{"record":{"id":"4d1970d4acf79764","repo":"gravitational/teleport","slug":"device-lacks-resident-key-capabilities","errorCode":null,"errorMessage":"device lacks resident key capabilities","messagePattern":"device lacks resident key capabilities","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"lib/auth/webauthncli/fido2.go","lineNumber":69,"sourceCode":"\t// Timeout for blocking operations.\n\t// Functions fail with FIDO_ERR_RX on timeout.\n\tfido2DeviceTimeout = 30 * time.Second\n\n\t// Operation retry interval.\n\t// Keep it less frequent than 5Hz / 0.2s.\n\tfido2RetryInterval = 500 * time.Millisecond\n\n\t// Timeout for touch.Status operations.\n\t// Keep it less frequent than 5Hz / 0.2s.\n\tfido2TouchMaxWait = 200 * time.Millisecond\n)\n\n// User-friendly device filter errors.\nvar (\n\terrHasExcludedCredential = errors.New(\"device already holds a registered credential\")\n\terrNoPasswordless        = errors.New(\"device not registered for passwordless\")\n\terrNoPlatform            = errors.New(\"device cannot fulfill platform attachment requirement\")\n\terrNoRK                  = errors.New(\"device lacks resident key capabilities\")\n\terrNoUV                  = errors.New(\"device lacks PIN or user verification capabilities necessary to support passwordless\")\n\terrPasswordlessU2F       = errors.New(\"U2F devices cannot do passwordless\")\n)\n\n// TouchRequest abstracts *libfido2.TouchRequest for testing.\ntype TouchRequest interface {\n\tStatus(timeout time.Duration) (touched bool, err error)\n\tStop() error\n}\n\n// FIDODevice abstracts *libfido2.Device for testing.\ntype FIDODevice interface {\n\t// Info mirrors libfido2.Device.Info.\n\tInfo() (*libfido2.DeviceInfo, error)\n\n\t// IsFIDO2 mirrors libfido2.Device.IsFIDO2.\n\tIsFIDO2() (bool, error)\n","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthncli/fido2.go#L51-L87","documentation":"errNoRK is a user-friendly device filter error: the ceremony requires a resident (discoverable) key — needed for passwordless and usernameless flows — but the device lacks resident key capabilities (info.rk false), typically an older U2F-only or CTAP1 key.","triggerScenarios":"fido2.go:521 — rrk && !info.rk during device filtering when requireResidentKey is set in the ceremony.","commonSituations":"YubiKey 4/older keys without CTAP2 resident key support used for passwordless; key firmware too old; passwordless registration attempted with a non-RK key.","solutions":["Use a resident-key-capable authenticator (YubiKey 5+, CTAP2.1 device).","Update device firmware if the vendor added FIDO2 support (YubiKey 5 firmware updates).","Disable the resident key requirement if discoverable credentials are not strictly needed."],"exampleFix":"// before\n\"authenticatorSelection\": {\"requireResidentKey\": true}\n// after\n\"authenticatorSelection\": {\"requireResidentKey\": false} // if RK not required","handlingStrategy":"validation","validationCode":"// check resident key support before RK-requiring flows\n// ykman fido info  -> resident key supported?","typeGuard":null,"tryCatchPattern":"err := login(ctx)\nif err != nil && strings.Contains(err.Error(), \"resident key capabilities\") {\n\t// retry without requireResidentKey or prompt for a different device\n}","preventionTips":["Standardize on CTAP2.1 hardware (YubiKey 5+) where RK is required.","Keep key firmware updated.","Only set requireResidentKey=true for passwordless flows that genuinely need discoverable credentials."],"tags":["fido2","resident-key","yubikey","webauthn"],"backgroundTag":"authenticator-resident-key-unsupported","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}