3.7 Configuring MyID to issue passkeys using Microsoft Entra

To configure and enable this feature in MyID, you must:

• Set up the allowed origins in the MyID web.oauth2 settings.

• Set up an external system to communicate with the FIDO system.

• Create a credential profile for your FIDO devices.

3.7.1 Setting up the allowed origins

To allow MyID to perform attestation checks on a newly created FIDO credential with an origin that is not the MyID server, you must configure the MyID web.oauth2 settings to list the allowed origins for FIDO devices; this is the list of domains that are allowed to authenticate. You must include your MyID web server domain and the Microsoft domain.

To configure the server settings for multiple origins:

1. On the MyID web server, open the appsettings.Production.json file in a text editor.

   By default, this is:

   C:\Program Files\Intercede\MyID\web.oauth2\appsettings.Production.json

   This file is the override configuration file for the appsettings.json file for the web service. If this file does not already exist, you must create it in the same folder as the appsettings.json file.

2. Edit the file to include the following:

   Copy

   {
       "Fido":{
           "Config":{
               "Origins":["https://<server>", "https://login.microsoft.com"]
           }
       }
   }

   where:

   • <server> – the name of the MyID web server.

   Important: The Origins option is case sensitive, and must be consistent with the casing of the DNS Name in the web server's TLS certificate.

3. Save the appsettings.Production.json file.

4. Recycle the web service app pool:

   1. On the MyID web server, in Internet Information Services (IIS) Manager, select Application Pools.
   2. Right-click the myid.web.oauth2.pool application pool, then from the pop-up menu click Recycle.

   This ensures that the web service has picked up the changes to the configuration file.

Note: If Origins is specified, it overrides any value in Origin.

3.7.2 Setting the MyID Client Service timeout

When you attempt to collect an externally-linked FIDO credential, if you have not already opened the MyID Client Service, the browser displays a pop-up asking you to open the MyID Client Suite (which contains the MyID Client Service required to collect the FIDO credential).

The browser waits ten seconds (by default) for you to click the option.

If the MyID Client Service does not run by the end of the timeout period, the browser displays the following error:

• OA10087 – The MyID client service encountered an issue while attempting to register your device with an external source.

If you want to change this timeout, you can configure the web.oauth2 settings file.

Note: This setting affects the timeout only when collecting externally-linked FIDO credentials; it does not affect the behavior of the pop-up in other circumstances.

To change the MyID Client Service timeout:

1. On the MyID web server, open the appsettings.Production.json file in a text editor.

   By default, this is:

   C:\Program Files\Intercede\MyID\web.oauth2\appsettings.Production.json

   This file is the override configuration file for the appsettings.json file for the web service. If this file does not already exist, you must create it in the same folder as the appsettings.json file.

2. Edit the MyID section to include the following:

   Copy

   {
       "MyID":  {
           "MaxCheckAliveTimeMs":  <timeout>
   }

   where:

   • <timeout> – the number of milliseconds to wait for the user to open the MyID Client Suite.

3. Save the appsettings.Production.json file.

4. Recycle the web service app pool:

   1. On the MyID web server, in Internet Information Services (IIS) Manager, select Application Pools.
   2. Right-click the myid.web.oauth2.pool application pool, then from the pop-up menu click Recycle.

   This ensures that the web service has picked up the changes to the configuration file.

3.7.4 Creating a credential profile for passkeys

Once you have configured your external system, you can create a credential profile for passkeys that use this external system. See section 5.2, Setting up a passkey credential profile for the Self-Service Request Portal.