authelia/docs/configuration/webauthn.md

layout	title	parent	nav_order
default	Webauthn	Configuration	17

The Webauthn section has tunable options for the Webauthn implementation.

Configuration

webauthn:
  disable: false
  display_name: Authelia
  attestation_conveyance_preference: indirect
  user_verification: preferred
  timeout: 60s

Options

disable

type: boolean {: .label .label-config .label-purple } default: false {: .label .label-config .label-blue } required: no {: .label .label-config .label-green }

This disables Webauthn if set to true.

display_name

type: string {: .label .label-config .label-purple } default: Authelia {: .label .label-config .label-blue } required: no {: .label .label-config .label-green }

Sets the display name which is sent to the client to be displayed. It's up to individual browsers and potentially individual operating systems if and how they display this information.

See the W3C Webauthn Documentation for more information.

attestation_conveyance_preference

type: string {: .label .label-config .label-purple } default: indirect {: .label .label-config .label-blue } required: no {: .label .label-config .label-green }

Sets the conveyance preference. Conveyancing allows collection of attestation statements about the authenticator such as the AAGUID. The AAGUID indicates the model of the device.

See the W3C Webauthn Documentation for more information.

Available Options:

Value	Description
none	The client will be instructed not to perform conveyancing
indirect	The client will be instructed to perform conveyancing but the client can choose how to do this including using a third party anonymization CA
direct	The client will be instructed to perform conveyancing with an attestation statement directly signed by the device

user_verification

type: string {: .label .label-config .label-purple } default: preferred {: .label .label-config .label-blue } required: no {: .label .label-config .label-green }

Sets the user verification preference.

See the W3C Webauthn Documentation for more information.

Available Options:

Value	Description
discouraged	The client will be discouraged from asking for user verification
preferred	The client if compliant will ask the user for verification if the device supports it
required	The client will ask the user for verification or will fail if the device does not support verification

timeout

type: string (duration) {: .label .label-config .label-purple } default: 60s {: .label .label-config .label-blue } required: no {: .label .label-config .label-green }

This adjusts the requested timeout for a Webauthn interaction. The period of time is in duration notation format.

FAQ

See the Security Key FAQ for the FAQ.