[SOLVED] Adding 2FA WebAuthn fails

[LooneyTunes]

Hi,

I want to enable WebAuthn for Proxmox VE but recieves an error when doing so "no webauthn configuration available". If I go to the Realms menu I find Yubico as an alternative, but selecting that shows new fields asking for API id and API key. No idea what that should be, or even if that is neccessary to fill in?
Thanks

 

[oguz]

hi,

did you edit /etc/pve/datacenter.cfg file as described in our documentation? [0]

[0]: https://pve.proxmox.com/pve-docs/pve-admin-guide.html#pveum_configure_webauthn

 

[LooneyTunes]

Oh, I missed that part, sorry. Thanks for pointing that out, will try immediately.

 

[LooneyTunes]

Oh, I missed that part, sorry. Thanks for pointing that out, will try immediately.

I configured the file and tried again, same issue. I am now rebooting Proxmox to see if that helps

Edit: Restart did not help, still same error when trying to add it...

In the log I found this now, so something is happening...

origin=https': property is not defined in schema and the schema does not allow additional properties

I did use the exact syntax from your example (modified to my domain of course);

webauthn:
rp=mypve.example.com,origin=https://mypve.example.com:8006,id=mypve.example.com

 

[oguz]

I did use the exact syntax from your example (modified to my domain of course);

can you try putting them in a single line? e.g. webauthn: id=localhost,origin=https://localhost:8006,rp=localhost

you can also do it on the GUI in case you don't want to manually edit the file; just go to Datacenter -> Options -> WebAuthn settings

edit: will send a fix for the syntax in the docs, thanks for the heads up!

 

[LooneyTunes]

can you try putting them in a single line? e.g. webauthn: id=localhost,origin=https://localhost:8006,rp=localhost

you can also do it on the GUI in case you don't want to manually edit the file; just go to Datacenter -> Options -> WebAuthn settings

edit: will send a fix for the syntax in the docs, thanks for the heads up!

Worked like a charm on one line!

Thank you!

 

[CRCinAU]

How do you do this if you have two nodes in a cluster?

 

[LooneyTunes]

How do you do this if you have two nodes in a cluster?

For now I don't so can't answer that. Perhaps someone else knows if you start a new thread. Hope you will find out!

 

[VoIP-Ninja]

How do you do this if you have two nodes in a cluster?

afaik - you need a name like: cluster.example.com and A and AAAA records with multiple IPs

e.g. for IPv4
cluster.example.com A 192.168.0.20
cluster.example.com A 192.168.0.30

same for IPv6
cluster.example.com AAAA fd20::20
cluster.example.com AAAA fd20::30

similiar with public IPv4/v6 addresses