Will Passkeys Work With Our Central Directory for Authentication?
Yes and no. Passkeys are unique to each web application and never shared across applications; this is a feature that reduces phishing, because a passkey won’t work except on the site for which it was generated. You can store multiple public keys in a central directory for your own web applications, or they can be distributed into each different web application.
If you choose to put them in a central directory, you’ll have to make significant changes to handle the additional per-user storage and create business logic for things such as authentication resets.
How Hard Is It to Modify My Applications To Support Passkeys?
It’s harder than you might think, but it is possible. Passkeys are not just another authentication method; the user interface and user experience are very different, the standard is hard to read, device support varies significantly, and detecting whether a user has set up a passkey and whether it’s available in the device being used can be difficult. Your developers will be able to do it, but it’s not going to happen overnight.
How Do I Handle Apps or Devices That I Don’t Want To Touch?
A whole industry of privileged access management products has popped up to solve the problem of legacy and nonweb applications. Some of these products support passkeys, so now’s the time to start with passkeys for user authentication.
RELATED: K–12 schools must modernize their identity and access management programs.
How Do Passkeys Fit in With Federated Identity?
Take advantage of the best aspects of both. Passkeys are more secure than passwords or multifactor authentication, so they’re especially appropriate for high-risk/high-value applications. You can also use passkeys for authentication to your federated identity system. You’ll give up some of the security and phishing protection, but you can get started with passkeys and realize immediate security gains by eliminating passwords and MFA costs.
