The platform supports the self-issuance of FIDO2 Passkeys without the verification of the PIV ID. You can register your external security keys (connected devices) such as YubiKeys or built-in-sensors (platform authenticators) as passkeys or both. This depends on the configuration of the Passkeys (FIDO2) registration policies.

The Unifyia platform supports the issuance of passkeys (FIDO2) on two types of authenticators: Platform Authenticators (built-in or device bound) and Cross-Platform Authenticators (roaming authenticators).

The following are the ways to register Passkeys (FIDO2):

Issue on Platform Authenticators

A platform authenticator refers to an authentication system built into a specific platform, such as a smartphone or computer. It uses device-native features like biometrics (fingerprint or facial recognition), a PIN, Passcode, or Pattern for verification. Platform authenticators are typically more integrated into the device and provide a seamless, secure login experience without needing third-party applications. If you are issuing FIDO2 credential on the mobile device leverage the device-native security features. If you are issuing a FIDO2 credential on a computer leverage the system-native security features such as TPM or Windows Hello.

Supported Browsers and Platforms

The following are the browsers and platforms that support the FIDO2 WebAuthn.

• Web Browsers
  • Google Chrome
  • Mozilla Firefox
  • Microsoft Edge
• Platforms
  • Windows 10
  • Android and iOS platforms.

Platform Authenticator (TPM) - Windows Hello on PC

Set up Windows Hello for passwordless authentication on Windows devices. Windows Hello provides secure, password-free authentication using biometrics (fingerprint, facial recognition) or a PIN. MacBooks also support passwordless login, but only if they have biometric hardware (e.g., Touch ID). The setup process is similar for both platforms. FIDO2 functionality is available on MacBooks starting with macOS 14 Sonoma.

Prerequisites

Follow the below steps to issue passkeys (FIDO2) on platform authenticators:

1. Log into the Unifyia platform as a platform user or federated user.
2. Navigate to Identities.
3. Select + Add New.
4. If more than one identity is approved for you, you are prompted to select for which workflow you wish to issue an identity to continue.
5. Next, from the listed identity device options, select FIDO2 WebAuthn.
6. The system's security page appears. It should be noted that the options will be listed based on the device model and operating system. Typically, the computer will prompt you to select one option from Face, Fingerprint, PIN, or Use another device.
   1. If you have chosen to register your face as your passkey, it will detect your face and save it as your passkey.
   2. If you have chosen to register your Fingerprint as your passkey, it will prompt you to touch the fingerprint sensor and save it as your passkey.
   3. If you have selected to register your computer's PIN, it will prompt you to enter the PIN and save it as your passkey.
7. The system will then prompt to provide a label for FIDO2 passkeys registration. Enter a label that uniquely identifies the device where you have saved the passkeys. Select OK.
8. You are all set to leverage the FIDO2 passkeys to authenticate to the platform.

Register Mobile Devices as FIDO2 Passkeys Using BLE (Bluetooth)

Ensure your PC and mobile device have Bluetooth turned on and are connected over the same internet.

Issue on Cross-Platform Authenticators

Roaming or cross platform authenticators are portable devices that can be used across multiple platforms, services, or devices to authenticate a user. They are part of the FIDO2/WebAuthn framework, which provides passwordless and phishing-resistant authentication. Roaming authenticators typically communicate with the relying party (e.g., a website or service) via standard interfaces such as USB, NFC, or Bluetooth. Examples of Roaming Authenticators include security keys such as YubiKey 5, ZTPass on NXP P71D600, and ID-One PIV v2.4.2 on Cosmo V8.2.

This section explains how to issue FIDO2 credential on Cross platform authenticators or roaming authenticators.

Supported Identity Devices

A FIDO2 credential can be issued on the following identity devices:

Prerequisites

• Ensure that you are registered with the necessary privileges by an authorized user within the organization.
• You have a smart card reader to read smart cards.
• You have a FIDO-supported smart card or security key. The identity device type to be issued is at the discretion of your organization.
• You have installed the Unifyia User Client on your system to access the connected devices.

Follow the below steps to issue passkeys (FIDO2) on connected devices:

1. Log into the Unifyia platform as a platform user or federated user.
2. Navigate to Identities.
3. Select + Add New.
4. If more than one identity is approved for you, you are prompted to select for which workflow you wish to issue an identity to continue.
5. Next, from the listed identity device options, select FIDO2 WebAuthn.
6. The system's security page appears. The computer will prompt you to select one option from Face, PIN, or Use another device.
7. Select Use another device. It will prompt you to select where to save the passkey. Select Security Key.
8. Select OK to continue the setup using an external security key.
9. Connect the identity device to proceed.
   1. If you are using a smart card, insert it into a connected card reader.
   2. If you are using a USB passkey, connect it to your computer. It will prompt you to touch your security key. Touch the key.
   3. If you are using an NFC passkey, connect an external NFC reader to your computer. When prompted, tap the NFC passkey on the reader to continue.
10. Next, set a PIN for the passkey.
11. In the next screen, enter a label for the registered authenticator (identity device).
12. Select OK.

Your FIDO WebAuthn passkey is registered.