Passkey Metadata
What this screen is for
This screen holds the FIDO Alliance metadata (MDS3) that tells which passkeys are attested by their maker, hardware-backed and bound to one device. It is reached from Access & Identity → Passkey metadata. The metadata is the only source of that trust: this deployment never downloads it, and no passkey check makes an outbound request, so an air-gapped installation works the same way.
You need it only when a tenant requires an attested, hardware-backed or device-bound passkey. A passkey reports by itself whether it can be copied to other devices, so being bound to one device counts only when its maker's attestation is verified too. Without the metadata, every passkey registers with none of these three properties, and a tenant that requires one of them cannot register one.
What must exist first
- The platform context.
- The permission to read platform configuration, to see what is loaded; uploading needs the permission to write it, held by the built-in platform administrator.
- The current metadata file, downloaded on a connected workstation from
https://mds3.fidoalliance.org/and moved to where you run the console.
Decisions you make here
Reading what is loaded
The screen shows the loaded file's Serial number, its Next update date, and who uploaded it and when; never the file itself. When the next update date has passed, the screen says so: the file is no longer used until a current one is uploaded, exactly as if none were loaded.
Uploading a new file
Choose the Metadata file exactly as downloaded and press Upload. The platform admits it only when its signature leads to the FIDO Alliance root this deployment trusts and is made by the FIDO Alliance's own signing certificate (mds.fidoalliance.org), its next update date has not passed, and it is not older than the loaded one. A file over 32 MiB, one that is not FIDO metadata, one whose signature does not verify, an expired one or an older one is refused with the reason, and the loaded file stays in force. Every upload, admitted or refused, is written to the audit trail.
The FIDO Alliance publishes a new file about once a month. Upload it before the loaded file's next update date: a tenant that requires an attested, hardware-backed or device-bound passkey cannot register one while no current file is loaded. Passkeys already registered keep the properties recorded when they were registered.
How it relates to other screens
A tenant decides whether its members need an attested, hardware-backed or device-bound passkey on its own settings screen, and each person sees what their passkeys establish on their Security page:
The rest of the sign-in configuration is the group this screen sits in: