Integration of user login with FIDO-based authentication

OneSpan Cloud Authentication allows you to integrate FIDO The FIDO (Fast IDentity Online) Alliance is an organization whose main goal is to reduce the user’s reliance on passwords. It proposes several frameworks that enable passwordless authentication.-based authentication in your solution. It supports the following FIDO protocols:

• FIDO UAF FIDO UAF aims to substitute password authentication. It provides passwordless and multi-factor authentication with compliant authenticators. (Universal Authentication Framework)

• FIDO2 FIDO2 is a standard for strong authentication in the web. FIDO2 is comprised of the WebAuthn specification and the corresponding Client-to-Authenticator Protocols (CTAP). It allows users to use their devices and authenticators to authenticate to online services without the need for entering a password. It can be accomplished both on their desktop and mobile environments.

For more information about the FIDO UAF and FIDO2 protocols, see FIDO-based authentication.

Prerequisites for a FIDO-based authentication

To ensure successful FIDO-based authentication, the following prerequisites must be met:

• The user must exist in OneSpan Cloud Authentication.
• The user must be assigned to a registered tenant.
• FIDO has been configured for the relevant tenant in the Tenant Configuration service.
• The user must have a registered FIDO authenticator.
• A relying party instance with defined policies must have been created.

Sequence of a user login operation via FIDO-based authentication

1. The user starts the login operation and triggers the web server to initiate the authentication to the OneSpan Trusted Identity platform API Provides the endpoints that are required for the successful completion of the operations. by calling the POST users/{userID@domain}/generate-fido-authentication-request endpoint.

2. The OneSpan Trusted Identity platform API initializes the authentication request to the FIDO Server.
3. The FIDO Server retrieves the policies associated to the user and generates an authentication request that is sent to the OneSpan Trusted Identity platform API.

   These policies define which authenticator is authorized to be used for authentication.

4. The OneSpan Trusted Identity platform API receives the request and sends it to the web server.
5. The web server forwards the authentication request to the app.
6. The app communicates with the FIDO authenticator to generate an authentication response.
7. The app forwards the authentication response to the web server, which forwards the response to the OneSpan Trusted Identity platform API by calling the POST /users/{userID@domain}/login endpoint.
8. The OneSpan Trusted Identity platform API finalizes the authentication with the FIDO Server.
9. The FIDO Server verifies the authentication response that is sent to the OneSpan Trusted Identity platform API.
10. The OneSpan Trusted Identity platform API receives the success response and sends it to the web server.
11. The web server sends this verification response to the app and with this finalizes the authentication operation.

To integrate user login with FIDO-based authentication

1. Issue an authentication request with the POST /users/{userID@domain}/generate-fido-authentication-request endpoint.

   • Payload:

     • fidoProtocol: UAF11, FIDO2
     • authenticationMessage (UAF only)
       Contains a message is shown on a built-in display of an UAF authenticator.
     • userVerification: required, preferred, discouraged (FIDO2 only)

   • Response body:

     • authenticationRequest
     • requestID
     • uafStatusCode
       For a full list of UAF status codes, refer to the FIDO alliance documentation.
       For FIDO2, this field will return null.

2. Issue a login request with the POST /users/{userID@domain}/login endpoint.

   • Payload:

     • objecttype: "LoginInput"

     • credentials

       • fidoAuthenticator

         • authenticationResponse
     • requestID

   • Response body:

     • uafStatusCode

       For a full list of UAF status codes, refer to the FIDO alliance documentation.

       For FIDO2, this field will return null.