The passwordless feature has been just added onto Nextcloud V19. It allows authentication without a password. WebAuthn's support makes it possible using a Fido2 USB key. You'll find here the step by step guide to enable your Nextcloud account with the password-less authentication. The guide was originally published by sosandroid, in English and French

Test service

Prerequisite

A server or laptop running Docker is used here. There are other ways to test, we chose that one. You'll also need a valid domain with a valid SSL cert (not self-signed). This guide is based on a test container using the docker-compose.yaml. It has been launched using the following command line.

NEXTCLOUD_URL=mydomain.tld NEXTCLOUD_ADMIN_USER=admin NEXTCLOUD_ADMIN_PASSWORD=mypassword docker-compose up

Authentication WebAuthn / Fido2

The following key has been tested: Token2 T2F2 ALU for this test.

Set a PIN code

Before you can enrol the FIDO2 key a PIN code needs to be set. This can be done using standard control panel applet (available with Windows 10 starting 1903 release)

You can also use the TOKEN2 Companion app to set the PIN-code on your FIDO2 Key.  

Set your PIN code. 1234 for instance.

Set your Nextcloud account

0. Insert the USB key into the computer
1. Authenticate using your account and password
2. Go to the settings

3. Navigate to Security
4. Start adding a WebAuthn device

5. A pop-up asks you for the PIN code

6. Press the key button to enrol it

7. Give the key a cool name

8. You're set

1st authentication

0. Insert the USB key into the computer and log out from your Nextcloud account
1. From your browser, refresh the Nextcloud's login: https://mydomain.tld/login

2. Click Log in with a device
3. Fill your login and press Log in

4. Enter your pin code

5. Press the hardware button of the USB key

6. You're in

Tested Browsers

Fido2 key enrollment

For the authentication

Footnotes

1. On Nextcloud the login/password authentication remains active. You must then choose a strong password as per common security rules.
2. The consequence is you cannot be locked out by losing your USB key
3. When the session expires or when changing some settings on your account the password is requested.
4. While authenticating, depending on the OS / Browser the PIN code can be requested or not. This is normal behaviour