthn tests and some minor improvements and I've noticed our authentication login page for WebAuthn and I don't really like it much. Regardless the count of registered possible authenticators, there's only one button for executing authentication process, as you can see in the figure below. When the user clicks the button, credentials all those authenticators are provided to the WebAuthn API as
allowCredentialsand all those credentials can be used within authentication process. What about to leave the decision up to the user, who can choose the authenticator by his/her choice? It'd be also nice to get some information about the authenticator, which will be used.Current page:
Proposed changes with one authenticator with button (it's not possible to click on the authenticator; only for information about it):
Proposed changes with one authenticator without button:
Proposed changes for more authenticators:
Those design are only for consideration and someone from UI team would take a look at it.
@ssilvert @mposolda WDYT?
All reactions