Feature Request: FIDO2 / WebAuthn MFA Support for Manager Server

ideas
1

We use Manager Server as a business-critical accounting application and would like to request support for FIDO2/WebAuthn authentication, particularly hardware security keys such as YubiKey.

We have recently deployed YubiKey authentication with other self-hosted business applications, including OpenProject, MeshCentral, and Office365 and would like to standardize on phishing-resistant MFA wherever possible.

Ideally, Manager Server would support:

  • Multiple FIDO2/WebAuthn authenticators per user, allowing primary and backup YubiKeys
  • Password + WebAuthn security key as MFA
  • Administrator enforcement of MFA for specified users or administrators
  • Recovery codes or administrator-assisted recovery
  • Audit logging for authenticator enrollment/removal
  • Support for platform authenticators such as Windows Hello in addition to hardware security keys
  • Eventually, optional passwordless/passkey authentication if appropriate

For our environment, the immediate priority would simply be:

Username/password + required FIDO2/WebAuthn second factor, with at least two registered authenticators per administrator account.

FIDO2/WebAuthn would provide Manager Server administrators with a phishing-resistant authentication option based on public-key cryptography rather than reusable OTP or password credentials.

Is WebAuthn/FIDO2 support currently planned for Manager Server?

2

See Support for multi-factor authentication

3

Thanks. Yes, I’m aware Manager already supports TOTP-based MFA through authenticator applications, and we currently use that functionality.

My request is specifically for FIDO2/WebAuthn support as an additional MFA method, particularly for hardware security keys such as YubiKey.

TOTP and WebAuthn are both forms of MFA, but WebAuthn provides phishing-resistant, origin-bound public-key authentication rather than authentication based on a shared TOTP secret.

I’m not suggesting replacing the existing authenticator-app option. I’d like to see WebAuthn/security keys added alongside TOTP, allowing administrators to require password + FIDO2 security key and ideally register a primary and backup key.

4

You are right. My earlier reference to Support for multi-factor authentication concerned MFA generally, whereas your request specifically addresses FIDO2/WebAuthn. I agree this is a distinct feature request and as such put this topic into the ideas category. We also already use YubiKeys for applications particularly given the phishing resistance they offer over TOTP.