# WebAuthn WebAuthn is a web API for creating and using strong public-key credentials to authenticate users. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Passkeys in B2B: the real risk is recovery DevFeed: [Passkeys in B2B: the real risk is recovery]() Original publisher: [Read original article]() Author: WorkOS Published: 2026-08-06T15:29:33Z Content type: article Language: en Sources: [WorkOS Blog]() Topics: [Passkeys](), [WebAuthn](), [Cloud](), [systems]() Tags: [b2b](), [cloud](), [cryptographic](), [phishing](), [recovery]() ### AI overview The article explains why consumer passkey guidance does not fully apply to B2B systems. Although passkeys are phishing-resistant WebAuthn credentials, synced passkeys may reside in employees' personal cloud accounts, creating enrollment, ownership, recovery, and revocation challenges when devices are lost or employees leave. ### Source excerpt Consumer passkey guidance optimizes for the login. In B2B, the enrollment and recovery story is what decides whether passkeys actually work. Here's the gap. ## Keycloak 26.7.1 released DevFeed: [Keycloak 26.7.1 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-08-05T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Security](), [Authorization](), [OpenID connect (OIDC)](), [saml](), [LDAP](), [WebAuthn]() Tags: [2026](), [authorization](), [cve](), [extension](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.7.1 is released with multiple security fixes addressing authorization bypasses, privilege escalation, protocol validation issues, and other vulnerabilities, along with bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #49429 [CVE-2026-9793] JWE request object bypasses requestObjectSignatureAlg enforcement oidc #50445 [CVE-2026-4629] Privilege escalation via hardcoded role mapper injection in manage-clients admin/api #50569 [CVE-2026-14209] Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 admin/fine-grained-permissions #50615 [CVE-2026-14614] Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment admin/fine-grained-permissions #50617 [CVE-2026-14615] FGAP v2 parent group children endpoint bypasses per-child view permission filter admin/fine-grained-permissions #51467 CVE-2026-15573 Authorization bypass via unnormalized uri matching in pathmatcher #51468 CVE-2026-15572 DCR protocol mapper type-swap policy bypass allows privilege escalation #51469 CVE-2026-16100 Unbounded metric cardinality in user event metrics via request-controlled error text #51470 CVE-2026-16442 SAML idp-initiated broker login bypasses link-only restriction #51471 CVE-2026-16443 SAML broker metadata import disables response signature validation #51472 CVE-2026-16071 LDAP entry-dn user search bypasses configured users dn boundary #51473 CVE-2026-16102 Default DCR policy allows role forgery via user property mappers Bugs #50719 WebAuthn authenticator attachment policy is bypassed when the client omits the attachment field authentication/webauthn #50750 Clustering test broken in 26.7 release branch ci #50836 Kustomize cluster-wide faulty Role&RoleBinding operator #50850 New Password is commited when multiple Password Reset is detected authentication #50882 500 when client requests `organization` scope with it already set to `Default` authentication #50928 IllegalFormatConversionException in LiquibaseDBLockProviderFactory and wrong time conversion core ## Opaque, Interoperable Passkey Records (and a Go API) DevFeed: [Opaque, Interoperable Passkey Records (and a Go API)]() Original publisher: [Read original article]() Author: Filippo Valsorda Published: 2026-07-20T22:33:32Z Content type: article Language: en Sources: [Filippo Valsorda]() Topics: [WebAuthn](), [Passkeys](), [Go Language](), [Security](), [API](), [passwords]() Tags: [api](), [authentication](), [go](), [password](), [security](), [web](), [web-developers]() ### AI overview The article proposes interoperable passkey record encodings for WebAuthn credentials, allowing applications to store records as opaque strings similar to password hashes. It also presents a potential Go API for handling these records. ### Source excerpt Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them. ## Sign in to Pulumi Cloud with Passkeys DevFeed: [Sign in to Pulumi Cloud with Passkeys]() Original publisher: [Read original article]() Author: Devon Grove Published: 2026-07-13T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [Passkeys](), [WebAuthn](), [Security](), [passwords]() Tags: [bitbucket](), [features](), [gitlab](), [google](), [oauth](), [passwords](), [product](), [product-launches](), [security]() ### AI overview Pulumi Cloud now supports passkeys for users who sign in with an email address and password. Passkeys use device-stored public-key credentials and WebAuthn, while identity-provider sign-in flows remain unchanged. ### Source excerpt Pulumi Cloud now supports passkeys for users who sign in with email and password. Select a button, approve with Touch ID, Face ID, Windows Hello, or your hardware key, and you're signed in. A passkey is a public-key credential stored