Passkeys (WebAuthn)
Passkeys are Layer 4 of the authentication model. They replace traditional passwords with cryptographic credentials tied to the user’s device, providing phishing-resistant, passwordless authentication built on FIDO2 (Fast Identity Online 2) / WebAuthn (Web Authentication) standards.
In Thinfinity® Workspace, passkeys function as a primary authentication method — not as a second factor. When enabled, users can sign in using biometric verification (fingerprint, face scan), a device PIN, or a hardware security key, without entering a username or password. The platform handles passkeys as a standalone login path alongside traditional credential-based and SSO methods.
How Passkeys Work in Thinfinity Workspace
Passkeys in Thinfinity Workspace involve two flows: registration (one-time setup) and authentication (every subsequent login).
Registration (Onboarding)
After a user completes a successful login through any traditional method (Directory Service, OAuth, SAML, or RADIUS), the platform can prompt them to register a passkey:
- The user logs in normally through any configured Authentication Method.
- If passkeys are enabled and the user has no registered passkey, the login flow presents a registration prompt — the user can register or skip.
- If the user chooses to register, the browser’s WebAuthn API is invoked. The user verifies their identity through their device’s authenticator (biometric, PIN, or security key).
- A cryptographic key pair is created. The private key stays on the user’s device (or password manager); the public key is stored by Thinfinity Workspace.
- The passkey is now linked to the user’s account for future logins.
Authentication
Once a passkey is registered, the user can bypass the traditional login form entirely:
- On the login page, the user selects Sign in with Passkey — or, if the browser supports conditional mediation (autofill), the passkey option appears directly in the username field’s autocomplete suggestions.
- The browser invokes the WebAuthn API. The user verifies through their device’s authenticator.
- The signed assertion is sent to the Primary Broker, which validates the cryptographic proof against the stored public key.
- On successful validation, the session is established and access is granted — no password is involved at any point.
Conditional mediation means that on supported browsers, passkey suggestions can appear automatically in the username field’s autofill menu — even before the user selects any button. This behavior is active when at least one traditional login method (username/password) is also available. This creates a smooth login experience.
When to Use Passkeys
| Scenario | Passkeys as… | Reason |
|---|---|---|
| Zero Trust / maximum security | Primary login method | Eliminates passwords and phishing risk entirely. |
| Convenience for frequent users | Alternative to SSO | Faster than IdP redirects — one biometric tap. |
| High-security environments with existing SSO | Complement to Layers 1–3 | Adds a passwordless option without removing existing methods. |
| Compliance requiring phishing-resistant auth | Primary or only method | Supports phishing-resistant authentication aligned with NIST AAL2+ guidelines. Hardware-bound passkeys can satisfy AAL3 requirements. |
Passkeys do not replace Directory Service accounts. The passkey is linked to a DS identity — it changes how the user proves their identity, not who they are within the platform. The layered model still applies: Layer 1 (DS) defines the user, Layer 4 (Passkeys) changes the authentication mechanism.
Managing Registered Passkeys
Users can view and revoke their registered passkeys. Revoking a passkey removes the stored public key — the user will need to register a new passkey or use another authentication method on their next login.
Administrators can manage passkey registrations through the platform’s API endpoints for audit and lifecycle management.