Applicable Products
QuTS hero h6.0.0 and later
FIDO2 Server
Required Environment
To use Passkey (FIDO2) authentication on the QNAP NAS, you need to meet the following requirements:
- Connection method: You must connect to the NAS using
HTTPS + Domain Name. An HTTPS connection with a trusted certificate is required.IP addresses and SmartURLs are not supported. - Required component: Install the FIDO2 Server in the App Center. Note that FIDO2 Server has no user interface and will redirect you to the login settings after installation.
- Authenticator support:
- On-device authenticators: Windows Hello (Face, Fingerprint, PIN), Apple Touch ID, PIN
- External authenticators: FIDO-certified USB security keys, mobile or tablet QR code scanning
Procedure
Register a Passkey device
- Ensure the following:
- FIDO2 Server is installed in the App Center.
- You are accessing the NAS is via HTTPS and Domain Name.
- On the NAS, go to Desktop > Login & Security > 2-step Verification & Passwordless Login.
- Click Add Passkey device.
- Follow the on-screen instructions to complete the setup. The steps may differ depending on the device and browser used.
- Follow the instructions for the default authentication method on your device (for example, fingerprint scan or PIN).
- Once verified, the device is successfully registered and listed under Passkey devices.
Log in using a Passkey
- On the NAS login screen, select Login with Passkey.
- Follow the on-screen instructions to use the hardware key. The steps may differ depending on the hardware model and browser used.
- Follow the instructions for the default authentication method on your device (for example, fingerprint scan or PIN).
- Upon successful verification, you will be logged into the NAS desktop.
Supported Security Key Models
Support for security keys varies by operating systems and browsers. Refer to this website for more details. Make sure to access it through web browsers and platforms that support WebAuthn.
We recommend the following security keys, which we have tested:
| Brand | Model Name |
|---|
| THETIS | Thetis FIDO2 Security Key |
| Yubico | YubiKey 5 NFC |
| Yubico | YubiKey 5C NFC |
| IDENTIV | uTrust FIDO2 NFC+ Security Key |
| ONLYKEY | OnlyKey (FIDO2 Edition) |
| SoloKeys | Solo V2 |
Common Issues and Limitations
Browser shows "Not Secure" warning after Domain + SSL setup
Even after configuring the domain and SSL, some browsers may still show a "Not Secure" warning. Try using incognito mode or open a new tab and then reconnect via https://domain name
For details, see this FAQ.
SmartURL (for example, qlink.to) is not supported
SmartURLs may redirect to different URLs over time. If a Passkey is registered before the change, it will no longer work. Therefore, SmartURLs are not supported.
For example: https://qlink.to/alicetest is not supported.
However, myQNAPcloud DDNS is supported. For example: alicetest.myqnapcloud.com
High Availability architecture support
When using HA architecture, ensure that you connect via Domain Name and map the domain to CIP to enable passkey registration and login.
Further Reading
How do I install a Let’s Encrypt SSL certificate for my custom DDNS domain in QTS?
How to purchase and install a myQNAPcloud SSL certificate?
QNAP secure login and authentication
QNAP Authenticator User Guide
How to use and set up your Network & Virtual switch?
适用产品
QuTS hero h6.0.0 及更高版本
FIDO2 服务器
所需环境
要在 QNAP NAS 上使用 Passkey (FIDO2) 身份验证，您需要满足以下要求：
- 连接方式：您必须使用
HTTPS + Domain Name连接到 NAS。需要使用受信任证书的 HTTPS 连接。不支持 IP 地址和 SmartURL。 - 所需组件：在 App Center 中安装FIDO2 服务器。请注意，FIDO2 服务器没有用户界面，安装后会将您重定向到登录设置。
- 认证器支持：
- 设备内认证器：Windows Hello（面部识别、指纹、PIN），Apple Touch ID，PIN
- 外部认证器：FIDO 认证的 USB 安全密钥，移动设备或平板电脑二维码扫描
步骤
注册 Passkey 设备
- 确保以下事项：
- FIDO2 服务器已安装在 App Center 中。
- 您通过 HTTPS 和域名访问 NAS。
- 在 NAS 上，前往桌面 > 登录与安全 > 两步验证 & 无密码登录。
- 点击添加 Passkey 设备。
- 按照屏幕上的说明完成设置。步骤可能因使用的设备和浏览器而异。
- 按照设备上的默认认证方法说明进行操作（例如，指纹扫描或 PIN）。
- 验证成功后，设备将成功注册并列在 Passkey 设备下。
使用 Passkey 登录
- 在 NAS 登录屏幕上，选择使用 Passkey 登录。
- 按照屏幕上的说明使用硬件密钥。步骤可能因硬件型号和浏览器而异。
- 按照设备上的默认认证方法说明进行操作（例如，指纹扫描或 PIN）。
- 验证成功后，您将登录到 NAS 桌面。
支持的安全密钥型号
安全密钥的支持因操作系统和浏览器而异。请参考本网站获取更多详细信息。确保通过支持 WebAuthn 的网络浏览器和平台访问。
我们推荐以下经过测试的安全密钥：
| 品牌 | 型号名称 |
|---|
| THETIS | Thetis FIDO2 安全密钥 |
| Yubico | YubiKey 5 NFC |
| Yubico | YubiKey 5C NFC |
| IDENTIV | uTrust FIDO2 NFC+ 安全密钥 |
| ONLYKEY | OnlyKey (FIDO2 版) |
| SoloKeys | Solo V2 |
常见问题和限制
域名和 SSL 设置后浏览器显示“非安全”警告
即使配置了域名和 SSL，某些浏览器仍可能显示“非安全”警告。尝试使用无痕模式或打开一个 新标签页，然后通过https://domain name重新连接
详情请参阅此常见问题解答。
不支持 SmartURL（例如，qlink.to）
SmartURL 可能会随着时间重定向到不同的 URL。如果在更改之前注册了 Passkey，则将不再有效。因此，不支持 SmartURL。
例如：https://qlink.to/alicetest不支持。
然而，myQNAPcloud DDNS是支持的。例如：alicetest.myqnapcloud.com
高可用性架构支持
使用 HA 架构时，请确保通过域名连接，并将域名映射到CIP以启用 Passkey 注册和登录。
进一步阅读
如何在 QTS 中为自定义 DDNS 域名安装 Let’s Encrypt SSL 证书？
如何购买和安装 myQNAPcloud SSL 证书？
QNAP 安全登录和认证
QNAP Authenticator 用户指南
如何使用和设置您的网络和虚拟交换机？
