FIDO2 authentication for centrally managed users
summary
Implementation enables FIDO2/WebAuthn with FreeIPA and SSSD so centrally managed LDAP users register a FIDO2 key via sssctl, store key mapping in LDAP, and authenticate locally to receive a Kerberos ticket on local auth when the IPA server is reachable. Demo shows local unlock works (PIN/fingerprint + touch) but Kerberos ticketing fails offline. sssd changes are in upstream git and Fedora packaging; no mass enrollment tool yet and UI polish and external IdP flows remain work in progress.
AI-written summary · about
chapters (14)
- 0:00FIDO2 authentication intro
- 1:01Why FIDO2 for orgs
- 3:09FIDO2 workflows for managed users
- 4:13Zero trust gov requirements
- 6:01FIDO2 tech implementation
- 7:46FIDO2 tech stack
- 8:50Demo setup and testing
- 11:05Passwordless future plans
- 14:43UX and security considerations
- 21:51FIDO2 adoption challenges
- 23:09FIDO2 hardware/software compat
- 27:31UI messaging improvements
- 28:42Gov requirements and benefits
- 30:16Q&A on FIDO2 protocols
