WebAuthn verification settings
WebAuthn verification settings control how Advanced Identity Cloud obtains and validates metadata from the FIDO Metadata Service (MDS).
When an end user registers a WebAuthn authenticator, Advanced Identity Cloud can verify the authenticator’s attestation, which is a signed statement from the device manufacturer confirming the authenticator’s model and security properties. The FIDO MDS provides the metadata and root certificates needed to perform this verification.
These settings are available by default. You only need to configure them if you want to use a custom metadata source, such as a local or non-default metadata blob location, or if you want to enable revocation checking during attestation validation.
Learn more about how to configure Advanced Identity Cloud to store WebAuthn device profiles in WebAuthn storage & encryption settings.
Configure WebAuthn verification settings
-
In the Advanced Identity Cloud admin console, go to Authentication > Authentication Methods.
-
Click WebAuthn Verification.
-
If WebAuthn verification is not already enabled, click Enable WebAuthn Verification to create it with default settings before configuring it.
-
Configure the following settings:
- Metadata service URIs
-
The list of locations from which to download the metadata blob.
Advanced Identity Cloud verifies the blob signature against secrets mapped to the
am.authentication.nodes.webauthn.fidometadataservice.rootcertificatesecret label. - Enforce revocation check
-
This setting specifies whether Advanced Identity Cloud must check revocation entries from certificates.
The setting is disabled by default, so Advanced Identity Cloud doesn’t check presented certificates for revocation.
If you enable this setting, Advanced Identity Cloud must be able to verify any attestation certificate’s trust chain with a CRL or OCSP entry during processing.
Certificates downloaded from the FIDO Metadata Service might not have a CRL or OCSP entry.
-
Click Save.