Universal 2nd Factor Authentication (U2F)

Universal 2nd Factor (U2F) is an open authentication standard that strengthens and simplifies two-factor authentication using specialized USB or NFC devices.

LLNG can propose to users to register their keys. When done, registered user can't login without using its key.

Note that it's a second factor, not an authentication module. Users are authenticated by both login form and U2F form.

Prerequisites and dependencies

This feature uses Crypt::U2F::Server::Simple that is available only via CPAN for now. Before compiling it, you must install Yubico's C library headers (called libu2f-server-dev on Debian).

An HTTPS portal is required to use U2F

Configuration

In the manager (advanced parameters), you just have to enable it:

U2F ⇒ Activation: set it to “on”
U2F ⇒ Self registration: set it to “on” (to display this application on the menu, create an application that points to https://auth.your.domain/u2fregister.html)
U2F ⇒ Authentication level: you can overwrite here auth level for U2F registered users. Leave it blank keeps auth level provided by first authentication module (default: 2 for user/password based modules). It is recommended to set an higher value here if you want to give access to some apps only to users enrolled

If you want to use a custom rule for “activation” and want to keep self-registration, you must include this in your rule: $_u2fKeyHandle and $_u2fUserKey, else U2F will be required even if users are not registered. This is automatically done when “activation” is simply set to “on”.

Browser compatibility

Chrome/Chromium >= 38
Firefox :
- 38 to 56 with U2F Support Add-on
- 57 to 58, with “security.webauth.u2f” set to “true” in “about:config” (see Yubico explanations)
- probably enabled by default for versions >= 59
Opera >= 40

Enrollment

If you've enabled self registration, users can register their FIDO key using https://portal/u2fregister.html

Assistance

If a user lost its key, you may remove it's persistent session using the session explorer.

Developer corner

If you have another U2F registration interface, you have to populate session (using exported variables) to set these keys:

Name	Value
_u2fKeyHandle	key handle value, base64 encoded
_u2fUserKey	user key value, base64 encoded

Note that both “origin” and “appId” are fixed to portal URL.

Table of Contents