October 8, 2019 By Henrik Loeser 4 min read

Enabling a secure web application that is protected by App ID to use FIDO2 devices for the second factor.

Last week, I had the chance to read a blog post on how to protect cloud apps with App ID by using the IBM Cloud Identity user directory. That blog discusses how to configure IBM Cloud Identity as a SAML-based identity source for IBM Cloud App ID

Because Cloud Identity supports FIDO2 devices for second-factor authentication (2FA) as a beta feature, I wanted to test how easy it is to use my USB FIDO2 devices for securing my web apps. For that purpose, I picked the app from the solution tutorial discussing end-to-end security for an application on IBM Cloud. App ID is part of the solution architecture (see the diagram):

FIDO2: An overview

If you are not too deep into security, you might be wondering about FIDO2. FIDO2 is a joint project by the FIDO Alliance (Fast IDentity Online) and the W3C to provide strong authentication for web applications. Thus, it aims to improve security by reducing or eliminating identity theft through providing passwordless authentication. 

At the core of FIDO2 are cryptographic authenticators which can be hardware security keys connected via USB, NFC, or by being built into (e.g., smartphones). The authenticators are combined with the WebAuthn protocol that defines how web applications, the computer (client), and authenticators interact. It is important to note that the authentication itself is performed by the cryptographic authenticator (the hardware). The computer (client) utilizes the Client to Authenticator Protocol (CTAP).

For my tests I am using both FIDO2 Level 1 and Level 2 certified authenticators. One USB device has a button to press to initiate authentication, the other is a fingerprint scanner with some of my fingerprints enrolled. You can learn more about FIDO2 at the FIDO Alliance site or via links on this curated WebAuthn awesome list.

Enabling FIDO2 in IBM Cloud Identity

After signing up for IBM Cloud Identity, I contacted the beta administrator to enable FIDO2 support in my instance. I also configured Cloud Identity as a SAML-based provider in the App ID instance that I have. The app is based on the mentioned tutorial on end-to-end security

For connecting App ID and Cloud Identity, I followed the instructions from the recent blog post.

With the foundation in place, I added a new user to Cloud Identity’s Cloud Directory (i.e., its user repository). Because I enabled it, an email with a temporary password was sent to the specified email address. Utilizing Chrome with an incognito window and acting as the new user, I logged in to Cloud Identity. There, I first had to change the password and then confirm my identity with a one-time-passcode (OTP) sent by email. 

After clicking on my profile, I could add new methods for the second-factor authentication:

I picked “FIDO Device” and registered my first device, then repeated it for my second device. It is important to note that only certain browsers with a minimum software level support the registration and authentication flows.

Next, I tested the secure file storage application from the tutorial. I could log in, but the security key was needed. Something was wrong, and I found that I had to change the configuration for the App ID application within Cloud Identity. The default policy was still in place and I replaced it with “Require 2FA each session in all devices”:

FIDO2-based 2FA for IBM Cloud apps

With the changed policy in place, I logged in to my app again. After accepting my password, the login dialog presented me options for the second factor. Either OTP by email or authenticating by using one of the configured FIDO devices:

After selecting a device, I was prompted to insert the USB security key into my computer to authenticate. This meant either pressing the button on the USB dongle or touching the key with an enrolled finger. Finally, I was logged in and could upload a file to my encrypted cloud storage account (the tutorial app).

If you want to test it yourself, I recommend changing the SAML configuration for App ID in Cloud Identity. For the “Name Identifier” change it to “Email.” It allows the tutorial to work if the user name is not an email address.

In addition to tests described above, I also tried an account without a FIDO2 device. For that case, I had configured email-based OTPs as supported second factors. The sent code is valid for five minutes:


Enabling the secure web application that is protected by App ID to use FIDO2 devices for the second factor was simple. At this moment, App ID’s own cloud directory does not support FIDO2, but IBM Cloud Identity does. Cloud Identity can be used as SAML-based identity provider. With the right access policy in place, 2FA is enforced and I could use my hardware security keys for it.

If you have feedback, suggestions, or questions about this post, please reach out to me on Twitter (@data_henrik) or LinkedIn

Was this article helpful?

More from Cloud

Announcing Dizzion Desktop as a Service for IBM Virtual Private Cloud (VPC)

2 min read - For more than four years, Dizzion and IBM Cloud® have strategically partnered to deliver incredible digital workspace experiences to our clients. We are excited to announce that Dizzion has expanded their Desktop as a Service (DaaS) offering to now support IBM Cloud Virtual Private Cloud (VPC). Powered by Frame, Dizzion’s cloud-native DaaS platform, clients can now deploy their Windows and Linux® virtual desktops and applications on IBM Cloud VPC and enjoy fast, dynamic, infrastructure provisioning and a true consumption-based model.…

Microcontrollers vs. microprocessors: What’s the difference?

6 min read - Microcontroller units (MCUs) and microprocessor units (MPUs) are two kinds of integrated circuits that, while similar in certain ways, are very different in many others. Replacing antiquated multi-component central processing units (CPUs) with separate logic units, these single-chip processors are both extremely valuable in the continued development of computing technology. However, microcontrollers and microprocessors differ significantly in component structure, chip architecture, performance capabilities and application. The key difference between these two units is that microcontrollers combine all the necessary elements…

Seven top central processing unit (CPU) use cases

7 min read - The central processing unit (CPU) is the computer’s brain, assigning and processing tasks and managing essential operational functions. Computers have been so seamlessly integrated with modern life that sometimes we’re not even aware of how many CPUs are in use around the world. It’s a staggering amount—so many CPUs that a conclusive figure can only be approximated. How many CPUs are now in use? It’s been estimated that there may be as many as 200 billion CPU cores (or more)…

IBM Newsletters

Get our newsletters and topic updates that deliver the latest thought leadership and insights on emerging trends.
Subscribe now More newsletters