Since Version 18, the Password Depot Enterprise Server supports FIDO2/WebAuthn, enabling users to use YubiKeys as a two-factor authentication (2FA) method when connecting to a Password Depot server via the Password Depot client.
Requirements:
A FIDO2-compatible device. To use FIDO2 as a 2FA method, ensure that your YubiKey supports FIDO2.
Windows 10 Version 1903 or higher.
How to enable FIDO2/WebAuthn 2FA authentication on your Password Depot Server:
To set up the FIDO2 2FA method globally, open your Password Depot Server Manager and navigate to Manage -> Server options -> 2FA Settings. You can also enable 2FA for individual users by going to Users -> <User> -> Properties -> Account and selecting Enable Two-Factor Authentication.
How to authenticate via FIDO2 on first login:
Once 2FA has been enabled and FIDO2 is selected as the 2FA method (either globally or individually), follow the steps below:
Step 1: Open the Password Depot client.
Step 2: Click on Connect to Enterprise Server.
Step 3: Enter the address, port number, and user credentials, then click Login.
A dialog window from Windows Security will pop up (it may appear in the background; check your taskbar).
Step 4: In the Windows Security dialog, select the option Security key and click Next.
Step 5: Follow the instructions to set up a security key.
Step 6: Either enter your PIN or set a new security key PIN for your YubiKey and touch your security key.
Below you will find additional answers to frequently asked questions:
Why does Windows Security ask for the key PIN on every login using a YubiKey?
This is how the preferred mode works.
Can computers be added as trusted devices when using FIDO2?
No, this is not possible.
Error message: The security key doesn’t look familiar. Please try a different one.
To resolve this issue, open the Password Depot Server Manager, go to Users -> <User> and click on Reset 2FA. After resetting, please close the dialog window and try logging into the server again through the client.
Note: The YubiKey cannot be used as the primary authentication method to unlock a Password Depot database, such as replacing the master password.