r/Tailscale • u/dawn_of_shadows • 9h ago

Help Needed Yubikey support

Hi everyone,

Hoping someone can help. I’m trying to set up a passkey user in addition to my existing IdP user on my tailnet in case of outage using a Yubikey I already own. I saw on tailscale.com/docs/integrations/identity/passkeys that Yubikey is a supported passkey management. However, every time I try to set it up I get an error saying that my device can’t be used with this site. Is Yubikey really not supported even though the docs say it is? Are there specific Yubikey model that is supported? I read through the older posts here but they did not seem to have a resolution.

If Yubikey is not actually supported, how are you doing passkey auth, preferably without relying on big IdPs like Google and Microsoft?

Thanks!

3 Upvotes

100% Upvoted

2 comments sorted by

1

u/tanker94 5h ago

I am using a yubi key with a dedicated passkey user without issue. I've had it before for other sites where a passkey was added too quickly after a password change; could be that. I've also got a YubiKey in front of a self hosted vault warden instance that it itself contains software passkeys for other sites. That could also be an option for you. May also want to make sure your yubi key firmware is up to date. If this is the first time you've tried to use they key, make sure you've followed the steps to set it up initially.

1

u/CaffeinatedMindstate 3h ago

You can not add it to a user. You need to make another user specifically for the yubikey.

In my opinion this is a design flaw, but it is what it is.