FIDO2 passkey authentication with ADSelfService Plus

Understanding FIDO2 and passkeys

FIDO2 authentication is an open authentication standard developed by the FIDO Alliance, an industry consortium that aims to reduce reliance on passwords and improve the overall security of online authentication.

FIDO2 utilizes public key cryptographic credentials, also known as FIDO passkeys, to ensure interoperability with various vendors' hardware, mobile authenticators, and biometric authentication methods, including facial recognition, on diverse browsers and operating systems. This enables passwordless authentication, facilitating smoother logins to numerous web services.

FIDO2 passwordless authentication and phishing-resistant MFA

FIDO2 eliminates passwords and replaces them with native authentication mechanisms on users' devices, like Windows Hello and Apple TouchID, and portable security keys.

Alongside its ability to eliminate passwords, FIDO2 is recognized for its robust security standing, and here's why: All communication between the parties involved in FIDO2 authentication is done using public key cryptography. That is, instead of communicating the actual user-entered authentication secret—such as a PIN, an OTP, or biometric information—to the authentication server, a FIDO passkey (a mathematically generated key corresponding to the secret) is communicated. Therefore, user credentials are not shared between services. Even if one service is compromised, the credentials cannot be used to access other services, making FIDO2 authentication resistant to phishing, replay, and manipulator-in-the-middle (MITM) attacks.

This makes the FIDO login experience a secure, user-friendly, cost-effective, and more resilient substitute for traditional password-based logins.

How does FIDO2 authentication work?

FIDO2 works using two open standards—the Client to Authenticator Protocol (CTAP) and the W3C standard WebAuthn. These work together to provide passwordless authentication and MFA.

• WebAuthn: This is a standard web API built into browsers. It provides an interface to manage and create public keys and communicate with CTAP1 and CTAP2 authenticators.
• CTAP1: This provides the second-factor authentication experience, which requires users to connect security devices to access an online service.
• CTAP2: This allows an authenticator to be used for both the first and second authentication factors and provides users with passwordless authentication and MFA.

Here's a breakdown of the FIDO authentication process using FIDO passkeys:

1. The authenticator generates an asymmetric key pair, also known as FIDO passkeys, and sends the public key to the server during registration.
2. The user performs local verification using biometrics, PIN, or a security key to unlock the private key.
3. The server stores the public key and links it to the user’s account.
4. During logins, the server issues a cryptographic challenge to the client.
5. The authenticator signs the challenge with the private key, and the server verifies it using the stored public key to grant access.

FIDO vs FIDO2

"FIDO" is a generic term that includes different protocols. The first iteration, FIDO 1.0, was released back in 2014 and aimed to enable passwordless authentication. However, it lacked standardization, which led to the launch of FIDO2 in 2018. Let's see how each of FIDO's protocols work:

• Universal Authentication Framework (UAF): The UAF allows online services to offer passwordless logins using local methods like biometrics or PINs. During registration, a key pair is created—the private key stays on the device, and the public key is sent to the server. For logins, the user verifies locally to unlock the private key, which signs a challenge the server verifies to grant access without a password.
• Universal Second Factor (U2F): U2F, currently known as CTAP1 in FIDO2, acts as a complement to traditional password logins and adds an additional factor with something you have, like security devices (USB devices and key fobs). During login, the user enters their password, and the service sends a challenge to the registered security device. The device proves its possession of the private key and sends the signed challenge to the online service, which grants the user access.
• FIDO2: This is the latest protocol and works with two open standards—the Client to Authenticator Protocol and the W3C standard WebAuthn. FIDO2 includes additional security features, such as domain association and runtime checks, which help prevent phishing attacks by ensuring FIDO passkeys cannot be replayed or redirected to unauthorized domains.

Implementing FIDO2-based passkeys authentication using ADSelfService Plus

ManageEngine ADSelfService Plus supports FIDO2 authentication to secure access to cloud applications, OWA logins, and more. Using the WebAuthn API, ADSelfService Plus provides secure and customizable FIDO2 authentication, supporting both platform and roaming FIDO2 authenticators.

Customizable configuration

 

 

Configure your preferred username pattern.

 

 

Choose whether you want users to enroll using security keys, device passkeys, or both.

 

 

Choose how many credentials users are allowed to enroll for FIDO2 authentication.

Comprehensive reports

 

 

Generate comprehensive reports on users' FIDO2 enrollment status.

 

 

Instantly disenroll FIDO2 credentials for users upon detecting suspicious activities.

 

 

Employ filters to effortlessly locate specific users within a large pool of records.

Easy enrollment

 

 

Provide a simple, user-friendly console for hassle-free FIDO2 enrollment and authentication for your users.

FIDO2 authentication methods supported by ADSelfService Plus

ADSelfService Plus supports both platform and roaming FIDO2 authentication methods. Platform authenticators are native to a computer or mobile device, and roaming authenticators are portable and can be used for identity verification on any device. The following authentication methods are supported by ADSelfService Plus:

• Device passkeys: Built-in authenticators native to the device and controlled by the operating system, such as Windows Hello, Apple TouchID and Face ID, and Android Biometrics.
• Security keys: FIDO2- and U2F-compliant hardware security keys like YubiKey, and Google Titan.

Benefits of FIDO2 authentication with ADSelfService Plus

• No more passwords

  FIDO2 replaces passwords with secure, device-based authentication methods, shielding users from password-related cyberthreats.

• No sharing of user secrets

  User secrets are translated into encrypted keys using public key cryptography and are not exposed to the network.

• Phishing resistance

  Phishing, replay, and MITM attacks are repelled since attackers cannot obtain user credentials over the network.

• Support for multiple credentials

  Using ADSelfService Plus, users can enroll up to three FIDO2 passkeys corresponding to different devices and platforms.

• Customizable FIDO MFA

  ADSelfService Plus provides customizable configuration controls for FIDO2, offering both single- and two-factor authentication options to protect sensitive resources.

• Compliance with regulatory standards

  Deploying FIDO2 authentication with ADSelfService Plus ensures compliance with regulatory standards such as the NIST Cybersecurity Framework, HIPAA, the PCI DSS, and the PSD2.