goauthentik / goauthentik/authentik

Allow validator stage fallback to identification stage for default webauthn prompt

Open
#23,179 3 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Python
Stars
25.6k
Forks
2k
Avg merge
1d 2h
Merged PRs (30d)
651

Description

### Is your feature request related to a problem?

When using the passkey setting in the default identification stage the passwordless flow can be specified. This allows me to click and then be prompted for a passkey through my password manager.

However I am not prompted for a passkey on login load, which I would like, and on authentication failure, or policy, have the user redirected to either an identification stage and flow, or enrollment (if a passkey is not configured).

### Describe the solution you'd like

Currently if I set the webauthn validation stage as first in the flow I am immediately prompted for a passkey, however if a user does not have a passkey, or is not configured, or has lost their passkey there is no way for them to reach the identification stage or use a different authentication mechanism to recover their account.

It would be really great to have a fallback mode for the webauthn, so that if authentication fails this way it defaults to the identification stage or to have the webauthn page support a "password recovery" flow that is the default authentication setup.

### Describe alternatives that you've considered

As discussed above.

### Additional context

Thanks for taking the time to read and consider.

Contributor guide

Open the contributing guide

Research direction

The issue does not name files, tests, or entry points. First clarify the desired fallback behavior for failed WebAuthn authentication, including identification and enrollment paths; done means users without a usable passkey can recover through the configured alternative flow without losing the default passkey prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
authentication
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.