WebAuthn MFA not working on windows but works on android

[cobalt wave]

I modified "default-authentication-mfa-validation" under stages to use WebAuthn, force user to authenticate etc

When I setup via my phone (S24 Ultra) I can login, (user/pass) then add the device chosing the option for "use this device". The thumbprint pops up and all is gravy.

However, if I go to my desktop (windows 10) and attempt to login, I can login (user/pass) but then I am prompted to add a usb secruity key (even though this is not the option I picked on my phone). There is no other option. I have also re-added the device and also started the process from my computer but it straight away asks for a usb security key.

Any advice here or is this a bug? I followed @tropic pendant : https://www.youtube.com/watch?v=jCwGTLFABYU but the comments appear to give the same issue (i've tried different browser and even ask a friend remotely to try. Same issue.

If its a bug, I can submit a ticket on GitHub instead but there is always a chance, I have did something wrong. Cheers!

[tropic pendant]

...when I would get that prompt I would cancel it, and at least from Chrome I can then choose my Pixel 8 and authenticate

[cobalt wave]

Have you tried that on the latest version of authentik for a new user? I ask as I've just did the same and it just says failed to authenticate. Then if I retry same USB prompt again. I have tried chrome Firefox and edge in windows 10

I'd also mention when you did this process on your video, you came up with device name pixel6 but my s24 ultra just get the device name "1" am not sure if this is pre-set or a remembered Id. It can be changed in devices but maybe something is not populating.

[tropic pendant]

I am on the latest version of authentik, but have not created a new user since...I will test with creating a new user and registering my work iphone and let you know

I didn't name it anywhere, I mean I named my phone within its device settings and nothing else...the process automatically recognized the name (so that must be the host name)

[tropic pendant]

so on Windows 11 pro, I used chrome incognito to set an a new account as you, registered mfa with iphone and logged out...opened regular chrome window and chose passwordless flow (WebAuthn) and was not prompted for USB...but instead to scan QR code since I picked a different device than my Pixel 8, scanned with iphone and scanned my thumb for biometrics and it logged in...

[cobalt wave]

Thanks for checking this dude. If you are still able to do it, then I can only assume there is a setting in the staging that needs to be ticked (that I've not) or a setting in windows 10 perhaps. So when it gets the webauthn it asks for X authentication method, locally instead of forwarding to the set device.

Your authentik instance, is it local to your network? Mine is setting in oracle cloud.

[tropic pendant]

yes, authentik is local to my network...however, I navigated to it via the FQDN where the A record is set at Cloudflare... so for instance when I am at work (completely different network) it still works...

so I guess what is different is when I choose Other device it asks me to scan the QR code then I am prompted to scan my finger on the iphone... If I choose my pixel, the original device I set up, there is no QR code, I get WebAuthn/Passkey prompt to scan my finger then it logs right in

...and I think I now see it is because my pixel is registered as a passkey in chrome where the iphone is not (thus prompting to scan QR code with the device that has the passkey registered)

...also tested logging in but with my phone on cellular service for WebAuthn, instead of being on wifi to be completely different networks, it logs right in

[vivid ledge]

Hi, I've a similar problem, webauthn is working on iphone and macs but not in windows browser.