How to manage registered WebAuthn credentials?

[EkaLinMan]

Hi, we are evaluating WebAuthn/Passkey support in OpenAM 16.1.2.

Based on the documentation, OpenAM provides WebAuthn registration and authentication. However, we could not find a documented way to manage registered WebAuthn credentials.

Does OpenAM 16.1.2 provide a supported way for:

• Users to list their registered WebAuthn credentials
• Users to delete a specific credential
• Administrators to remove a user's credential

Is there an existing UI or REST API for these operations, or would custom implementation be required?

Any clarification would be greatly appreciated. Thank you!

[maximthomas]

Hi @EkaLinMan,
There is no dedicated UI or REST endpoint for WebAuthn credentials in OpenAM 16.x, but you do not need custom development to manage them either.

WebAuthn credentials are stored as values of an ordinary multi-valued user profile attribute, so the standard Identity Management REST API can list and delete them, both for an administrator and for the end user themselves.

The credentials are stored by default in the sunIdentityServerPPSignKey user attribute.

Check the actual value in Realms -> Authentication -> Modules -> your WebAuthn module. Both the registration and the authentication module must point at the same attribute.

The stored value carries no friendly name, no registration timestamp and no "last used" marker - the whole base64 string is the only identifier you have. There is nothing in the profile that tells you "this is Alice's YubiKey and that one is her laptop's Touch ID".

In practice that means: manage the credentials by exact string value and by count. If a user reports a lost key and you can't tell which value it is, the reliable operation is to clear all of them and have the user re-register.

If you need per-credential names, that is currently custom development.

I hope these links could be helpful:

• Authentication and Logout
• Identity Management

[EkaLinMan]

Thank you for the clarification 💯