Password Admin – Configure FIDO2 Authentication

Purpose

This guide shows an administrator can enable FIDO2 based authentication and how individual user can setup and login using FIDO2 devices

After this guide has been followed, individual users are required to setup using their FIDO devices to use it as the login authentication and can do this by following the guide here.

Enabling this prevents potential security risks and malicious actors from gaining unauthorized access to privileged user accounts.

Prerequisites

• Admin Access to Practice Protect

Instructions

1. Login to Practice Protect and switch to the Admin Portal.
2. In the Admin Portal select Core Services > Policies then select the existing policy you would like to enable FIDO2 setup.
3. Go to User Security Policies > User Account Settings. Select Yes next to Enable FIDO2 authentication
4. Select Yes to Enable security key enrollment and Enable On-device Authenticator.
5. (Optional) To enforce it, choose Yes to Prompt users to setup a FIDO2  Authenticator on login.
6. Click Save.
7. On the Authentication Profiles, select the appropriate Login Profile. This is usually Default New Device Login Profile for Geo-Locked users or Default Other Login Profile for IP restricted users.
8. On Challenge 2 section, tick the box for FIDO2 Authenticator(s) (single-factor) then select OK to apply.

Sign in using FIDO2 Authentication

1. After you sign in to Practice Protect, a wizard prompt will appear to configure FIDO2. Click Get Started.
2. Click FIDO2 Authenticator then enter a name. Hit Submit.
3. This prompts you to setup FIDO2 device, click OK. Follow the instructions appearing in the screen.
4. Insert your FIDO2 device and then enter a PIN for your device. Click OK.
   
5. Tap your FIDO2 device to confirm the setup.
6. A notification will show confirming you successfully set it up. Click Done to close the setup.
   
7. Users can now sign in to Practice Protect using FIDO2.