WebAuthn: Issue with Fido metadata?

Mon Jun 2 10:44:33 UTC 2025

On 2 Jun 2025, at 07:59, Mats Luspa via dev <dev at shibboleth.net> wrote:

Hello!

A little late but to follow up this I managed to do what I wanted to accomplish by reading the documenation and adding some Javascript code.
That means a user with passkey registered will only be able to login with passkey. A user with no passkey will fallback to password but will not be able to degrade a user with passkey as said.

Great.

I send the documentation in the attachment if it can be of interest.

Thanks, I will take a look.

Phil

/Regards Mats

On 11/6/24 6:22 AM, Mats Luspa wrote:
Thanks for the clarification!

/Regards Mats

Den 5 nov. 2024 19:11 skrev Philip Smart <Philip.Smart at jisc.ac.uk><mailto:Philip.Smart at jisc.ac.uk>:
I've added a note on pre-populating the username set in the passwordless step to the Username and Password login page. https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#Prepopulating-the-username-input-in-the-authn%2FPassword-flow

Echoing Scott’s comment about the free support.

Phil

On 5 Nov 2024, at 14:04, Cantor, Scott <cantor.2 at osu.edu><mailto:cantor.2 at osu.edu> wrote:

Ok, I'm sorry about the many questions, but I was interested
to see if  it could be done.

Anything can be done, it requires reading the documentation and doing development work in Java or Javascript.

What you're trying to do is what the MFA flow is for, it's not got anything to do with the plugin. Orchestrating custom behavior is why it exists.

But we are not subsidized any longer to help people online. A question or two is fine, but exhaustive exploration of the software's features is just not realistic.

-- Scott

Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.

For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice

Thanks for the clarification!

/Regards Mats

Den 5 nov. 2024 19:11 skrev Philip Smart <Philip.Smart at jisc.ac.uk><mailto:Philip.Smart at jisc.ac.uk>:

I've added a note on pre-populating the username set in the passwordless step to the Username and Password login page. https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3878256667/WebAuthnAuthentication#Prepopulating-the-username-input-in-the-authn%2FPassword-flow