[PasskeySettings]
Available since Exponential 6.0.15 (in development, not in a release yet).
Summary
The group [PasskeySettings] of settings/site.ini.
File
settings/site.ini; override it in settings/override/site.ini.append.php, in a siteaccess or in an extension.
Settings
| Setting | Default | Description |
|---|---|---|
| Passkeys | enabled | Passkeys (WebAuthn): a user registers passkeys on user/passkeys (My account > Passkeys) and signs in with one on the web sign-in form, next to the password; a passkey also answers "Verify it's you" ([ReauthSettings]). Only the web pages use passkeys: REST, SOAP, WebDAV and the expservices login do not change. Guide: doc/eng-us/guides/passkeys.md enabled or disabled. Disabled: no passkey can be added or used; the stored ones stay. |
| SignInForm | enabled | Offer "Sign in with a passkey" on the sign-in form (and the browser's passkey autofill). |
| RelyingPartyID | (empty) | The relying party id: a host name, the passkeys are bound to it. Empty: the host name of the request. A shared parent domain (example.com) lets the passkeys of www.example.com work on admin.example.com too; it must be the host or a parent of it. |
| RelyingPartyName | (empty) | The name the browser shows. Empty: [SiteSettings] SiteName. |
| AllowedOrigins[] | (empty array) | The origins (scheme://host[:port]) answers may come from. Empty: the origin of the request. List every host the passkeys are used on when RelyingPartyID is a parent domain. |
| UserVerification | required | required (default; the authenticator checks a PIN, fingerprint or face), preferred or discouraged. Signing in with a passkey always requires it; this applies to re-authentication. |
| Algorithms[] | -7; -257; -8; -35; -36 | COSE algorithms offered, most preferred first: -7 ES256, -257 RS256, -8 Ed25519 (needs PHP's sodium extension), -35 ES384, -36 ES512. |
| ChallengeSeconds | 300 | Seconds a challenge may be answered. |
| MaxPerUser | 20 | Passkeys one account may have. |
| Attestation | none | The attestation asked for when a passkey is added: none (default), indirect or direct. With indirect every browser keeps the authenticator's model id (AAGUID), which names it in the list ("iCloud Keychain", "YubiKey 5 Series"); the statement itself is never relied on. |
| RelyingPartyIDMap[] | (empty array) | A multi-host installation: the relying party id of each host, RelyingPartyIDMap[<host>]=<id>. The id must be the host or a parent domain of it; a host not listed uses RelyingPartyID. |
| AuthenticatorNames[] | (empty array) | Names of authenticator models the built-in list lacks or names otherwise: AuthenticatorNames[<aaguid>]=<name> |
| Policy | optional | The passkey policy (doc/eng-us/guides/passkeys.md, "Policy"). Only the web pages apply it; REST, SOAP, WebDAV and the expservices login keep their own sign-in. optional (default): users may add passkeys. preferred: a user without a passkey is asked once per session to add one and may go on. required: a user without a passkey adds one before any other page. |
| PasswordSignIn | enabled | enabled (default) or disabled: disabled refuses the password on the sign-in form for an account that has a passkey (answered like a wrong password). An account without a passkey still signs in with its password, so nobody is locked out. |
| GroupPolicy[] | (empty array) | Per user group (content object id): the strictest of the user's groups and Policy wins; disabled in any group wins. GroupPolicy[13]=required, GroupPasswordSignIn[13]=disabled |
| GroupPasswordSignIn[] | (empty array) | |
| UserPolicy[] | (empty array) | Per account (content object id), winning over the groups. |
| UserPasswordSignIn[] | (empty array) | |
| PolicyHandlers[] | (empty array) | Classes implementing expPasskeyPolicyHandler: extensions change the policy of an account. |
| ExemptViews[] | user/passkeys; user/logout; user/login; user/password; user2fa; ezjscore; user/preferences | The views that stay open while a passkey is required ("module" or "module/view"). |
| ConsoleSlots[] | (empty array) | Templates added below the list of passkeys on user/passkeys (an extension's own section): ConsoleSlots[]=design:myextension/passkeys_slot.tpl |
See also
Generated example: site.ini [PasskeySettings]
Added to the reference for Exponential 6.0.15: the 4.x reference had no page for this group. The descriptions are the comment lines of settings/site.ini.
Contributors
- Graham Brookins Updated
Comments
Add a comment