A <ahref="http://www.yubico.com/yubikey"class="urlextern"title="http://www.yubico.com/yubikey"rel="nofollow">Yubikey</a> is a small material token manufactured by <ahref="http://www.yubico.com"class="urlextern"title="http://www.yubico.com"rel="nofollow">Yubico</a>. It sends an OTP, which is validated via Yubico server.
You must install <ahref="http://search.cpan.org/~massyn/Auth-Yubikey_WebClient/"class="urlextern"title="http://search.cpan.org/~massyn/Auth-Yubikey_WebClient/"rel="nofollow">Auth::Yubikey_WebClient</a> package.
You have to retrieve a client ID and a secret key from Yubico. See <ahref="https://upgrade.yubico.com/getapikey/"class="urlextern"title="https://upgrade.yubico.com/getapikey/"rel="nofollow">Yubico API</a> page.
<liclass="level1"><divclass="li"> Authentication level: you can overwrite here auth level for Yubikey registered users. Leave it blank keeps auth level provided by first authentication module <em>(default: 2 for user/password based modules)</em>. <strong>It is recommended to set an higher value here if you want to give access to some apps only to enrolled users</strong></div>
<divclass="noteimportant">If you want to use a custom rule for “activation” and want to keep self-registration, you must include this in your rule: <code>$_2fDevices =~ /“type”:\s*“UBK”/s</code>, else Yubikey will be required even if users are not registered. This is automatically done when “activation” is simply set to “on”.
If you don't want to use self-registration, set public part of user's yubikey in Second Factor Devices array (JSON) in your user-database. Then map it to the _2fDevices attribute <em>(see <ahref="exportedvars.html"class="wikilink1"title="documentation:2.0:exportedvars">exported variables</a>)</em>:
If you have enabled self registration, users can register their U2F keys using <ahref="https://portal/2fregisters"class="urlextern"title="https://portal/2fregisters"rel="nofollow">https://portal/2fregisters</a>