Skip to content

FIDO & Passkeys Administration Guide#

Janssen’s FIDO2 server enables relying parties (RPs) to register and authenticate users via hardware security keys, platform authenticators (e.g., Apple Touch ID, Windows Hello), and synced passkeys.

Ecosystem Component Map#

Janssen’s FIDO2 architecture is comprised of several interacting components:

  1. Janssen FIDO2 Server: A standalone component in the Janssen Project that hosts the REST endpoints for WebAuthn attestation (registration) and assertion (authentication) processes. It verifies FIDO credentials against trust roots and caches metadata.
  2. FIDO Interception Scripts: Flexible custom scripts that manage the user journey, linking standard username/password authentication with FIDO-based multi-factor authentication (MFA) or passwordless/usernameless flows.
  3. Agama Lab Passkey & Security Key Projects: Pre-packaged Agama projects that enable developers to implement native security key and passkeys flow using out-of-the-box low-code approach.
  4. Admin Tools:
    • Jans TUI: Text-based User Interface for quick configuration updates.
    • Jans CLI: Command-line interface for dynamic properties management.
    • Jans Config API: RESTful programmatic endpoints to manage FIDO2 server settings.
  5. Casa: Casa is a self-service user credentials management portal, providing an interface for end-users to register, view, and delete their own security keys and passkeys.

For details on the technical architecture of the FIDO ecosystem, see the FIDO2 server design documentation.

Feature Highlights#

Passkeys Support#

Janssen provides native, out-of-the-box support for passkeys, offering users seamless cross-device synchronization and platform-level biometrics. To get started with passkey deployment, refer to the Passkeys Implementation Guide.

FIDO Metric API#

Janssen server provides FIDO Metric API. These APIs enable collection of vital operational metrics such as:

  • Number of active registrations
  • Registration requests
  • Assertion completions

This information helps system administrators to monitor the health and adoption rate of MFA methods. See Passkey Telemetry & Metrics for what is collected, how aggregation and retention work, and how to consume the data.

Interception Scripts#

Custom scripts drive Janssen's extensibility. Developers can hook into attestation and assertion cycles (start and finish hooks) to perform custom user validations, query risk engines, modify returned assertion/attestation parameters, or integrate external authorization rules during WebAuthn sessions.

Fido Metadata Service (MDS)#

Janssen FIDO2 server uses Metadata Service (MDS) to dynamically fetch, verify, and cache attestation statements for certified authenticators. This allows organizations to enforce policies (e.g., rejecting uncertified devices or locking down authentication to FIPS-compliant security keys). See FIDO Vendor Metadata Management for more details.