on your device: your phone, your laptop, a hardware key (YubiKey, Google Titan, etc.), or your password manager can all function as the authenticator. When you sign in, your device authenticates you locally and signs a challenge from Pulumi Cloud with the private key. The private key stays on your device -- Pulumi Cloud never sees or stores it. Passkeys are built on the WebAuthn standard, so they're already supported on every major browser and operating system. Who this is for This release applies to users who sign in to Pulumi Cloud with an email address and password. If you sign in through an identity provider (IdP), such as GitHub OAuth, GitLab, Bitbucket, Google, or your organization's SAML SSO, your existing flow is unchanged. Why passkeys Passwords have always been the weakest link in account security. Since they are shared secrets, they are vulnerable to phishing attacks, and every place you type one is a place that can be impersonated or a data store that can be leaked. Passkeys swap that out for a per-site key pair that lives on your device: Phishing-resistant by design. A passkey is bound to the exact origin it was registered for. A look-alike domain can't trigger your authenticator. Synced across your devices. Apple iCloud Keychain, Google Password Manager, 1Password, Dashlane, Bitwarden: most credential managers now sync passkeys end-to-end-encrypted to every device you've signed in on. Discoverable. Pulumi Cloud doesn't need to know which user you are before you authenticate. Just select "Sign in with a passkey" and your device offers the right credential. Nothing to remember. A passkey lives on your device. There's no string to memorize, and no sensitive credential stored by us. Setting up a passkey The next time you sign i ## AI, OAuth, And Other Platform APIs In The Core DevFeed: [AI, OAuth, And Other Platform APIs In The Core]() Original publisher: [Read original article]() Author: Shai Almog Published: 2026-05-31T00:00:00Z Content type: article Language: en Sources: [CodeName One]() Topics: [Artificial Intelligence](), [OAuth](), [OpenID connect (OIDC)](), [WebAuthn](), [Passkeys](), [Framework](), [API](), [Large Language Model](), [Ollama](), [llama.cpp](), [vllm](), [SQLite]() Tags: [agent-skill](), [ai](), [api](), [authentication](), [function-calling](), [llama-cpp](), [llm](), [oauth](), [oidc](), [ollama](), [sqlite](), [streaming](), [vllm]() ### AI overview This follow-up release article describes platform APIs moved into the framework core, including a first-class LLM client and ChatView, OAuth and OIDC authentication, WebAuthn passkeys, WiFi and connectivity APIs, and share-sheet callbacks. It also outlines streaming chat, tool calls, embeddings, image generation, and local-model support through Ollama-compatible endpoints. ### Source excerpt Deeper AI integration in the framework core, modern authentication via OAuth / OIDC and WebAuthn passkeys driven from the system browser, and a few smaller additions alongside. ## Keycloak 26.6.2 released DevFeed: [Keycloak 26.6.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2026-05-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Vulnerabilities](), [Security](), [Authentication](), [OpenID connect (OIDC)](), [WebAuthn](), [XSS]() Tags: [2](), [2026](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oidc](), [openid-connect](), [permission](), [pii](), [release](), [saml](), [security](), [sso](), [vulnerability](), [xss]() ### AI overview Keycloak 26.6.2 is a security-focused release that fixes multiple vulnerabilities, including denial-of-service issues, request smuggling, access-control flaws, stored XSS, WebAuthn policy bypass, token disclosure, account takeover, and PII enumeration. It also includes enhancements and bug fixes. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Security fixes #47485 CVE-2026-33871 HTTP/2 CONTINUATION Frame Flood Denial of Service #47486 CVE-2026-33870 RFC violation: HTTP Request Smuggling primitive via Chunked Extension Quoted-String Parsing #47932 [CVE-2026-4628] Improper Access Control on Keycloak Server through UMA resource management endpoints via PUT parameters authorization-services #48049 [CVE-2026-37980] Stored XSS in select-organization.ftl - FreeMarker HTML-escape insufficient in inline JS handler organizations #48275 CVE-2026-5588 Bouncy Castle Crypto Package For Java: Use of a Broken or Risky Cryptographic Algorithm vulnerability in bcpkix modules core #48388 [CVE-2026-6856] Acceptable AAGUID policy bypass via packed self-attestation in WebAuthn registration authentication/webauthn #48570 [CVE-2026-0636, CVE-2026-3505, CVE-2026-5598] Multiple bouncycastle CVEs core #49108 [CVE-2026-7307] Denial of service when sending a crafted request to the /saml endpoint #49109 [CVE-2026-7504] Security Vulnerability Report: Redirect URI Validation Bypass in Keycloak #49110 [CVE-2026-7571] Access token disclosure and implicit flow bypass via forged client data #49111 [CVE-2026-7507] Session fixation in OIDC login flow leading to account takeover #49112 [CVE-2026-37982] Execute-actions token