passkey on multisite-domains

  • Resolved emiliopro

    (@emiliopro)


    3 weeks, 6 days ago

    I’ve created a passkey for my multi-site installation, and I can login using the passkey on the main domain but not on another domain, ie:
    mainsite.org <- works.
    othersiteonsameinstallation.org <- does not work but gives error:

    SecurityError: The requested RPID did not match the origin or related origins.

    othersiteonsameinstallation.org is listed on Allowed Passkey Hostnames in settings.

    Maybe this has something to do with the fact that only superadmins can use the passkey feature?

    (imho: it is a shame to only superadmins can use passkeys on multisite, as system adinimstrators are usually more aware of security and phishing risks than regular users. So the latter would benefit more)

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfpeter

    (@wfpeter)

    3 weeks, 1 day ago

    Hi @emiliopro,

    We do only support Super Admin with passkeys on multisite at this time as that’s the highest default level, above individual site “Administrator” status.

    To better understand your situation as a “System Administrator”, I take that to mean you may be in control of managing all of the sites and have the permissions necessary to set yourself as a Super Admin role in the WordPress multisite installation? Are you using custom role management, or is something else preventing you from taking on the role?

    Many thanks,
    Peter.

    ablears

    (@ablears)

    2 weeks, 4 days ago

    I’m super admin for a WP network. Activated passkeys on the Wordfence admin panel on the network parent. Added the other domains to the “Allowed Passkey Hostnames” field. Saved the change and clicked ‘Update Public Suffix List’ just in case.

    I try to login to any domain added to the hostnames with passkeys and get:
    >SecurityError: The requested RPID did not match the origin or related origins.

    EDIT: The error is at the browser level, not Wordfence. See https://www.corbado.com/blog/webauthn-related-origins-cross-domain-passkeys for help setting up a /.well-known/webauthn file.

    • This reply was modified 2 weeks, 4 days ago by ablears.
    Plugin Support wfmargaret

    (@wfmargaret)

    1 week, 4 days ago

    Hi @ablears,

    Thank you for reaching out. If you’re still having any trouble, please start a new topic so we can help you with your specific setup. Unless users have the exact same version of WordPress on the same physical server, hosted by the same host, with the same plugins, theme, and configurations, a solution that works for one user likely won’t work for another.

    Thanks,
    Margaret

Viewing 3 replies - 1 through 3 (of 3 total)

You must be logged in to reply to this topic.