Universal 2nd Factor (U2F) is an open authentication standard that strengthens and simplifies two-factor authentication using specialized USB or NFC devices.
LLNG can propose to users to register their keys. When done, registered user can't login without using its key.
This feature uses Crypt::U2F::Server::Simple that is available only via CPAN for now. Before compiling it, you must install Yubico's C library headers (called libu2f-server-dev on Debian).
In the manager (second factors), you just have to enable it:
$_u2fKeyHandle and $_u2fUserKey
, else U2F will be required even if users are not registered. This is automatically done when “activation” is simply set to “on”.
If you've enabled self registration, users can register their FIDO key using https://portal/u2fregister.html
If a user lost its key, you may remove it's persistent session using the session explorer.
If you have another U2F registration interface, you have to populate session (using exported variables) to set these keys:
Name | Value |
---|---|
_u2fKeyHandle | key handle value, base64 encoded |
_u2fUserKey | user key value, base64 encoded |
Note that both “origin” and “appId” are fixed to portal URL.