replay allows unauthorized WebAuthn credential enrollment on victim account #49113 [CVE-2026-37979] OIDC Introspection endpoint does not enforce audience restriction, leaking claims from lightweight access tokens #49114 [CVE-2026-37978] Cross-role PII leakage via evaluate-scopes endpoints bypasses user view permission #49115 [CVE-2026-4630] Keycloak Authorization Services Protection API IDOR (Cross-Resource Server Access) #49116 [CVE-2026-37981] Broken Access Control in Account Resources User Lookup allows PII enumeration Enhancements #47728 Monitor backups for CNPG - ## Passkeys support in upcoming Keycloak release (26.4) DevFeed: [Passkeys support in upcoming Keycloak release (26.4)]() Original publisher: [Read original article]() Author: Peter Skopek Published: 2025-09-16T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [Passkeys](), [Authentication](), [WebAuthn]() Tags: [authentication](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [openid-connect](), [password](), [release](), [saml](), [sso]() ### AI overview Keycloak 26.4.0 is announced as adding official passkey support. The feature uses conditional and modal UI, is disabled by default, and can be enabled through the WebAuthn Passwordless Policy. A new conditional credential authenticator can skip 2FA when a passkey was used as the primary credential. ### Source excerpt Passkeys have been available in Keycloak since version 23.0.0 as a preview feature. We are happy to announce official support for passkeys in upcoming Keycloak 26.4.0. What is passkey? Definition from FIDO Alliance A passkey is a FIDO authentication credential based on FIDO standards, that allows a user to sign in to apps and websites with the same process that they use to unlock their device (biometrics, PIN, or pattern). Passkeys are FIDO cryptographic credentials that are tied to a user's account on a website or application. More info What's new? Passkeys are now seamlessly integrated to Keycloak using both conditional and modal UI. There is no need to modify default browser flow to use passkeys. Passkeys support is not enabled by default. It needs to be enabled in the WebAuthn Passwordless Policy (Authentication -> Policies -> Webauthn Passwordless Policy). There is new Conditional - credential authenticator that checks if a specific credential type (passkey) has been used during the authentication process. It is added to the default browser flow to skip 2FA in case a passkey was used to log in as the primary credential. Further quite hidden passkey support is also in the re-authentication form, where users can choose passkey as well as password. For more information check Keycloak Server Administration Guide. A few examples Let's start form the fresh Keycloak database. The first steps are obvious ones. create admin user create one test user enable passkey support in (Authentication -> Policies -> Webauthn Passwordless Policy) set default required action in (Authentication -> Required actions -> Webauthn Register Passwordless) (This step is not necessary, one can use Account Console to register a passkey.) No need for any other changes. Conditional UI Conditional UI is displayed when other components of the platform supports this UI style and username input field is present. It can be achieved for example on Linux using Google Chrome browser and 1password password man ## Keycloak 26.3.0 released DevFeed: [Keycloak 26.3.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2025-07-03T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [releases](), [Authentication](), [Logging](), [Passkeys](), [WebAuthn](), [migration](), [OAuth 2.0](), [openid](), [Latency]() Tags: [authentication](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [latency](), [ldap](), [logging](), [migration](), [new-feature](), [oauth-2-0](), [openid-connect](), [otp](), [release](), [releases](), [saml](), [sso]() ### AI overview Keycloak 26.3.0 is a software release that adds supported 2FA recovery codes, simplifies WebAuthn and Passkeys registration and account linking, expands OAuth 2.0 and OpenID Connect connectivity, improves logging throughput and latency, and introduces experimental rolling updates for patch releases. ### Source excerpt To download the release go to Keycloak downloads. Highlights This release delivers advancements to optimize your system and improve the experience of users, developers and administrators: Account recovery with 2FA recovery codes, protecting users from lockout. Simplified experiences for application developers with streamlined WebAuthn/Passkey registration and simplified account linking to identity providers via application initiated actions. Broader connectivity with the ability to broker with any OAuth 2.0 compliant authorization server, and enhanced trusted email verification for OpenID Connect providers. Asynchronous logging for higher throughput and lower latency, ensuring more efficient deployments. For administrators, experimental rolling updates for patch releases mean minimized downtime and smoother upgrades. Read on to learn more about each new feature, and