17.2. Registering a passkey device

Procedure

1. Insert the passkey device in the USB port.

2. Register the passkey for the IdM user:

   # ipa user-add-passkey user01 --register

   Follow the application prompts:

   1. Enter the PIN for the passkey device.

   2. Touch the device to verify your identity. If you are using a biometric device, ensure to use the same finger with which you registered the device.

      提示

      It is good practice for users to configure multiple passkey devices as a backup that allows authentication from multiple locations or devices. To ensure the Kerberos ticket is issued during authentication, do not configure more than 12 passkey devices for a user.

Verification

1. Log in to the system with the username you have configured to use passkey authentication. The system prompts you to insert the passkey device:

   Insert your passkey device, then press ENTER.

2. Insert the passkey device into the USB port and enter your PIN when prompted:

   Enter PIN:
   Creating home directory for user01@example.com.

3. Confirm the Kerberos ticket is issued:

   $ klist
   Default principal: user01@IPA.EXAMPLE.COM