FIDO2 / WebAuthn authentication

[deleted]

Hey,

when I try to setup a WebAuthn or FIDO2 authentication, I always get the error msg.
“invalid rpId hash” or “Error code: Error: invalid rpId hash - (reload browser if the error persists)”

Any Idea how to fix that?

aaronsmith

Have you reviewed this guide for setting up 2FA?
https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-tfa/

For WebAuthn to work, you need an encrypted connection to the server (HTTPS) as well as a FIDO security key.

Also note the browser must be compatible. See above link for the list.

Finally, make sure your physical security key is FIDO2 compatible. For example, YubiKey 4 is not FIDO2 compatible:
https://support.yubico.com/hc/en-us/articles/360013714599-YubiKey-4

However the YubiKey 5 is FIDO2 compatible:
https://support.yubico.com/hc/en-us/articles/360016649339-YubiKey-5C-NFC

[deleted]

I try to use it on a MacBook, running Safari.
Also I have the YubiKey 5C.

On all other websites it is just working fine.
So I think it seems to be an issue on the mailcow side.
But no idea what kind of :/

aaronsmith

Ah okay, maybe this document explains why:
https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-fido/

As of today, only administrators and domain administrators are able to setup WebAuthn/FIDO2.

Maybe to verify, can you try setting this up with the admin account?

As an alternative for non-admin accounts, you could try setting up Yubi OTP or TOTP.

[deleted]

aaronsmith

I actually tried it with the admin account :/

Small Update,

I have a MacBook which also supports WebAuth trough the Fingerprint sensor.
When I try to setup my MacBook as a auth device it works fine. (Even for normal user accounts)

But my Yubikey still won’t work :/
Can’t really understand why because on all other sides like Facebook or PayPal for example the yubikey works just fine.

aaronsmith

Maybe a bug in Mailcow then? Might be worth the time to submit an issue in GitHub. Logs from the containers might also give some clues as to what is wrong (and will likely be needed as part of logging the issue.)

To rule out an obscure OS / end-user-device issue with Mailcow (especially since you mentioned an M1 Mac which has its own fingerprint support), you might want to try again from a different machine (e.g. Windows or an Intel Mac) and see if it works?

[deleted]

Okay, I finally was able to add my yubikey.
I’ve tried it on phone and there is was working fine.

Now it also works on my MacBook.
Wired.. but working.