find additional details in the upgrading guide if you are upgrading from a previous release of Keycloak. Recovering your account if you lose your 2FA credentials When using for example a one-time-password (OTP) generators as a second factor for authenticating users (2FA), a user can get locked out of their account when they, for example, lose their phone that contains the OTP generator. To prepare for such a case, the recovery codes feature allows users to print a set of recovery codes as an additional second factor. If the recovery codes are then allowed as an alternative 2FA in the login flow, they can be used instead of the OTP generated passwords. With this release, the recovery codes feature is promoted from preview to a supported feature. For newly created realms, the browser flow now includes the Recovery Authentication Code Form as Disabled, and it can be switched to Alternative by admins if they want to use this feature. For more information about this 2FA method, see the Recovery Codes chapter in the Server Administration Guide. Performance improvements to import, export and migration The time ## A Tour of WebAuthn DevFeed: [A Tour of WebAuthn]() Original publisher: [Read original article]() Author: Adam Langley Published: 2024-12-23T00:00:00Z Content type: article Language: en Sources: [ImperialViolet]() Topics: [WebAuthn](), [Passkeys]() Tags: [conference](), [html]() ### AI overview The author announces that a longer work about understanding and using WebAuthn is now available online in HTML. The work expands on earlier posts about WebAuthn and passkeys and was previously distributed as a printed booklet at a FIDO conference. ### Source excerpt I've done a bunch of posts about WebAuthn/passkeys over time. This year I decided to flesh them out a bit into a longer work on understanding and using WebAuthn. If you were at the FIDO conference in Carlsbad this year, you may have received a physical, printed booklet of the result. It took a while to get around to converting to HTML, but the text is now available online. ## Keycloak 26.0.2 released DevFeed: [Keycloak 26.0.2 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-10-24T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [JavaScript](), [OpenID connect (OIDC)](), [OpenAPI Specification](), [OpenTelemetry](), [Passkeys](), [WebAuthn](), [Security]() Tags: [ci](), [idm](), [javascript](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openapi](), [openid-connect](), [opentelemetry](), [quarkus](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 26.0.2 is a maintenance release published on October 24, 2024. It includes an enhancement for trusted certificate configuration and resolves bugs affecting JavaScript adapters, GUI validation, the Organization API documentation, passkeys, OpenTelemetry initialization, organization features, imports, password validation, CLI handling, and other areas. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Enhancements #32110 [Documentation] - Configuring trusted certificates - Fully specify truststore path dist/quarkus Bugs #15635 oidc - JavaScript-Adapter LocalStorage#clearExpired does not clear all possible items adapter/javascript #19101 Uncaught (in promise): QuotaExceededError adapter/javascript #20287 When using `oidcProvider` config url (.well-known) it's not possible to use `silentCheckSsoRedirectUri` adapter/javascript #28978 some GUI validation check missing admin/ui #30832 Organization API not available from OpenAPI documentation admin/api #31724 Logout not working after removing Identity Provider of user identity-brokering #33072 Passkeys: Infinite (re-)loading loop on browsers with WebAuthn Conditional UI disabled authentication/webauthn #33844 Wrong documentation link in keycloak-js readme docs #33902 Not persisted config settings prevent server start dist/quarkus #33948 [PERF] OpenTelemetry is initialized even when disabled #33968 Not possible to close dialog boxes when clicking buttons or the close icon admin/ui #33991 Doc CI - broken links error docs #34009 grammatical error in "Managing Organizations" documentation docs #34015 Home URL for security-admin-console is broken admin/ui #34028 Custom keycloak login theme styles.css return error 404 login/ui #34049 Org Invite: `linkExpiration` template variable represents 54 years in minutes organizations #34063 Respect the locale set to a user when redering verify email pages user-profile #34069 Do not show domain match message in the identity-first login when no login hint is provided organizations #34075 Flaky test: org.keycloak.testsuite.broker.KcOidcBrokerTest#testPostBrokerLoginFlowWithOTP_bruteForceEnabled ci #34095 Keycloak 26.0.0/26.0.1 Import Issue: Multiple Realms Not Imported, Duplicated Realm Imported Instead import-export #34151 JS passw ## Keycloak 25.0.6 released DevFeed: [Keycloak 25.0.6 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-09-19T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [LDAP](), [saml](), [Quarkus](), [WebAuthn]() Tags: [bugs](), [cve](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [openid-connect](), [release](), [saml](), [sso]() ### AI overview Keycloak 25.0.6 is released with resolved issues affecting network responses, user properties, WebAuthn login flows, hostname paths, client annotations, realm imports, LDAP searches, and SAML security. The release also addresses two CVEs. