--- source_url: "https://github.com/ory/kratos/discussions/2702" title: "Webauthn and AAL2 · ory kratos · Discussion #2702 · GitHub" mirrored_at: 2026-08-05T01:00:59.176Z host: github.com cited_in_42a: true mirror_canonical: "https://index.42a.ai/github.com/ory/kratos/discussions/2702" --- > **Original source:** https://github.com/ory/kratos/discussions/2702 At the moment, Webauthn can either be enabled as a second factor, or as a first factor instead of a password. In the latter case, Kratos will return aal1 when the user authenticates with a Webauthn device only. However, there are Webauthn devices with built-in biometric scanners. I believe these are called user-verifying platform authenticators in the specification. The RP can determine the user verification status by reading the UV flag in the authenticator data. So if I understand it correctly, Kratos should return aal2 if that UV flag is set to 1. So am I understanding this correctly? Are there any plans to change the implementation like that? The background is that we want to require aal2 for certain users, but a FIDO authenticator with a built-in biometrical challenge would already fulfill this requirement for us. - [https://w3c.github.io/webauthn/#user-verification](https://w3c.github.io/webauthn/#user-verification) - [https://w3c.github.io/webauthn/#authdata-flags-uv](https://w3c.github.io/webauthn/#authdata-flags-uv) - [https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases.pdf](https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-Cases.pdf) Hey [@woylie](https://github.com/woylie), sorry for the late response! > So am I understanding this correctly? IMO this sounds right, I have not tested this UV flag, but 2FA with yubikey works for me. > The RP can determine the user verification status by reading the UV flag in the authenticator data This is where I am not clear how exactly to read these flags, but should be available at some step of the flow in Kratos. You want to require aal2 for certain user(groups?) and you want to do 2 auth steps in one step with a FIDO authenticator for these users. So login with the FIDO key (password saved on the key), then check the flag (fingerprint? activate/press key?) and count that as second factor if it returns 1. Am I… [View full answer](#discussioncomment-3851485) Hey [@woylie](https://github.com/woylie), sorry for the late response! > So am I understanding this correctly? IMO this sounds right, I have not tested this UV flag, but 2FA with yubikey works for me. > The RP can determine the user verification status by reading the UV flag in the authenticator data This is where I am not clear how exactly to read these flags, but should be available at some step of the flow in Kratos. You want to require aal2 for certain user(groups?) and you want to do 2 auth steps in one step with a FIDO authenticator for these users. So login with the FIDO key (password saved on the key), then check the flag (fingerprint? activate/press key?) and count that as second factor if it returns 1. Am I getting it right? Is the second factor an automatic step or requires user input? It says in the document > for example, through a touch plus pin code, password entry, or biometric recognition Currently it is not possible to enable WebAuthn as first and second factor, but [a feature request](https://github.com/ory/kratos/issues/new?assignees=&labels=feat&template=FEATURE-REQUEST.yml) would help us to keep track of it and eventually implement. I did not find a similar request at the moment from a quick search, so feel free to create one if this is something you would like to see in Kratos 🙏 2 replies > and you want to do 2 auth steps in one step with a FIDO authenticator for these users. So login with the FIDO key (password saved on the key), then check the flag (fingerprint? activate/press key?) and count that as second factor if it returns 1. Am I getting it right? Is the second factor an automatic step or requires user input? Yes, correct. The Yubikey Bio requires you to authenticate with a built-in fingerprint scanner. The iPhone can be used as a Webauthn device, and it will require authentication via face ID. A macBook uses the built-in fingerprint scanner. You can ignore the part about requiring AAL2 for certain user types, we implemented that and it has nothing to do with the feature request. I opened a feature request here: [#2794](https://github.com/ory/kratos/issues/2794) Thanks for opening the request Mathias! Really would like to see WebAuthn as the go-to method and this feature would help in that direction. edit: marking this as answered for now, but feel free to add to this discussion here (or in the linked issue) Answer selected by [vinckr](https://github.com/vinckr)