Configuration for WebAuthn

[icb-]

What configuration is needed to make WebAuthn work?

I've tried everything obvious to me. Neither privacyidea.authentication_flow default or triggerChallenge seems to make it go. I've set the privacyidea.service_name and privacyidea.service_pass to the privacyIDEA admin user, in case that's needed (this is just a test instance of privacyIDEA and the Shibboleth IdP)

I've made sure my user does have a WebAuthn token enrolled. The TOTP I also have on my user does succeed, so the two systems are talking to each other.

The webauthnSignRequest input is empty in the web form that gets presented. origin is being set to the IdP's correct domain, and mode is being set to otp. I'm not sure how to get that to change to webauthn and have a non-empty webauthnSignRequest.

I'm using the default template on IdP 5.0.0, with plugin v1.1.0.

[icb-]

Doing more troubleshooting on my side, I turned on privacyidea.debug it looks like my PI server isn't reliably returning that I have a WebAuthn token. I've seen it do several things

1. It doesn't find that I have a WebAuthn token, and I only get prompted for OTP code
2. It does see that I have a WebAuthn token, and my browser immediately prompts me to tap my token
   1. Usually this succeeds
   2. Once it gave me a message indicating I gave the wrong PIN
   3. Once it made me tap my token about 5 times before finally accepting it, with a "wrong otp pin" error in the debug logs

Looks like I need to do some troubleshooting on the PI server side, so I'll focus some troubleshooting there. I'm using the khalibre/privacyidea Docker image.

[icb-]

After more troubleshooting, it appears that PI isn't getting along with our LDAP servers.