Distribution layout
| Path | Contents |
|---|---|
database/ |
Shared passkey schema bootstrap SQL for PostgreSQL and MySQL/MariaDB. |
app/ |
Container build context for the OmniPasskey management interface. |
packages/ |
Installable OmniPasskey application packages for supported operating systems. |
idp_plugin/ |
Signed Shibboleth IdP plugin artifacts for passkey authentication. |
README.txt |
Identifies the release, points to the current web documentation, and summarizes verification and deployment precautions. |
SHA256SUMS |
Provides SHA-256 checksums for the extracted release payload. |
URL map
| URL | Purpose | Typical audience |
|---|---|---|
/passkey/registration |
Start a new passkey registration | End user, admin, helpdesk |
/passkey/account/credentials |
View and remove personal passkeys | End user |
/passkey/account/history |
Review personal passkey activity | End user |
/passkey/helpdesk/* |
Support-focused dashboards, logs, and credential views | Helpdesk |
/passkey/admin/* |
Administrative dashboards, credential management, rules, and settings | Administrator |
/registration-server/webauthn/* |
Browser-facing API surface used by the OmniPasskey UI | Application runtime |
/registration-server-backend/* |
Backend-only inline-registration API path | IdP only |
Key configuration files
| File | Why it matters |
|---|---|
.env |
Defines the WebAuthn server identity and Django runtime boundaries. |
env.js |
Points the browser at the correct API base and logout path. |
omnipasskey.conf |
Provides route protection, WSGI aliases, and authorization placeholders. |
passkey-database.properties |
Aligns the management interface and IdP plugin on the same database engine, host, credentials, and schema. |
passkey.properties |
Controls relying-party values and passkey authentication behavior at the IdP. |
mfa-authn-config.xml |
Determines how passkey flows participate in your MFA map. |
Role access matrix
| Capability | End user | Helpdesk | Administrator |
|---|---|---|---|
| Register a passkey | Yes | Yes | Yes |
| Manage personal passkeys | Yes | Yes | Yes |
| Search organization-wide credentials | No | Yes | Yes |
| Review operational logs | No | Yes | Yes |
| View dashboards | No | Yes | Yes |
| Manage device rules | No | No | Yes |
| Manage global settings | No | No | Yes |
Shared data model
| Table | Purpose |
|---|---|
passkey_users |
Maps usernames to stable WebAuthn user handles and tracks the most recent successful passkey authentication. |
passkey_registrations |
Stores globally unique credential IDs, key material, counters, attestation details, transports, backup eligibility/state, UV initialization, nullable client-reported discoverability, nicknames, and timestamps. |
registration_cache |
Holds short-lived registration state, including challenge, exact expected origin, user-verification requirement, and offered COSE algorithms. |
inline_registration_tokens |
Stores one-time hashed tokens used for IdP-to-backend inline-registration calls. |
passkey_log |
Stores the structured audit data presented by System Logs, including request correlation, operation outcome, identity, credential, client, network, and bounded error details. Authentication entries also supply input for dashboard aggregation. |
passkey_authattempts_aggregate |
Stores the hourly rollups that power dashboard metrics. |
passkey_settings |
Stores global configuration values, including policy defaults, exact registration origins, backup eligibility, inline-registration experience, algorithm order, and browser client-hint preferences. |
passkey_rules |
Stores per-AAGUID device policy rules. |
Dashboard metrics
Successful authentications
Failed authentications
Monthly active users
Average authentications per user
Passkeys per user
Trend charts over time
Property reference
| Property | Meaning |
|---|---|
ID |
WebAuthn relying-party ID for the management interface. |
SERVER_NAME |
Friendly server name used by the WebAuthn registration service. |
idp.authn.passkey.relyingPartyId |
Relying-party ID used during IdP-side passkey authentication. |
idp.authn.passkey.relyingPartyOrigin |
Exact IdP origin used during passkey ceremonies. |
idp.authn.passkey.allowAnyOriginPort |
Allows the configured IdP origin on any port for controlled testing scenarios. |
idp.authn.passkey.allowAnyOriginSubdomain |
Allows subdomains of the relying-party ID as valid origins when intentionally required by the deployment. |
idp.authn.passkey.usernameless |
Enables discoverable-passkey flows when set to true. |
idp.authn.passkey.conditionalMediation |
Lets supported browsers offer passkeys automatically on the IdP login page. |
idp.authn.passkey.userVerificationRequirement |
Controls biometric, PIN, or equivalent authenticator verification during passkey authentication. This is separate from the Registration User Verification choice in Manage Settings. |
idp.authn.passkey.2fa |
Globally permits passkey use as a second factor inside the IdP MFA flow. It does not disable primary-factor passkey use. It must be true for OmniPasskey MFA-only device or default rules to work. |
idp.authn.passkey.2fa.factorsAllowed |
Lists the first-factor IdP flows that may precede passkey second-factor use. A completed prior factor must match this list when second-factor use is attempted. |
idp.authn.passkey.supportedPrincipals |
Defines the assurance classes the passkey flow itself can advertise on success. Configure values that accurately describe the assurance provided by the flow. |
idp.authn.MFA.supportedPrincipals |
Defines the assurance classes the top-level MFA flow advertises to service providers. |
idp.authn.audit.enabled |
Enables the standard Shibboleth IdP authentication audit log for cross-checking passkey outcomes. |
idp.authn.passkey.genericMessageID |
Message key prefix used by the default passkey error lookup. |
idp.authn.passkey.ui.debug |
Enables scrollable on-page diagnostic panels in the IdP passkey views. Application diagnostics stay in these panels instead of the browser console. Output can contain usernames, helper-cookie state, request details, and WebAuthn objects, so use it temporarily and redact it before sharing. |
idp.authn.passkey.inlineRegistration.enabled |
Turns on the optional post-password inline-registration experience. |
idp.authn.passkey.inlineRegistration.backendUrl |
Points the IdP at the backend-only Django endpoint used for inline registration. |
idp.authn.passkey.inlineRegistration.promptTargetPasskeys |
Defines how many passkeys a user should have before the IdP stops prompting for inline registration. |
idp.authn.passkey.inlineRegistration.promptIntervalDays |
Defines how long the IdP waits after dismissal before offering inline registration again. |
| Inline Registration Experience | Manage Settings choice. Standard inline setup is the button-driven default. Automatic Conditional Create opts into a saved-password-to-passkey upgrade with a fallback. It requires a recently used saved password whose username exactly matches the canonical WebAuthn username, browser and default-password-manager support, and policy that does not require registration verification or trusted attestation. |
| Registration Client Hints | Ordered browser hints used during Django-backed self-service and inline registration ceremonies. |
| Authentication Client Hints | Ordered browser hints used during IdP-side passkey authentication and conditional mediation. |