Webauthn not working & 2FA too

ℹ️ Support
, ,
1

Can not add security key/Webauthn device (Yubico 5 NFC).

Nextcloud version: 26.0.0
Operating system and version: Ubuntu 22.04.2 LTS (ARM-Raspberry Pi 4b)
Apache or nginx version: Apache/2.4.52 (Ubuntu)
PHP version: 8.1.2-1ubuntu2.11
Config similar to https://pimylifeup.com/raspberry-pi-nextcloud-server/

Firefox 111.0.1 ;
Brave 1.49.132 ;
Chromium 111.0.5563.147 ;

Connect by HTTPS with Self-signed certificate

The issue:
Can not add security key/Webauthn device (Yubico 5 NFC).
After click button “add WebAuthn device” → no any “reaction” like pop-up or something (less 1 secound can see information " Please authorize your WebAuthn device. " in place button, but nothing more).

Added APP Two-Factor WebAuthn v. 1.1.2
Then after Two-Factor Authentication → add security key, only information "The operation is insecure. "

The output of Administration->Overview-> Security & setup warnings:

  • Your web server is not properly set up to resolve “/.well-known/webfinger”.
  • Your web server is not properly set up to resolve “/.well-known/nodeinfo”.
  • Your web server is not properly set up to resolve “/.well-known/caldav”.
  • Your web server is not properly set up to resolve “/.well-known/carddav”. Further information can be found in the documentation :arrow_upper_right:.

Steps to replicate it:

  1. Personal settings
  2. Security
  3. Passwordless Authentication → Add Webauthn device
    or
  4. Two-Factor Authentication → Add security key

Tried fix it, but I do not know what i am doing wrong yet.
Please about help.

1 Like
2

hi @NOTI welcome to the forum :handshake:

Please use the search - lot of issues have been discussed already

sounds like you run you server without TLS… this is not allowed for Webauthn… Please switch to https://

3

Hi @wwe , thx for trying help, but … it is not probably this, pls read again my first post :slightly_smiling_face:

I wrote about HTTPS before too.

Connected*

  1. Are the webfinger, nodeinfo, caldav, carddav necessary for the webauthn?

  2. Please about some other suggestions. :slightly_smiling_face:

4

I missed your statement about self-signed certificates - but yes this certificates are not secure by definition (of browser vendor)… I know technically there is no issue but from the idealistic point of view self-signed certs are bad so valid public TLS cert is often pre-requisite to be “secure”