The FIDO2 method facilitates you to use any FIDO compliant device either in-built with the system or connected through USB to register and authenticate to the Windows workstation. When you try to authenticate, FIDO compliant device and user gesture, such as a tap on the token and swipe fingerprint on the reader are validated.
NOTE:To use the FIDO2 method for authentication, you must install the Advanced Authentication Device Service. For more information about the Device Service, see the Advanced Authentication - Device Service guide.
NOTE:To use the FIDO2 method for authentication, install the Advanced Authentication Device Service 6.3.60028 or newer version.
To authenticate with the FIDO2 method:
Ensure that the FIDO U2F token is connected to your workstation.
Connect the FIDO2 token to your workstation.
Perform the action associated to the device.
For example, if you use the FIDO2 device, connect it to the computer, set the pin, and touch the device when you see a flash.
Enter your FIDO2 device PIN.
If the administrator has configured the Username-less login enabled option in the server configurations, you can authenticate to the Windows Client using the FIDO2 compliant devices without specifying the username.
To authenticate with FIDO2 username-less login:
Turn on the Windows Client.
Connect the FIDO2 token to your workstation.
IMPORTANT:When you run a program or application that requires administrator approval (through a User Account Control prompt), ensure that your FIDO2 device is removed, disconnected, or kept beyond the proximity limit. This prevents unintended username-less login attempts using the administrator account.
Perform the action associated to the device without clicking anywhere on the Windows Welcome Screen.
For example, touch the device when you see a flash or present your FIDO2 card to the card reader.
NOTE:
User does not see any prompt to present your FIDO2 device.
The Windows Client automatically selects the chain that contains FIDO2 method, regardless of its priority.
If the user has not enrolled the FIDO2 method, the windows client does not display any prompt or error.
To choose a different authentication chain, users must click anywhere on the Windows Welcome Screen.
Enter your FIDO2 device PIN and complete any additional authentication steps, if required.
After successful authentication, you are logged in to the Windows Client.