Jdi na navigaci

FIDO2 – Keychain

Settings

As a keychain we recommend using YubiKey 5C NFC or GoTrust IdemKey.

Varování:

To set up the keychain, the user must have the MFA method activated via Microsoft Authenticator, TOTP or have a temporary access pass (TAP). You can request a temporary access pass using form on ICT Helpdesk.

Windows

To set a PIN on the keychain, go to the settings in the menu section: Accounts[Access Options], select the option Security Key, click on the btn: [Manage] and set a PIN code.
Continue to settings common to all systems.

Linux

Set a PIN on the keychain.

YubiKey

Console

Depending on the distribution, you need to install the link: YubiKey Manager.

Arch Linux

sudo pacman -S yubikey-manager
sudo systemctl enable pcscd.socket

Debian / Ubuntu

sudo apt-add-repository ppa:yubico/stable
sudo apt update
sudo apt install yubikey-manager

Fedora

sudo dnf install yubikey-manager

After installing and connecting the YubiKey to your computer, you need to check that the YubiKey device is recognized.
```
ykman information
```

Sample of successful reading:

Device type: YubiKey 5 NFC
Serial number: 4200689
Firmware version: 5.7.1
Format: Keychain (USB-A)
Enabled USB interfaces: OTP, FIDO, CCID
NFC transfer is enabled
USB NFC application
Yubico OTP enabled enabled
FIDO U2F enabled enabled
FIDO2 enabled enabled
OATH enabled enabled
PIV enabled Enabled
OpenPGP enabled enabled
YubiHSM Auth Enabled Enabled

Finally, set the PIN code.
```
ykman fido access change-pin
```

GoTrust IdemKey
Web browser
1. In the *Google Chrome/Chromium web browser, you need to open the address chrome://settings/securityKeys.
2. Open the tab Create PIN.
3. Connect the key fob to the device.
4. After inserting the key fob, you can create a PIN and click Save.

Common

On your computer, open the page https://mysignins.microsoft.com/security-info and log in using your university account username@cvut.cz and CTU passwords.
Click Add login method.
Select Security Key.
Select USB Device.
Prepare the key and click Next.
Plug the key into the computer and wait for the user to be redirected to the next page.
After the redirection, enter the PIN code that was created in step 1.
Touch the key.
Click Enable.
Name your key and click Next.
The key has been successfully added.

Varování:

If adding a FIDO2 keychain fails with an unknown error, the user needs to check that they have set the PIN correctly on the keychain. A keychain without a PIN code cannot be used for MFA registration.