How to set up login with WebAuthn in Windows

If your device has a fingerprint sensor, you can opt for using your fingerprint as Two-Factor Authentication (2FA).

The following steps describe how this can be configured:

1. Go to https://users-portal.web.cern.ch, log in with SSO, then click on Configure 2FA.

1. Click on the toggle for "Enbale WebAuthn credentials" to start configuring it.

1. Read the message, then click on the "Got it" button. Once you do this, the page will keep loading until this configuration is finished. Proceed with the next step.

1. Open an incognito/private session in your browser and go to https://users-portal.web.cern.ch and login with your CERN account and provide your OTP code for 2FA if needed.

1. At this point, a button to Register your Security key will be shown, click on it.

1. A prompt from Windows to configure authentication to auth.cern.ch will be shown, confirm with OK.

1. Choose Fingerprint and use your fingerprint to confirm the action.

1. A confirmation will be shown that the passkey was saved.

1. Provide a name for your Security key, which can be an alias of your laptop.

1. If all above steps went correctly, close the incognito session, then you will observe that the toggle for WebAuthn is now enabled.

1. Congrats! You can now ues the fingerprint on your laptop to log in with 2FA. When you log in with SSO the next time, you can click on "Try Another Way" if the default is not WebAuthn.

1. Choose then Security Key.

1. And finally you will be able to see your newly-configured Security key as a way to authenticate using 2FA.