{"record":{"id":"a14f56c489b2bd35","repo":"gravitational/teleport","slug":"device-not-registered-for-passwordless","errorCode":null,"errorMessage":"device not registered for passwordless","messagePattern":"device not registered for passwordless","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"lib/auth/webauthncli/fido2.go","lineNumber":67,"sourceCode":"\tfido2DeviceMaxWait = 100 * time.Millisecond\n\n\t// Timeout for blocking operations.\n\t// Functions fail with FIDO_ERR_RX on timeout.\n\tfido2DeviceTimeout = 30 * time.Second\n\n\t// Operation retry interval.\n\t// Keep it less frequent than 5Hz / 0.2s.\n\tfido2RetryInterval = 500 * time.Millisecond\n\n\t// Timeout for touch.Status operations.\n\t// Keep it less frequent than 5Hz / 0.2s.\n\tfido2TouchMaxWait = 200 * time.Millisecond\n)\n\n// User-friendly device filter errors.\nvar (\n\terrHasExcludedCredential = errors.New(\"device already holds a registered credential\")\n\terrNoPasswordless        = errors.New(\"device not registered for passwordless\")\n\terrNoPlatform            = errors.New(\"device cannot fulfill platform attachment requirement\")\n\terrNoRK                  = errors.New(\"device lacks resident key capabilities\")\n\terrNoUV                  = errors.New(\"device lacks PIN or user verification capabilities necessary to support passwordless\")\n\terrPasswordlessU2F       = errors.New(\"U2F devices cannot do passwordless\")\n)\n\n// TouchRequest abstracts *libfido2.TouchRequest for testing.\ntype TouchRequest interface {\n\tStatus(timeout time.Duration) (touched bool, err error)\n\tStop() error\n}\n\n// FIDODevice abstracts *libfido2.Device for testing.\ntype FIDODevice interface {\n\t// Info mirrors libfido2.Device.Info.\n\tInfo() (*libfido2.DeviceInfo, error)\n\n\t// IsFIDO2 mirrors libfido2.Device.IsFIDO2.","sourceCodeStart":49,"sourceCodeEnd":85,"githubUrl":"https://github.com/gravitational/teleport/blob/1283425b60ec5f60d509ba4c791183d452923ff7/lib/auth/webauthncli/fido2.go#L49-L85","documentation":"errNoPasswordless is a user-friendly device filter error: during a passwordless login/registration, the device is not usable because it either lacks user verification (PIN/biometric) or resident key capability for this site — i.e. it is not registered/capable of passwordless. It filters the device out so the flow can try another device or prompt accordingly.","triggerScenarios":"fido2.go:200 — passwordless=true and (!info.uvCapable() || !info.rk): the tapped device cannot do UV or resident keys while the ceremony requires passwordless.","commonSituations":"Using an older YubiKey (non-5 series) for passwordless; security key without a PIN set; user chose passwordless but only a non-passwordless MFA key is plugged in.","solutions":["Set a PIN on the security key (yubikey-manager: ykman fido access change-pin) to enable user verification.","Use a FIDO2 device with resident key support (YubiKey 5+ / other CTAP2.1 keys) for passwordless.","Register a passwordless-capable device: tsh mfa add --type=webauthn on hardware that supports passkeys.","Fall back to normal MFA (tap + password) instead of passwordless."],"exampleFix":"// before\nykman fido info  // reveals rk=false on old keys\n// after: set PIN and use a resident-key-capable key\nykman fido access change-pin\ntsh mfa add --type=webauthn","handlingStrategy":"validation","validationCode":"// verify device capabilities before passwordless\n// ykman fido info  -> resident key + UV supported?","typeGuard":null,"tryCatchPattern":"err := tryPasswordlessLogin(ctx)\nif err != nil && strings.Contains(err.Error(), \"not registered for passwordless\") {\n\treturn normalMFALogin(ctx) // fall back to tap+password\n}","preventionTips":["Set a FIDO2 PIN on keys used for passwordless.","Procure YubiKey 5+ / CTAP2.1 devices for passwordless fleets.","Detect key capabilities (ykman) before enabling passwordless policy.","Provide a non-passwordless MFA fallback path."],"tags":["fido2","passwordless","yubikey","webauthn"],"backgroundTag":"authenticator-passwordless-incapable","analyzedSha":"1283425b60ec5f60d509ba4c791183d452923ff7","analyzedAt":"2026-09-02T04:06:41.601Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}