What causes "U2F devices cannot do passwordless" in gravitational/teleport?

Replace the token with a FIDO2-capable security key (CTAP2, e.g. YubiKey 5 series).

U2F devices cannot do passwordless

Error message

U2F devices cannot do passwordless

What it means

errPasswordlessU2F is a user-friendly device filter error: the device is a legacy U2F (CTAP1) authenticator — info.fido2 false — and the ceremony requires features U2F cannot do (resident keys or user verification), so it is filtered out instead of failing mid-ceremony.

Source

Thrown at lib/auth/webauthncli/fido2.go:71

	fido2DeviceTimeout = 30 * time.Second

	// Operation retry interval.
	// Keep it less frequent than 5Hz / 0.2s.
	fido2RetryInterval = 500 * time.Millisecond

	// Timeout for touch.Status operations.
	// Keep it less frequent than 5Hz / 0.2s.
	fido2TouchMaxWait = 200 * time.Millisecond
)

// User-friendly device filter errors.
var (
	errHasExcludedCredential = errors.New("device already holds a registered credential")
	errNoPasswordless        = errors.New("device not registered for passwordless")
	errNoPlatform            = errors.New("device cannot fulfill platform attachment requirement")
	errNoRK                  = errors.New("device lacks resident key capabilities")
	errNoUV                  = errors.New("device lacks PIN or user verification capabilities necessary to support passwordless")
	errPasswordlessU2F       = errors.New("U2F devices cannot do passwordless")
)

// TouchRequest abstracts *libfido2.TouchRequest for testing.
type TouchRequest interface {
	Status(timeout time.Duration) (touched bool, err error)
	Stop() error
}

// FIDODevice abstracts *libfido2.Device for testing.
type FIDODevice interface {
	// Info mirrors libfido2.Device.Info.
	Info() (*libfido2.DeviceInfo, error)

	// IsFIDO2 mirrors libfido2.Device.IsFIDO2.
	IsFIDO2() (bool, error)

	// Cancel mirrors libfido2.Device.Cancel.
	Cancel() error

View on GitHub (pinned to 1283425b60)

Solutions

Replace the token with a FIDO2-capable security key (CTAP2, e.g. YubiKey 5 series).
Use the plain U2F/WebAuthn MFA flow (tap only, no passwordless/UV requirements).
Relax the ceremony requirements (no rrk/uv) if U2F devices must remain supported.

Example fix

// before: passwordless required, U2F-only fleet
// after: allow plain MFA or upgrade keys
$ tsh mfa add --type=webauthn  // with a FIDO2 key

Defensive patterns

Strategy: fallback

Validate before calling

// detect U2F-only devices before passwordless/UV flows
// ykman info / device info shows CTAP1 (U2F) only?

Try / catch

err := login(ctx)
if err != nil && strings.Contains(err.Error(), "U2F devices cannot do passwordless") {
	return legacyMFALogin(ctx) // plain U2F tap flow
}

Prevention

Inventory your fleet's security keys and identify U2F-only tokens.
Migrate to FIDO2 keys before enabling passwordless/UV policies.
Keep a plain-MFA login path available for legacy tokens.

When it happens

Trigger: fido2.go:198 (passwordless path: !info.fido2 && (uv || passwordless)) and fido2.go:517 (registration path: !info.fido2 && (rrk || uv)) — any U2F-only device (e.g. original YubiKey designed for U2F, YubiKey Neo) in an RK/UV-requiring flow.

Common situations: First-generation FIDO U2F security keys used where passwordless/MFA-with-UV is required; very old YubiKeys; company fleet of U2F-only tokens after a policy upgrade to passwordless.

Related errors

AI-assisted analysis of gravitational/teleport@1283425b60 (2026-09-02). Data as JSON: /api/errors/417097a44637b854. Report an issue: GitHub.