Introduction
From version 7.5 of vSEC:CMS you can manage the lifecycle of FIDO and PKI credentials on Yubikey MPE credentials. The article will cover the following:
- Setup a template that will allow you to create and issue a Windows logon certificate and a passkey to a Yubikey MPE credential from vSEC:CMS Admin or Agent console application;
- Issue centrally a Windows logon certificate and a passkey to the Yubikey MPE credential;
- Log onto a Windows client using the issued Yubikey MPE credential;
- Setup a template that will allow you to create and issue a Windows logon certificate and a passkey to a Yubikey MPE credential from vSEC:CMS User application;
- Issue a Windows logon certificate and a passkey to the Yubikey MPE credential via the vSEC:CMS User application;
- Log onto a Windows client using the issued Yubikey PIV credential;
- Authenticate to an IDP application using the issued passkey.
This article will be divided into 2 sections depending on how you wish to manage the issuance of Yubikey MPE credential: Issue Centrally or Issue Through USS.
The PKI used here will be a Microsoft Certificate Authority (CA). If another CA is to be used please refer to the Administration guide for details on configuring a connection to such a CA.
The passkey used here will be an Entra ID credential. Please make sure to have already setup connections to support this. Refer to this article for instructions.
It will be required that at minimum you have already successfully completed the configuration steps described in the article Setup Evaluation Version. The instructions in this document are applicable regardless of whether you are running the evaluation version or a production version.
Important
It is required that the YubiKey MPE driver is installed. It offers more functionality than the default Windows driver. You should install it on any computer where you plan to manage or use your YubiKeys.
When installing the Yubikey MPE driver over an RDP connection you need to pass in a parameter INSTALL_LEGACY_NODE=1 to the installer. For example from a command line run similar to below (consult the Yubico online documentation on this for further details):
msiexec /i YubiKey-Minidriver-[Version].msi INSTALL_LEGACY_NODE=1 /quietYou can verify that the driver is installed correctly from Actions - Credential Information and where is says Minidriver you should see that the name is similar to below screenshot. You can click this link to open and verify the version of the driver.
Issue Centrally
If you will issue the Yubikey MPE credential centrally by an operator then follow the instructions in this section. The configuration steps need to be performed using the vSEC:CMS Admin application.
Configure Credential Access
Typically the credential access is already set to the correct type but for completeness we will cover this in the article.
From Options - Credential Access attach a Yubikey MPE credential that you will manage with the vSEC:CMS. The vSEC:CMS will filter the credential type and present the entry in the table.
If the filter is empty click the Add button, followed again by clicking the Add button. Make sure to select the correct reader and click the Get button. Cick Ok and click Save.
Configure Challenge/Response For PIN Reset
The PIV standard only supports the resetting of the user PIN using a PUC code. Therefore, challenge-response is not normally supported for performing PIN resets. However, this is possible with vSEC:CMS.
From Options – Security in the Application Security section enable the Enable challenge/response for offline PUC based unblock.
Additionally, it will be necessary to enable support for this feature on the client side. The Enable challenge/response for offline PUC based unblock setting will need to be enabled in the vSEC:CMS User application through the -configure option when configuring the setting on the client.
See the Issue Credential section in Issue Through vSEC:CMS User below where you will find instructions for installing the vSEC:CMS User application.
From a command prompt go to the location where the vSEC:CMS User application is installed and run the command: vSEC_CMS_T_USS.exe -configure
Then enable the setting Enable challenge/response for offline PUC based unblock as below. It should be noted that this setting can be enabled through GPO. See the article Configure Windows GPO for further details.
Additionally the Credential Access needs to be set to Use native access if possible.
Credential Configuration
1. From Templates - Credential Templates click the Add button.
Click the Edit link beside General. Enter a template name and attach a Yubikey MPE credential that is to be managed by this template and click the Detect button and wait for the vSEC:CMS to detect the token and click Ok.
Check Enable FIDO2.
Leave all other settings as default and click Ok to close and save.
2. Click the Edit link for Issue Credential. Select Issue by Operator(s) and enable Assign user ID and select the directory that the user will be selected from.
Enable Enroll certificate(s) and add a certificate type that is to be issued.
Enable FIDO2 Enrollment and select the FIDO2 template that is to be used.
Leave all other settings as default and click Ok to close and save.
3. Click the Edit link for Initiate Credential.
Enable Update Credentials at FIDO2 IdP.
Enable System keeps PIN if you want vSEC:CMS to set a random PIN value. If this is not configured then the user will need to set a PIN value.
Enable Enroll FIDO FP (FingerPrint). As the MPE credential sync the FP with the user PIN, if you enroll a FP then this will be used when authenticating rather than the PIN.
Click the Configure button to see additional options.
Select User selects which finger to enroll to allow user to use whatever FP during enrollment. Alternatively, you can select the option Preconfigured fingers to enroll. Click the Configure button.
Enter a label name for the finger you want to be prompted to enroll during the actual enrollment and click Add.
Click Ok to save and close.
4. Click the Edit link for Activate Credential. Enable Update Credentials at FIDO2 IdP and click Ok to save and close.
5. Click the Edit link for Revoke Credential. Enable Update Credentials at FIDO2 IdP and Force FIDO2 Authenticator data deletion at IdP (Fail to revoke device if IdP is not reachable).
Click Ok to save and close.
Issue Credential
You can centrally issue using either the vSEC:CMS Admin or Agent application.
From the Lifecycle page attach a blank Yubikey MPE credential to your host.
Click the Issued oval and select the template from Select credential template drop-down list and click Execute.
You will be prompted to enter your Operator passcode before the issuance will begin. Then you will be prompted to select the user from your directory that the credential will be issued to. Select the user and at the end of the process you will get a short summary dialog of what operations were performed.
Now you should activate the credential, i.e. enroll a FP and/or set a PIN (depending how you configured the template). Depending on how you configured the template you may or may not need to enter a name for the FP enrollment. Click the New Enrollment button to start the enrollment.
You will need to touch and remove your finger from the scanner multiple times to get an accurate FP capture. Follow the prompts to complete the enrollment.
Now you can use the MPE credential for passkey and PKI authentication.
Issue Through USS
If the end user will issue the Yubikey MPE credential themselves via vSEC:CMS User then follow the instructions in this section.
You can extend the existing template we created in the section Issue Centrally above and navigate to the General section. Click the Manage button in the Self-service using the following template section.
Select the template created earlier and click Edit. Enable Self-issuance enabled check box and click Save to close and save. Close the dialog and select Cancel at the bottom of the General dialog.
Select Edit in the Issue Credential section.
Enable Automatically initiate credentials after issuance and Issue by User(s). Click the Configure button. In the User ID from drop-down select the Entra ID template where the user will be selected from. In the Authenticate user using drop-down select the Entra ID OAuth template that will be used to authenticate the user during credential issuance. Click Ok to save the changes and close.
Click Ok to save and close.
Click Ok to complete and close the template configuration.
Issue from vSEC:CMS User Application
On a client open the vSEC:CMS User application that is already configured to connect to the backend service. Navigate to the Credential tab and select the correct reader that the credential is connected to and click Issue.
From the Credential template select the template created earlier and click Issue. Follow the on-screen prompts to issue and enroll FP(s).
Now you can use the MPE credential for passkey and PKI authentication.