Skip to content

v1.13.0 — FIDO2 + PIV authentication (app-native MFA)

Choose a tag to compare

View all tags
@clem-field clem-field released this 21 Jul 13:55
v1.13.0
This tag was signed with the committer’s verified signature.
clem-field
GPG key ID: 6BAB1F98BE4CFE69
Verified
Learn about vigilant mode.
7dda555
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Phishing-resistant, DoD-ready authentication — SPARC's first app-native multi-factor authentication. A security key or a CAC/PIV smart card + PIN is now a complete, single-step login.

Highlights

FIDO2 / WebAuthn passwordless sign-in (#779)

Register a FIDO2 security key (YubiKey, Feitian, Token2, a platform authenticator, …) with a PIN, then sign in with just the key — no password. The key + PIN is possession and knowledge in one ceremony, so it satisfies MFA on its own, and it's phishing- and replay-resistant. Authenticator-agnostic: resident and non-resident keys both work, usernameless with an email-first fallback. Users manage their keys from a Security Keys page; lockout recovery is an admin key-reset (no self-service codes by design). Enable with SPARC_FIDO2_ENABLED.

PIV / CAC smart-card sign-in (#779)

SPARC accepts a DoD PIV/CAC certificate — delivering NIST IA-2(12) "Acceptance of PIV Credentials". The mutual-TLS handshake, DoD PKI validation, and revocation happen at the gateway (ALB/nginx); SPARC consumes the already-validated certificate it forwards, maps the EDIPI/email to a user, and fails closed unless the gateway attests verification. Enable with SPARC_ENABLE_PIV. The gateway/mTLS setup is tracked in sparc-iac#559.

FIDO U2F

Covered for free — a WebAuthn implementation accepts a U2F key as a non-resident second factor.

Compliance

  • IA-2(1)/(2) — app-native MFA via FIDO2 (no longer conditional on an external OIDC IdP).
  • IA-2(8) — WebAuthn is replay- and phishing-resistant (per-ceremony challenge, origin binding, signature-counter clone detection).
  • IA-2(12) — native PIV/CAC acceptance → Implemented.

NIST mapping, the authentication CDEF, and new wiki guides (Authentication and MFA, User Guide: Security Keys & Smart Cards) are all updated.

Upgrade notes

  • No behavior change unless you opt in — SPARC_FIDO2_ENABLED and SPARC_ENABLE_PIV both default to false.
  • FIDO2: set SPARC_APP_URL to the externally-visible origin (https://…) — WebAuthn binds credentials to it, so a mismatch fails only in that environment.
  • PIV: requires the mTLS gateway from sparc-iac#559; SPARC fails closed without it. See the header contract in the Authentication and MFA guide.
  • The openssl gem is pinned ~> 3.3 — parity with the version the prod image already ships (its OpenSSL library remains 3.x); not a crypto change.
  • No database migration is required beyond the automatic webauthn_credentials table.

Full changelog: v1.12.3...v1.13.0

Assets 2
Loading