[PB-28135] Add WebAuthn MFA Support

Feature requests
,
1

Q1. What is the problem that you are trying to solve?
Support hardware authentication tokens via the WebAuthn (https://developer.mozilla.org/en-US/docs/Web/API/Web_Authentication_API) standard rather than proprietary vendor specific APIs (e.g. Yubico OTP).

Q2 - Who is impacted?
Anyone who uses a hardware authenticator.

Q3 - Why is it important and/or urgent?
Using WebAuthn rather than proprietary vendor specific APIs allows users to configure any CTAP1.0/2.0 hardware authenticator as an MFA device. This includes Yubikey (currently supported by the proprietary Yubico OTP), and many other keys from different vendors in different price ranges.

Additionally, WebAuthn is verified locally on the Passbolt server, without calling out to an external service (like the Yubico OTP servers), which removes a dependency (improving reliability) and means external HTTPs egress can be blocked (improving security).

Q4 - What is your proposed solution? (optional)
Use the WebAuthn APIs.

7 Likes
2

Q5. Community support
People can vote for this idea to show traction:

  • :ok_woman: Must have: this is critical for me to have this
  • :raising_hand_woman: Should have: this is important for me to have this
  • :tipping_hand_woman: Could have: this could be nice to have
  • :no_good_woman: Won’t have: we should not schedule this (explain why)

0 voters

3

I made an account so I could vote for this. webauthn is SO important

4 Likes
4

Same here, Im waiting with deployment till webauthn is implemented.
Currently using bitwarden which supports webauthn.

1 Like
5

Is this on the roadmap? I was very surprised that it isn’t even supportet yet.

6

Yes we were waiting for setting PHP 8.2 as a minimum hosting requirement in order to implement this. This will be possible for us to work on it in the 5.x series.

5 Likes
7

Any status update on this as v5 has been out a while?

8

No movement yet, we’ve been busy with wrapping up encrypted metadata last features, SCIM , and next would be password history.

2 Likes
9

Any status update here? Did Webauthn/FIDO support make it on the roadmap in the meantime?

2 Likes
10

Any status update on this as v5 has been out a while?

1 Like
11

Hello there!

For information, WebAuthn as MFA is now supported on the version 5.17.0.
Both the API and the extension requires to be updated to that version in order to have access to the feature.

The API packages are available as well as the chrome extension. The other browser extensions should be soon available (as usual, they will be available whenever the stores approved them after a review).

Cheers!

4 Likes