A <ahref="http://www.yubico.com/yubikey"class="urlextern"title="http://www.yubico.com/yubikey"rel="nofollow">Yubikey</a> is a small material token manufactured by <ahref="http://www.yubico.com"class="urlextern"title="http://www.yubico.com"rel="nofollow">Yubico</a>. It sends an OTP, which is validated via Yubico server.
You must install <ahref="http://search.cpan.org/~massyn/Auth-Yubikey_WebClient/"class="urlextern"title="http://search.cpan.org/~massyn/Auth-Yubikey_WebClient/"rel="nofollow">Auth::Yubikey_WebClient</a> package.
You have to retrieve a client ID and a secret key from Yubico. See <ahref="https://upgrade.yubico.com/getapikey/"class="urlextern"title="https://upgrade.yubico.com/getapikey/"rel="nofollow">Yubico API</a> page.
<liclass="level1"><divclass="li"><strong>Authentication level</strong>: you can overwrite here auth level for Yubikey registered users. Leave it blank keeps auth level provided by first authentication module <em>(default: 2 for user/password based modules)</em>. <strong>It is recommended to set an higher value here if you want to give access to some apps only to enrolled users</strong></div>
<liclass="level1"><divclass="li"><strong><abbrtitle="Application Programming Interface">API</abbr> secret key</strong>: given by Yubico or another service</div>
<liclass="level1"><divclass="li"><strong><abbrtitle="Uniform Resource Locator">URL</abbr></strong>: Url of service (leave blank to use Yubico cloud services)</div>
<liclass="level1"><divclass="li"><strong>OTP public ID part size</strong>: leave it to default (12) unless you know what you are doing</div>
</li>
<liclass="level1"><divclass="li"><strong>Allow users to remove Yubikey</strong>: If enabled, users can unregister Yubikey device.</div>
</li>
<liclass="level1"><divclass="li"><strong>Lifetime</strong>: Unlimited by default. Set a Time To Live in seconds. TTL is checked at each login process if set. If TTL is expired, relative Yubikey is removed.</div>
<divclass="noteimportant">If you want to use a custom rule for “activation” and want to keep self-registration, you must include this in your rule: <code>$_2fDevices =~ /“type”:\s*“UBK”/s</code>, else Yubikey will be required even if users are not registered. This is automatically done when “activation” is simply set to “on”.
If you don't want to use self-registration, set public part of user's yubikey in Second Factor Devices array (JSON) in your user-database. Then map it to the _2fDevices attribute <em>(see <ahref="exportedvars.html"class="wikilink1"title="documentation:2.0:exportedvars">exported variables</a>)</em>:
If you have enabled self registration, users can register their U2F keys using <ahref="https://portal/2fregisters"class="urlextern"title="https://portal/2fregisters"rel="nofollow">https://portal/2fregisters</a>