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #30604 Network response was not OK. saml #31165 Re-enabling a temporarily locked user (brute-force) deletes all user properties and attributes admin/ui #32100 Remember Me with External Infinispan is not works properly infinispan #32578 WebAuthn Flows Broken in login.v2 login/ui #32643 Dots are not allowed in the path in Hostname v2 dist/quarkus #32731 KeyCloak Admin Client uses non-standard `@NoCache` annotation which is an issue for Quarkus admin/client-java #32799 Realm import fails when client configures default_acr values import-export #32870 Increased DB activity due to changes in LDAPStorageManager.searchForUserByUserAttributeStream ldap #33115 CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect #33116 CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak ## Keycloak 23.0.4 released DevFeed: [Keycloak 23.0.4 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2024-01-08T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [WebAuthn](), [OpenID connect (OIDC)](), [Cross-origin resource sharing (CORS)](), [Deadlock](), [Parsing](), [passwords]() Tags: [cors](), [deadlock](), [idm](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [migration-guide](), [oidc](), [openid-connect](), [parsing](), [password](), [release](), [saml](), [sso](), [ui]() ### AI overview Keycloak 23.0.4 was released on January 8, 2024. The release provides download and upgrade guidance and lists resolved issues affecting WebAuthn tests, remote session preloading, offline sessions, password visibility styling, administrative APIs, CORS, user-profile scopes, CI label parsing, OIDC logout tokens, and Catalan HTML email links. ### Source excerpt To download the release go to Keycloak downloads. Upgrading Before upgrading refer to the migration guide for a complete list of changes. All resolved issues Bugs #9693 PubKeySignRegisterTest failures in WebAuthn tests testsuite #24508 Deadlock when pre-loading remote sessions from external Infinispan storage #24763 Remove sign out action for offline sessions admin/ui #25016 Make password visibility css classes configurable for themes login/ui #25096 Meaning of briefRepresentation query parameter is inverted in GroupResource.getSubGroups admin/api #25111 RealmAdminResource.getGroupByPathGroup does not work with space in path parameter admin/api #25120 CORS issue in 'openid-connect/certs' endpoint oidc #25475 User Profile: If required roles ("user") and reqired scopes are set, the required scopes have no effect user-profile #25633 Parsing of labels issue IDs doesn't work with colons and the "fixes" keyword ci #25753 Backchannel logout token is missing the "exp" claim oidc #25878 HTML emails in Catalan don't contain links translations ## Enforcing device trust on code changes DevFeed: [Enforcing device trust on code changes]() Original publisher: [Read original article]() Author: Griffin Choe Published: 2023-12-08T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Device Trust](), [Figma](), [GitHub](), [Security](), [pull-requests](), [Single sign-on (SSO)](), [WebAuthn](), [OAuth](), [ssh](), [Cryptography]() Tags: [cryptographic](), [device-trust](), [encryption](), [figma](), [git](), [github](), [oauth](), [okta](), [pull-requests](), [security](), [security-engineering](), [ssh](), [sso](), [verification]() ### AI overview Figma's security engineering team describes enforcing device trust for code changes merged into GitHub release branches. The approach combines commit signature verification with Okta Device Trust certificates to ensure changes originate from trusted, company-managed devices, while addressing risks from leaked credentials, tokens, and SSH keys. ### Source excerpt Here's how the Figma security engineering team leveraged commit signatures and Okta Device Trust certificates to protect GitHub release branches. ## Keycloak 23.0.0 released DevFeed: [Keycloak 23.0.0 released]() Original publisher: [Read original article]() Author: Keycloak Team Published: 2023-11-23T00:00:00Z Content type: release Language: en Sources: [Keycloak Blog]() Topics: [Keycloak](), [OAuth 2.0](), [openid](), [Passkeys](), [WebAuthn](), [Authentication](), [Security]() Tags: [idm](), [improvements](), [interoperability](), [kerberos](), [keycloak](), [keycloak-release](), [ldap](), [oauth](), [oauth-2-0](), [openid](), [openid-connect](), [release](), [saml](), [security](), [sso]() ### AI overview Keycloak 23.0.0 adds support for FAPI 2 draft client profiles, previews DPoP and Passkeys, expands introspection endpoint flexibility, adds a feature flag for the OAuth 2.0 device authorization grant, and improves WebAuthn interoperability. ### Source excerpt To download the release go to Keycloak downloads. Highlights OpenID Connect / OAuth 2.0 