freeipa

#9261 Add CLI and WebUI to register a passkey for a user
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Request for enhancement

In order to enable passkey (also known as FIDO2 key) authentication in IPA, provide command line and WebUI allowing to add a passkey for a user.

This feature is related to SSSD issue 6228 Enable FIDO2 key authentication in a centralized environment

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6447

master:

  • 574517cb165eb3d89dc3492895cf830a9bde67b2 Design for passkey support
  • af569508c1cefbbbfde2fe52b02fe4545818b04a New schema for Passkey mappings
  • 4bd1be9e90ea7369edb4ae15ff8c51232d5ab850 API: add new commands for ipa passkeyconfig-show | mod
  • a21214cb9e96ff7fdb4f55b5a4817b1ce60632c0 API: add new commands for passkey mappings
  • ae3c281a64c994cae10709a2e284f3830de64781 XMLRPC tests: test new passkey commands
  • 7911b2466d892386721952991d5150412530fb6e CLI: add support for passkey authentication type
  • a7d90c1ef5e70a532f4515c18bf3e073c11ab87c XMLRPC tests: add new tests for passkey auth type
  • f8580cae4b01568a6ab98b405435e83231994896 WebUI: add support for passkey auth type and auth indicator
  • d207f6bf328a9f2a3e07094aeab111aebca932de WebUI tests: add test for krbtpolicy passkey maxlife/maxrenew
  • 56e179748ba4844ce0c5e505803170b901e2a3c4 ipa-kdb: initial support for passkeys
  • 6f0da62f5afa65941c280e16bd12215a57e4d6b0 Passkey: add support for discoverable credentials
  • c58e483095d21aaa98f546425a99dc22d31dfb4a Passkey support: show the passkey in webui
  • 510f806a9f4f82d39772f22e3262ca6c17c918be WebUI: improve passkey display
  • c016e271b2bddde5c26822fee78e7f07b95dddc3 Passkey: add "passkey configuration" to webui
  • b650783a180e6c81a6ccec3fd18ee9ed13edaf12 Passkey: extract the passkey from stdout
  • 9963dcdd5b261011793072d92168c5961ece35ad Passkey: update the API doc
  • 0075c8b8f66a28f80029fb3184e1eeb6b0f99f79 passkeyconfig: require-user-verification is a boolean
  • c0f71b052560e5ac9782c582f151ca0bc7312d62 passkey: adjust selinux security context for passkey_child
  • 14526c50bbabb8df43fa6420b678fcfc3ecd6436 Webui tests: fix test failure
  • 31b70ee32470b6999306bdc38035266d6a496c9e Passkey: add a weak dependency on sssd-passkey
  • 9caea3205cbd99649bd9b9eca4e9322f058d4a98 ipa-otpd: suppress "function declaration isn't a prototype" warning
  • e7a69b3d9f6768afd524bf36dc9b208d9f7730f1 ipa-otpd: make add_krad_attr_to_set() public
  • 62e28e424769b35a19d424de45eade38c26082f3 ipa-otpd: make auth_type_is(), get_string() and get_string_array() public
  • a02fd5305ee42307a159db7ece40ffc305bc7e59 ipa-otpd: make get_krad_attr_from_packet() public
  • b252988da63c1b14da241438c744b882f416f189 ipa-otpd: add support for passkey authentication
  • 8d12d497f68961a5c2b614572f016980a9acca55 ipa-otpd: add passkey_child_debug_level option
  • e5c292cdada69a93a03de0fa6e48aa713b432ba1 doc/designs: update link to SSSD passkey design page
  • 665227e43755c0869f25e986265c0533af1cc7f7 Spec file: bump SSSD version for passkey support
  • e0acc51ff579251aeadf2a624ffd2bb91c2a4ef0 Passkey design: fix user verification
  • 957d67aca50958ad03a7e4d9831ef722b592fa69 Passkey design: user verification clarification
  • 105b03370cd5725a9ae57701da09efd0cdeed1f6 Passkey design: add second sssd design page

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
https://github.com/freeipa/freeipa/pull/6447
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.