Nextcloud Passwordless with Token2 T2F2 FIDO2 Keys
The passwordless feature has been just added onto Nextcloud V19. It allows authentication without a password. WebAuthn's support makes it possible using a Fido2 USB key. You'll find here the step by step guide to enable your Nextcloud account with the password-less authentication. The guide was originally published by sosandroid, in English and French
A server or laptop running Docker is used here. There are other ways to test, we chose that one. You'll also need a valid domain with a valid SSL cert (not self-signed). This guide is based on a test container using the docker-compose.yaml. It has been launched using the following command line.
NEXTCLOUD_URL=mydomain.tld NEXTCLOUD_ADMIN_USER=admin NEXTCLOUD_ADMIN_PASSWORD=mypassword docker-compose up
Authentication WebAuthn / Fido2
The following key has been tested: Token2 T2F2 ALU for this test.
Set a PIN code
Before you can enrol the FIDO2 key a PIN code needs to be set. This can be done using standard control panel applet (available with Windows 10 starting 1903 release)
You can also use the TOKEN2 Companion app to set the PIN-code on your FIDO2 Key.
Set your PIN code.
1234 for instance.
Set your Nextcloud account
- Insert the USB key into the computer
- Authenticate using your account and password
- Go to the settings
- Navigate to Security
- Start adding a WebAuthn device
- A pop-up asks you for the PIN code
- Press the key button to enrol it
- Give the key a cool name
- You're set
- Insert the USB key into the computer and log out from your Nextcloud account
- From your browser, refresh the Nextcloud's login: https://mydomain.tld/login
- Click Log in with a device
- Fill your login and press Log in
- Enter your pin code
- Press the hardware button of the USB key
- You're in
Fido2 key enrollment
For the authentication
- On Nextcloud the login/password authentication remains active. You must then choose a strong password as per common security rules.
- The consequence is you cannot be locked out by losing your USB key
- When the session expires or when changing some settings on your account the password is requested.
- While authenticating, depending on the OS / Browser the PIN code can be requested or not. This is normal behaviour
Subscribe to our mailing list
Want to keep up-to-date with the latest Token2 news, projects and events? Join our mailing list!