FAPI 2 drafts support Keycloak has new client profiles fapi-2-security-profile and fapi-2-message-signing, which ensure Keycloak enforces compliance with the latest FAPI 2 draft specifications when communicating with your clients. Thanks to Takashi Norimatsu for the contribution. DPoP preview support Keycloak has preview for support for OAuth 2.0 Demonstrating Proof-of-Possession at the Application Layer (DPoP). Thanks to Takashi Norimatsu and Dmitry Telegin for their contributions. More flexibility for introspection endpoint In previous versions, introspection endpoint automatically returned most claims, which were available in the access token. Now there is new switch Add to token introspection on most of protocol mappers. This addition allows more flexibility as introspection endpoint can return different claims than access token. This is first step towards "Lightweight access tokens" support as access tokens can omit lots of the claims, which would be still returned by the introspection endpoint. When migrating from previous versions, the introspection endpoint should return same claims, which are returned from access token, so the behavior should be effectively the same by default after the migration. Thanks to Shigeyuki Kabano for the contribution. Feature flag for OAuth 2.0 device authorization grant flow The OAuth 2.0 device authorization grant flow now includes a feature flag, so you can easily disable this feature. This feature is still enabled by default. Thanks to Thomas Darimont for the contribution. Authentication Passkeys support Keycloak has preview support for Passkeys. Passkey registration and authentication are realized by the features of WebAuthn. Therefore, users of Keycloak can do passkey registration and authentication by existing WebAuthn registration and authentication. Both synced passkeys and device-bound passkeys can be used for both Same-Device and Cr ## Chrome support for passkeys in iCloud Keychain DevFeed: [Chrome support for passkeys in iCloud Keychain]() Original publisher: [Read original article]() Author: Adam Langley Published: 2023-10-18T00:00:00Z Content type: release Language: en Sources: [ImperialViolet]() Topics: [Chrome](), [Passkeys](), [WebAuthn](), [macOS](), [iOS](), [Google]() Tags: [browsers](), [chrome](), [ios](), [macos](), [settings](), [stable-channel](), [sync](), [terminal]() ### AI overview Chrome 118 adds support for creating and accessing passkeys in iCloud Keychain on macOS 13.5 or later. The article explains the required permission for autofill and account-picker access, as well as iCloud account and sync requirements. ### Source excerpt Chrome 118 (which is rolling out to the Stable channel now) contains support for creating and accessing passkeys in iCloud Keychain. Firstly, I'd like to thank Apple for creating an API for this that browsers can use: it's a bunch of work, and they didn't have to. Chrome has long had support for creating WebAuthn credentials on macOS that were protected by the macOS Keychain and stored in the local Chrome profile. If you've used WebAuthn in Chrome and it asked you for Touch ID (or your unlock password) then it was this. It has worked great for a long time. But passkeys are supposed to be durable, and something that's forever trapped in a local profile on disk is not durable. Also, if you're a macOS + iOS user then it's very convenient to have passkeys sync between your different devices, but Google Password Manager doesn't cover passkeys on those platforms yet. (We're working on it.) So having iCloud Keychain support is hopefully useful for a number of people. With Chrome 118 you'll see an "iCloud Keychain" option appear in Chrome's WebAuthn UI if you're running macOS 13.5 or later: You won't, at first, see iCloud Keychain credentials appear in autofill. That's because you need to grant Chrome permission to access the metadata of iCloud Keychain passkeys before it can display them. So the first time you select iCloud Keychain as an option, you'll see this: If you accept, then iCloud Keychain credentials will appear in autofill, and in Chrome's account picker when you click a button to use passkeys. If you decline, then you won't be asked again. You can still use iCloud Keychain, but you'll have to go though some extra clicks every time. You can change your mind in System Settings -> Passkeys Access for Web Browsers, or you can run tccutil reset WebBrowserPublicKeyCredential from a terminal to reset that permission system wide. (Restart Chrome after doing either of those things.) Saving a passkey in iCloud Keychain requires having an iCloud account and having iCloud K ## Signature counters DevFeed: [Signature counters]() Original publisher: [Read original article]() Author: Adam Langley Published: 2023-08-05T00:00:00Z Content type: article Language: en Sources: [ImperialViolet]() Topics: [WebAuthn](), [Security](), [private key]() Tags: [account](), [private-key](), [security](), [signal]() ### AI overview The article explains WebAuthn signature counters, including their optional nature, how non-zero counters should