WebAuthn registration failed

[showiproute]

@dcsapak : I recognised that there was an update for libpve-access-control - will this fix the Webauthn issue?

 

[showiproute]

Okay so it seems that the package fixed the issues.
BUT I am still unable to have a Webauthn registration which works for the whole PVE cluster.

Can you please update your manual to that?
I think many other customers which run > 1 PVE as a cluster would benefit from that.

 

[showiproute]

I tinkered a bit around with RP & ID.

On my 2nd server I see following "error": authentication failure; rhost=::ffff:192.168.10.2 user=mmuehlbacher@hks msg=The clients relying party origin does not match our servers information

 

[dcsapak]

AFAIK, you must remove the origin from the datacenter.cfg ( since each host hast its own origin) and the rp must be a suffix domain e.g. for 'pve1.x.y' and 'pve2.x.y' the rp should be 'x.y'

 

[showiproute]

AFAIK, you must remove the origin from the datacenter.cfg ( since each host hast its own origin) and the rp must be a suffix domain e.g. for 'pve1.x.y' and 'pve2.x.y' the rp should be 'x.y'

It worked - thanks!

But you used rp twice in your previous message.
The right way is to delete the origin, id = domain, rp = pve.domain

So in my case the config looks like webauthn: id=hks.lan,rp=proxmox1.hks.lan

 

[showiproute]

Might be a good idea to enhance your documentation with that information.

 

[dcsapak]

Might be a good idea to enhance your documentation with that information.

yes that makes definitely sense