Passkey Support¶
Feature Overview¶
Implements passkey support through Auth0's WebAuthn capabilities for more secure and convenient authentication, allowing users to authenticate using platform-native biometric or hardware security methods instead of traditional passwords.
User Stories¶
US-UM-28: Register a Passkey through Auth0¶
As a staffing company user, I want to register a passkey for my account through Auth0, So that I can log in more securely and conveniently without typing passwords.
Acceptance Criteria: - Given I am logged into the platform - When I navigate to my security settings - Then I should see an option to add a passkey - When I select this option - Then: - I should be redirected to the Auth0 WebAuthn registration flow - Auth0 should initiate the passkey registration process - My device should prompt me to create a passkey using my device's authentication method (fingerprint, face recognition, PIN, etc.) - When I complete the authentication on my device - Then: - The passkey should be registered to my Auth0 account - My local user profile should be updated to reflect passkey availability - The systems should be synchronized to ensure consistent authentication options - And I should receive a confirmation message - And I should be able to name my passkey for easy identification in Auth0 - And the registration should be logged for security audit purposes in both systems
US-UM-29: Authenticate Using Auth0 Passkey¶
As a staffing company user with a registered passkey, I want to log in using my Auth0-registered passkey, So that I can access the platform securely without entering a password.
Acceptance Criteria: - Given I have a registered passkey for my Auth0 account - When I visit the login page - Then I should see an option to sign in with a passkey - When I select this option - Then: - I should be redirected to the Auth0 WebAuthn authentication flow - My device should prompt me to authenticate using my device's security method - When I successfully authenticate on my device - Then: - Auth0 should validate my passkey - I should be redirected back to the application with proper authentication tokens - I should be logged into the platform - And the login should be logged for security audit purposes in both systems - And if multi-factor authentication is enabled, the passkey should satisfy one of the factors
US-UM-30: Manage Auth0 Registered Passkeys¶
As a staffing company user, I want to manage my Auth0 registered passkeys, So that I can add, rename, or remove passkeys as needed.
Acceptance Criteria: - Given I am logged into the platform - When I navigate to my security settings - Then I should see a list of all my registered passkeys from Auth0 - And for each passkey, I should see: - A name/label - The date it was registered - The device type/name (if available) - Last used date - When I select to manage my passkeys - Then I should be redirected to the Auth0 credential management interface - And through the Auth0 interface, I should be able to: - Rename a passkey - Remove a passkey - Add a new passkey - When I remove a passkey through Auth0 - Then: - I should be required to confirm the action - The passkey should be immediately deactivated in Auth0 - My local user profile should be updated to reflect the change - And the action should be logged for security audit purposes in both systems
US-UM-31: Use Auth0 Fallback Authentication Method¶
As a staffing company user, I want to use alternative Auth0 authentication methods when passkeys are not available, So that I can still access my account from devices that don't support passkeys.
Acceptance Criteria: - Given I have a registered passkey for my Auth0 account - When I attempt to log in from a device that doesn't support passkeys - Then Auth0 should detect this limitation and present alternative authentication options - And these options should include: - Password authentication - Email verification code - SMS verification code (if a phone number is registered) - Other Auth0 supported authentication methods - When I select an alternative method - Then: - Auth0 should guide me through that authentication flow - Upon successful authentication, I should be redirected back to the application - And I should be logged into the platform - And the login should be logged for security audit purposes in both systems
US-UM-32: Recover Account Access Without Auth0 Passkey¶
As a staffing company user, I want to recover access to my account through Auth0 if I lose all my passkey devices, So that I can regain access to the platform.
Acceptance Criteria: - Given I have lost access to all my passkey devices - When I visit the login page - Then I should see an account recovery option - When I select this option - Then: - I should be redirected to the Auth0 account recovery flow - Auth0 should guide me through a secure account recovery process - This process should verify my identity through multiple verification steps - And once verified through Auth0, I should be able to: - Reset my password - Register a new passkey - Access my account - And all recovery actions should be logged for security audit purposes in both systems - And I should receive notifications about the account recovery - And my local user profile should be updated to reflect any changes made during recovery
US-UM-33: View Auth0 Passkey Usage Analytics¶
As a platform administrator, I want to view analytics on Auth0 passkey adoption and usage, So that I can monitor the security posture of the platform.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I navigate to the security analytics dashboard - Then I should see statistics on Auth0 passkey usage including: - Percentage of users with passkeys registered - Passkey authentication success rate - Passkey vs. password authentication usage - Failed authentication attempts by method - Auth0 authentication method distribution - And I should be able to filter data by date range and user groups - And I should be able to export reports for compliance purposes - And I should see trends over time to track adoption rates - And I should see recommendations for improving passkey adoption
US-UM-34: Configure Auth0 Passkey Policies¶
As a platform administrator, I want to configure Auth0 passkey policies, So that I can control how passkeys are used across the organization.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I navigate to the security policy settings - Then I should see options to configure Auth0 passkey policies - And I should be able to: - Enable or disable passkey authentication organization-wide - Set requirements for passkey registration (optional, recommended, required) - Configure which user groups can use passkeys - Set policies for passkey and password coexistence - When I update these policies - Then: - The changes should be applied to Auth0 tenant settings - Auth0 Rules should be updated to enforce the new policies - The local system should be updated to reflect the new policies - And users should be notified of the policy changes - And the changes should be logged for audit purposes in both systems
Dependencies¶
- Auth0 tenant setup and configuration
- Auth0 WebAuthn/FIDO2 capabilities enabled
- Integration between local database and Auth0
- Auth0 Logs API integration for monitoring