device lacks PIN or user verification capabilities necessary

Error message

device lacks PIN or user verification capabilities necessary to support passwordless

What it means

errNoUV is a user-friendly device filter error: the ceremony requires user verification (PIN or biometric, uv=true) but the device cannot perform UV (info.uvCapable() false). Without filtering, the request would later fail with libfido2.ErrUnsupportedOption, so the device is excluded up front.

Source

Thrown at lib/auth/webauthncli/fido2.go:70

	// Functions fail with FIDO_ERR_RX on timeout.
	fido2DeviceTimeout = 30 * time.Second

	// Operation retry interval.
	// Keep it less frequent than 5Hz / 0.2s.
	fido2RetryInterval = 500 * time.Millisecond

	// Timeout for touch.Status operations.
	// Keep it less frequent than 5Hz / 0.2s.
	fido2TouchMaxWait = 200 * time.Millisecond
)

// User-friendly device filter errors.
var (
	errHasExcludedCredential = errors.New("device already holds a registered credential")
	errNoPasswordless        = errors.New("device not registered for passwordless")
	errNoPlatform            = errors.New("device cannot fulfill platform attachment requirement")
	errNoRK                  = errors.New("device lacks resident key capabilities")
	errNoUV                  = errors.New("device lacks PIN or user verification capabilities necessary to support passwordless")
	errPasswordlessU2F       = errors.New("U2F devices cannot do passwordless")
)

// TouchRequest abstracts *libfido2.TouchRequest for testing.
type TouchRequest interface {
	Status(timeout time.Duration) (touched bool, err error)
	Stop() error
}

// FIDODevice abstracts *libfido2.Device for testing.
type FIDODevice interface {
	// Info mirrors libfido2.Device.Info.
	Info() (*libfido2.DeviceInfo, error)

	// IsFIDO2 mirrors libfido2.Device.IsFIDO2.
	IsFIDO2() (bool, error)

	// Cancel mirrors libfido2.Device.Cancel.

View on GitHub (pinned to 1283425b60)

Solutions

Set a FIDO2 PIN on the device: ykman fido access change-pin (then retry).
Use a device with built-in user verification (biometric key or platform authenticator).
Downgrade the requirement to userVerification="preferred"/"discouraged" in the WebAuthn config if UV is not mandatory.

Example fix

// before
"authenticatorSelection": {"userVerification": "required"} // with PIN-less key
// after: set a PIN, or relax:
"authenticatorSelection": {"userVerification": "preferred"}

Defensive patterns

Strategy: validation

Validate before calling

// ensure a FIDO2 PIN is set before UV-required flows
// ykman fido access change-pin

Try / catch

err := login(ctx)
if err != nil && strings.Contains(err.Error(), "PIN or user verification") {
	// prompt user to set a PIN or use a different device
}

Prevention

Provision PINs on all security keys during onboarding.
Verify uvCapable devices before enabling userVerification=required policies.
Allow userVerification=preferred when UV is not strictly mandated.

When it happens

Trigger: fido2.go:205 (passwordless/UV path) and fido2.go:523 (uv && !info.uvCapable()) — device has no PIN set or no UV support while userVerification="required".

Common situations: Security key without a configured PIN; FIDO devices with no biometric; policy requires UV but key is factory-default.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/0662df595f067f32. Report an issue: GitHub.