increase for future assertions from a credential, and how counter inconsistencies might indicate a cloned security key. It argues that sites using counters should lock the account, investigate, and replace the key rather than merely reject the assertion. ### Source excerpt If you look at the structure of the signed messages in WebAuthn you'll notice that one of the fields is called the "signature counter". In the previous long post I said to ignore it, which is still correct, but here's why. Signature counters are optional for the authenticator to implement: it's valid for a security key not to have a signature counter, although the vast majority of them do. In that case, the counter value is always zero. But once a website has seen a non-zero value, then the security key has to ensure that the counter, for all future assertions from a given credential, is strictly increasing. The motivation of the signature counter is that it might allow websites to detect when a security key has been cloned. Cloning a security key is supposed to be very difficult. At the very least, you should need physical access to it, and hopefully you need to spend a substantial amount of time invasively interrogating it. But, if you assume all that happened, then one could clone a security key (probably destroying it in the process), get the private key of a credential out of it, and create a working replica which could be slipped back into the possession of the legitimate user, leaving them unaware that anything has happened. At this point, the attacker can create assertions at will because they know the credential's private key. If all that has happened, then the signature counter might uncover it. Unless the attacker can know exactly when the legitimate user has created an assertion, and thus incremented the counter, then eventually either they or the real user will create an assertion where the counter didn't increase. You might be able to tell, but I consider this a rather far-fetched scenario. Nevertheless, if a website wants to use the signature counters, then it must treat any non-incrementing counter as a signal to lock the account and trigger an investigation. At a minimum, the security key in question should be replaced. Simply rejecting the assertio ## A short overview of Passkeys, and how to use them to secure your infrastructure with Teleport DevFeed: [A short overview of Passkeys, and how to use them to secure your infrastructure with Teleport]() Original publisher: [Read original article]() Author: ben@goteleport.com (Ben Arent) Published: 2023-01-12T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Passkeys](), [Authentication](), [WebAuthn](), [Security](), [API](), [QR Code]() Tags: [android](), [authentication](), [ios](), [private-key](), [qr-code](), [security](), [verification](), [windows-11]() ### AI overview This article explains passkeys as a passwordless authentication method for securing infrastructure with Teleport. It describes cross-platform and cross-browser login, cloud storage backed by a phone's secure enclave, and FIDO2 proximity proof using Bluetooth when a QR code is scanned. ### Source excerpt A short overview of Passkeys, and how to use them to secure your infrastructure with Teleport. ## The Complete Guide to iOS 16 Passkeys - App and Backend Implementation DevFeed: [The Complete Guide to iOS 16 Passkeys - App and Backend Implementation]() Original publisher: [Read original article]() Author: Allison Poppe Published: 2022-11-03T14:29:49Z Content type: tutorial Language: en Sources: [QuickBird Studios Blog]() Topics: [Passkeys](), [Authentication](), [iOS](), [WebAuthn](), [API](), [Back end]() Tags: [authentication](), [guide](), [ios](), [post](), [private-key](), [public-key](), [verification]() ### AI overview This tutorial explains how to integrate iOS 16 passkeys into an application, covering app-side authentication and the backend API endpoints needed to support registration and sign-in. It describes passkeys as Apple's implementation of WebAuthn and explains that authentication uses a public key stored on the server while the private key remains on the user's device. ### Source excerpt With iOS 16 Apple introduced a way to go passwordless called Passkeys. In this article, we are covering what needs to be done on the app side but also what needs to be implemented in the backend The post The Complete Guide to iOS 16 Passkeys - App and Backend Implementation appeared first on QuickBird Studios. ## How Passwordless Works DevFeed: [How Passwordless Works]() Original publisher: [Read original article]() Author: alan.parra@goteleport.com (Alan Parra) Published: 2022-08-04T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [WebAuthn](), [Authentication](), [passwords](), [Protocol (disambiguation)](), [client](), [Security](), [browser](), [Server]() Tags: [authentication](), [browser](), [password](), [security](), [server](), [specifications](), [web-authentication]() ### AI overview This tutorial explains passwordless and usernameless authentication, focusing on how WebAuthn uses a