goauthentik / goauthentik/authentik
Allow validator stage fallback to identification stage for default webauthn prompt
- Dominant language
- Python
- Stars
- 25.6k
- Forks
- 2k
- Avg merge
- 1d 2h
- Merged PRs (30d)
- 651
Description
### Is your feature request related to a problem?
When using the passkey setting in the default identification stage the passwordless flow can be specified. This allows me to click and then be prompted for a passkey through my password manager.
However I am not prompted for a passkey on login load, which I would like, and on authentication failure, or policy, have the user redirected to either an identification stage and flow, or enrollment (if a passkey is not configured).
### Describe the solution you'd like
Currently if I set the webauthn validation stage as first in the flow I am immediately prompted for a passkey, however if a user does not have a passkey, or is not configured, or has lost their passkey there is no way for them to reach the identification stage or use a different authentication mechanism to recover their account.
It would be really great to have a fallback mode for the webauthn, so that if authentication fails this way it defaults to the identification stage or to have the webauthn page support a "password recovery" flow that is the default authentication setup.
### Describe alternatives that you've considered
As discussed above.
### Additional context
Thanks for taking the time to read and consider.
Contributor guide
Research direction
The issue does not name files, tests, or entry points. First clarify the desired fallback behavior for failed WebAuthn authentication, including identification and enrollment paths; done means users without a usable passkey can recover through the configured alternative flow without losing the default passkey prompt.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100