RocketChat / RocketChat/Rocket.Chat

SSO Login does not support FIDO keys

Open
#29,784 6 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
TypeScript
Stars
46.1k
Forks
13.9k
Avg merge
3d 3h
Merged PRs (30d)
130

Description

Description:

To log in to the Rocket.Chat desktop app, I have to log in via our Keycloak instance for SSO.
Since I set up my FIDO keys (a NitroKey and a Yubikey) with PINs, I can no longer use them in this process. I have to switch over to the password-based login flow, where I can use the FIDO authenticators as 2FA - although the prompt to interact with them is still missing. Since the authenticator blinks for interaction, I still see the request and can do the user presence check.

Rocket.Chat should instead prompt me for the PIN for the FIDO keys and continue with the passwordless login flow (or at the very least prompt me when using them for 2FA).

Steps to reproduce:
  1. Set up a webauthn key for passwordless login in Keycloak and configure a PIN for it.
  2. Try to use it to log in to Rocket.Chat.
Expected behavior:

Rocket.Chat redirects to Keycloak, where I am prompted for the PIN and log in with my FIDO key.

Actual behavior:

Rocket.Chat redirects to Keycloak, where I am not prompted for a PIN and my FIDO authenticators fail to allow for passwordless login. Fallback to 2FA without PIN also works improperly and does not prompt for interaction when required.

Server Setup Information:
  • Version of Rocket.Chat Server: 7.12.2
  • Number of Running Instances: 1
  • NodeJS Version: v22.16.0
  • MongoDB Version: 8.0.13
Client Setup Information
  • Desktop App or Browser Version: Desktop
  • Operating System: Pop!_OS

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no repository files or tests; start by tracing the desktop SSO redirect to Keycloak and the FIDO/WebAuthn authentication flow. Done means passwordless login prompts for the authenticator PIN, and 2FA prompts for required user interaction.

Written by the indexing model from the issue text.

Assessment

Domain
authentication, desktop, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.