challenge-response protocol involving an authenticator, a web browser, and a server. It also introduces related FIDO2 specifications and discusses the approach's user-experience and security trade-offs. ### Source excerpt Learn how passwordless authentication works and how it's built using WebAuthn. ## Teleport Joins the FIDO Alliance to Develop Passwordless Infrastructure Access DevFeed: [Teleport Joins the FIDO Alliance to Develop Passwordless Infrastructure Access]() Original publisher: [Read original article]() Author: sasha@goteleport.com (Sasha Klizhentas) Published: 2022-07-28T00:00:00Z Content type: article Language: en Sources: [Teleport]() Topics: [passwords](), [Authentication](), [Security](), [WebAuthn](), [Cloud]() Tags: [authentication](), [cloud](), [infrastructure](), [passwords](), [security]() ### AI overview The article announces that Teleport has joined the FIDO Alliance and describes its plan to bring FIDO-based, passwordless authentication to infrastructure resources such as servers, databases, Kubernetes clusters, and internal applications. It presents WebAuthn as the protocol underlying biometric logins on modern browsers and mobile devices. ### Source excerpt Teleport has just joined the FIDO Alliance to bring this improved mix of security and usability to infrastructure resources. ## Teleport 10 Feature Overview DevFeed: [Teleport 10 Feature Overview]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-07-27T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [releases](), [Authentication](), [Access Control](), [passwords](), [WebAuthn](), [Single sign-on (SSO)](), [browsers](), [MFA]() Tags: [access-control](), [authentication](), [least-privilege](), [password](), [release](), [releases](), [sso](), [web-browsers]() ### AI overview This article introduces the features released in Teleport 10, including passwordless infrastructure access based on FIDO2 WebAuthn, browser and authenticator compatibility, and enhanced access control through resource access requests. ### Source excerpt Introducing all the features released and scheduled for Teleport 10. ## WebAuthn, FIDO2, and CTAP: Concepts and Components of Passwordless Authentication DevFeed: [WebAuthn, FIDO2, and CTAP: Concepts and Components of Passwordless Authentication]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-07-07T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [WebAuthn](), [Authentication](), [public key](), [browsers](), [Security](), [W3C]() Tags: [authentication](), [browsers](), [protocol](), [public-key](), [security](), [w3c](), [web]() ### AI overview This tutorial explains WebAuthn as a public-key authentication API for web browsers. It introduces the relationship between WebAuthn, FIDO2, the W3C specification, and CTAP, and describes the components required for passwordless authentication. ### Source excerpt This post introduces basic concepts and details related to WebAuthn. ## Authentication Best Practices DevFeed: [Authentication Best Practices]() Original publisher: [Read original article]() Author: sakshyam.shah@goteleport.com (Sakshyam Shah) Published: 2022-02-25T00:00:00Z Content type: tutorial Language: en Sources: [Teleport]() Topics: [Authentication](), [passwords](), [Security](), [Single sign-on (SSO)](), [OAuth 2.0](), [openid](), [saml](), [Vulnerabilities](), [WebAuthn](), [password reset]() Tags: [authentication](), [best-practices](), [blog](), [blog-post](), [hardware](), [oauth2](), [openid](), [saml](), [security](), [sso](), [tokens]() ### AI overview A guide to authentication best practices, including prioritizing passwordless authentication, using federated login and single sign-on, and hardening authentication functionality. It notes that security depends on correctly implementing the relevant standards and processes. ### Source excerpt Learn about authentication best practices such as prioritizing passwordless authentication and implementing federated login with 2fa in this comprehensive blog post. ## Securing internal web apps DevFeed: [Securing internal web apps]() Original publisher: [Read original article]() Author: Max Burkhardt Published: 2021-08-12T00:00:00Z Content type: article Language: en Sources: [Figma Blog]() Topics: [Security](), [Architecture & Design](), [Authorization](), [Authentication](), [Zero Trust](), [WebAuthn](), [Figma](), [Web]() Tags: [authentication](), [authorization](), [security](), [signing](), [web](), [web-apps](), [zero-trust]() ### AI overview Figma's security team describes a system for securely providing access to internally developed web applications. The approach combines reusable cloud components and modern web security technologies, with a focus on smooth employee access, zero-trust principles, strong authentication including WebAuthn, and centralized authorization. ### Source excerpt The Figma security team built out a system to securely provide access to internal applications. Security Engineer Max Burkhardt shares how we built the system, what we learned, and how this fits into our broader approach to security at Figma. [Next page]()