{"record":{"id":"0662df595f067f32","repo":"gravitational/teleport","slug":"device-lacks-pin-or-user-verification-capabilities","errorCode":null,"errorMessage":"device lacks PIN or user verification capabilities necessary to support passwordless","messagePattern":"device lacks PIN or user verification capabilities necessary to support passwordless","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"lib/auth/webauthncli/fido2.go","lineNumber":70,"sourceCode":"\t// Functions fail with FIDO_ERR_RX on timeout.\n\tfido2DeviceTimeout = 30 * time.Second\n\n\t// Operation retry interval.\n\t// Keep it less frequent than 5Hz / 0.2s.\n\tfido2RetryInterval = 500 * time.Millisecond\n\n\t// Timeout for touch.Status operations.\n\t// Keep it less frequent than 5Hz / 0.2s.\n\tfido2TouchMaxWait = 200 * time.Millisecond\n)\n\n// User-friendly device filter errors.\nvar (\n\terrHasExcludedCredential = errors.New(\"device already holds a registered credential\")\n\terrNoPasswordless        = errors.New(\"device not registered for passwordless\")\n\terrNoPlatform            = errors.New(\"device cannot fulfill platform attachment requirement\")\n\terrNoRK                  = errors.New(\"device lacks resident key capabilities\")\n\terrNoUV                  = errors.New(\"device lacks PIN or user verification capabilities necessary to support passwordless\")\n\terrPasswordlessU2F       = errors.New(\"U2F devices cannot do passwordless\")\n)\n\n// TouchRequest abstracts *libfido2.TouchRequest for testing.\ntype TouchRequest interface {\n\tStatus(timeout time.Duration) (touched bool, err error)\n\tStop() error\n}\n\n// FIDODevice abstracts *libfido2.Device for testing.\ntype FIDODevice interface {\n\t// Info mirrors libfido2.Device.Info.\n\tInfo() (*libfido2.DeviceInfo, error)\n\n\t// IsFIDO2 mirrors libfido2.Device.IsFIDO2.\n\tIsFIDO2() (bool, error)\n\n\t// Cancel mirrors libfido2.Device.Cancel.","sourceCodeStart":52,"sourceCodeEnd":88,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthncli/fido2.go#L52-L88","documentation":"errNoUV is a user-friendly device filter error: the ceremony requires user verification (PIN or biometric, uv=true) but the device cannot perform UV (info.uvCapable() false). Without filtering, the request would later fail with libfido2.ErrUnsupportedOption, so the device is excluded up front.","triggerScenarios":"fido2.go:205 (passwordless/UV path) and fido2.go:523 (uv && !info.uvCapable()) — device has no PIN set or no UV support while userVerification=\"required\".","commonSituations":"Security key without a configured PIN; FIDO devices with no biometric; policy requires UV but key is factory-default.","solutions":["Set a FIDO2 PIN on the device: ykman fido access change-pin (then retry).","Use a device with built-in user verification (biometric key or platform authenticator).","Downgrade the requirement to userVerification=\"preferred\"/\"discouraged\" in the WebAuthn config if UV is not mandatory."],"exampleFix":"// before\n\"authenticatorSelection\": {\"userVerification\": \"required\"} // with PIN-less key\n// after: set a PIN, or relax:\n\"authenticatorSelection\": {\"userVerification\": \"preferred\"}","handlingStrategy":"validation","validationCode":"// ensure a FIDO2 PIN is set before UV-required flows\n// ykman fido access change-pin","typeGuard":null,"tryCatchPattern":"err := login(ctx)\nif err != nil && strings.Contains(err.Error(), \"PIN or user verification\") {\n\t// prompt user to set a PIN or use a different device\n}","preventionTips":["Provision PINs on all security keys during onboarding.","Verify uvCapable devices before enabling userVerification=required policies.","Allow userVerification=preferred when UV is not strictly mandated."],"tags":["fido2","user-verification","pin","webauthn"],"backgroundTag":"authenticator-user-verification-incapable","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}