Passkeys

Users can authenticate into Therefore™ platforms such as the Therefore™ Navigator, Web Client and Portal by using Passkeys as an alternative to the standard password method. Passkeys can be enabled globally on a Therefore™ system, or on an individual user basis, by accessing the user's properties in the Therefore™ Solution Designer. See also:

Users and Groups

To access the global passkeys setting, right-click the 'Authentication' node in the Therefore™ Solution Designer and select 'Configure 2FA and Passkeys'. For the Therefore™ Portal, right-click the respective node under 'Integrations' and select 'Portal Configuration' from the context menu.

Passkey Configuration

The global configuration window has two settings:

Passkeys
Drop down menu, select 'Enabled', 'Disabled' or 'Advertised'. This selection will apply to all users who have 'Inherited' as their Passkeys mode. The Advertised setting will work the same way as Enabled would, with the addition that users who do not yet have a Passkey will now be prompted on log in to create one.

Relying Party ID
Enter the domain from where the web client would be accessed. The system's domain and the relying party ID must match for the passkeys to be enabled.

General Requirements

  • Windows 11 version 22H2 or above.

  • A device compatible with a Windows Hello sign-in option (PIN, fingerprint or facial recognition).

The following site can be used to test if a passkey can be created in the browser:
https://fido2.andersaberg.com/usernameless

Note:

  • Passkeys are saved on the machine the user is physically at. The passkey requirements will apply to the local machine in the event of a remote desktop connection.

  • In order for passkeys to function in a web browser, the site must be accessed with 'https'. When using 'localhost', 'http' may be used.