Fido2 optional discoverable credentials for stable32

[swissbit-eis-admin]

Let users choose during registration whether a passkey is stored as a discoverable credential; retry with the legacy flow if the authenticator can't do resident keys.
Simplify “Log in with a device”: a single field now accepts an optional login/email, using discoverable credentials when left empty and falling back gracefully otherwise.
Backend/WebAuthn services updated to handle optional usernames and return the credential source so the UID can be derived from the authenticator.

Please refer to PR to master: #57151
Both have similar function

Successor of #57140

• Resolves: #

Summary

This allows user to register discoverable and non-discoverable FIDO2 passkeys in user settings.
If user tries to login with second factor and omits email login -> discoverable credential attempted
if user fills in email at login -> classic host side credentials are used.

TODO

• ...

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

[swissbit-eis-admin]

would be great to pull in NC32...

[swissbit-eis-admin]

RESIDENT_KEY_REQUIREMENT_DISCOURAGED recommended

[tushev]

In my opinion, the correct thing to do would be to treat all WebAuthn credentials as a form of :

• either passwordless login (for non-discoverable credentials)
• or passwordless+usernameless login (for discoverable credentials = passkeys).

At least, this is how it's implemented right now: existing non-discoverable credentials are form of passwordless login (and the corresponding header in Account > Security literally says that).

WebAuthn credentials are generally regarded as secure and thus do not require 2FA. 2FA is usually required for passwords only, in order to compensate for some of their weaknesses (passwords can be stolen/leaked, reused/sprayed, bruteforced etc, unlike WebAuthn credentials).

UV is a whole different dimension. It's goal is to protect WebAuthn credential on user's side from unauthorized use. Imagine if someone finds a Yubikey in the street with [email protected] passkey. So, we definitely want UV for usernameless+passwordless logins = discoverable credentials. As for just passwordless logins where you still have to type your username, UV can be optional (but it's still better to request it).

Type	Form	Proposed use for Nextcloud login	UV	Separate 2FA step
Password		Login with username + password + 2FA	N/A	TOTP, WebAuthn etc
WebAuthn	Discoverable	Usernameless + passwordless login	Mandatory	Not required
WebAuthn	Non-discoverable	Passwordless login	Preferred	Not required

Note another use case for WebAuthn: on many websites, it's used as a better alternative to TOTP codes. In this case, UV is indeed optional, or even often discouraged, because the user already has to provide a password. By the way, this is exactly how it's implemented with Two-Factor WebAuthn app.

A good UX example would be GitHub itself: https://github.com/settings/security We have:

• Sign in methods (email, password, passkeys, 'Social login' = 3rd party services)
• 2FA (TOTP, SMS, 'Security keys' = WebAuthn, mobile app)
• Recovery options

Their docs are actually very good and worth reading: https://docs.github.com/en/authentication/authenticating-with-a-passkey/about-passkeys

---

So, I'd envision the UI in Account > Security as follows (new text in italic):

Passwordless Authentication

Set up your account for passwordless authentication following the FIDO2 standard.
This type of login satisfy both password and 2FA requirements, so you can complete your sign in with a single step, safely and easily, without requiring a password and two-factor authentication.

These credentials can be stored on hardware keys, or managed by your OS, or in some password managers.
You can also choose not to ask for username.

The following WebAuthn credentials are configured for your account:

Name	Date Added	Use
Yubikey 5	19 Dec 2025	Passwordless login (username required)	[ Rename ] [ Delete ]
Windows Hello on ABCD12	19 Dec 2025	Usernameless login	[ Rename ] [ Delete ]

Register new WebAuthn credential:

• Do not ask for username when logging in

[ Register credential ] [ ... ]

---

As for my proposal for an option to disable UV for passwordless logins (not usernameless+passwordless!), it could be hidden inside that [ ... ] button.

[swissbit-eis-admin]

In my opinion, the correct thing to do would be to treat all WebAuthn credentials as a form of :...

...you did not have a chance to take a look at the code in this PR, right? I added a comment also in the code for your proposal (RESIDENT_KEY_REQUIREMENT_DISCOURAGED).

As a conclusion:

UV (PIN) required for discoverable credentials
UV optional, but login name of course required for non-discoverable credentials / for passwordless login as is up to now

I tested the existing function and the new function, both have a smooth path through the UI.

[tushev]

My proposal is to make the UI/UX more friendly to an average user that has zero idea of what 'resident FIDO2 credential' is.
Passkeys are already perceived by many people as complicated, and (IMO) the UI should be as clear and user-friendly as possible.

Unfortunately, I'm not familiar with Vue (neither I would choose vibe-coding it without knowledge) so I won't be landing a PR right now.
However, I'd ask you to consider adding a few paragraphs and wording changes from my previous proposal in order to make it simpler to end users without deep FIDO2 knowledge.

And thank you very much for your work!!!

[p1gp1g]

To avoid confusion leading to the doc or to the UI:

WebAuthn credentials are generally regarded as secure and thus do not require 2FA.

FIDO2 with a PIN is a 2FA login, (you own the key and know the PIN), this is what says the quote of the specs you shared ( This type of login satisfy both password and 2FA requirements, so you can complete your sign in with a single step, safely and easily, without requiring a password and two-factor authentication.)

This is also why, when used as a 2FA (after typing the password), it is used without a PIN. This kind of login was previously specified as U2F, superseded by FIDO2. U2F is the legacy protocol, it was only possible to use it that way.

Finally, about the names of the protocol: passkey is a "marketing" name for WebAuthn, specified by FIDO2 (discoverable or not, usually for passwordless login, but sometime for 2FA too). Usually either FIDO2 or Passkey are used, interchangeably.

Today, on Nextcloud, the section is about "Passwordless authentication", and the button about "webauthn". I have no opinion about "passwordless authentication", it is probably good. It would be great to rename Webauthn. Regarding the option for discoverable keys, we can use "Use discoverable key" to match the protocol specifications, or "Login without username" to describe what it does.

[tushev]

The point of 2FA column in my table is just to indicate whether the server should request a separate 2FA step (which is indeed unnecessary with pure WebAuthn logins), nothing more, nothing less :)

I agree that there's a lot of confusion already (even among devs) so we should use as precise wording as possible, and in the same time keep it as simple as possible.

Thus I would prefer

"Login without username" to describe what it does

so it would be more clear to end users (with a hint about discoverable credential in a tooltip, and a proper description in docs).

[hubimuc]

Here's a proposal:

Login screen:
Passwordless Login button like "Login with device"
Dialog pops up:

• user enters login -> host side / non-discoverable credentials are attempted on button press
• user omits login entry -> discoverable credentials are attempted
  Tooltips guide the way.

Security Settings

Section like "Passwordless login with device" in users security Settings
(I tend to rephrase away from webauthn wording...)
Checkbox "No Username needed on Login, just PIN"

• on, default: ->create discoverable Passkeys
• off: -> proceed in existing way with host side credential (as is)
• tooltips guide the way

I really would like to finish this. In the end this is just my proposal that is ultimately up to the maintainers to accept or not. The more rephrasing , the more religion on UI comes into play then nothing will improve. Nextcloud needs the feature in my view pretty urgently independent from some words and I think it is security and usability wise a big step forward. Can you accept a different view on UI also and live with above?