When using WebAuthn on e.g. a Mac or an iPhone, the passkey is stored on that device. When trying to login on a Windows PC, the plugin requires a physical key (only). I cannot use my iPhone or Mac to authenticate.
Please enable functionality to use a "passkey from a nearby device", which is supposed to display a QR-code and would let me use my iPhone as a key.
The docs state there's an OAuth dependency: "WebAuthn requires OATHAuth and GMP php extensions to be installed as a prerequisite." In real life there is no dependency between WebAuthn and OAuth.
Why is there an artificial dependency being introduced here?
The OATHAuth extension provides all the plumbing to let you use OAuth and similar features with MediaWiki. It's not "artificial". Perhaps some of this code should live inside MediaWiki itself; patches welcome!
While this extension works fine on my MediaWiki version 1.34 installation and the main Vector skin it does not work with MinervaNeue skin as mobile user interface.
Actually the WebAuthn opens a modal window on the Vector skin where it asks you to enable your device, that doesn't appear on the MinervaNeue at all.
If I switch to Vector skin on my smartphone it allows me to use WebAuthn, switching back after successful login to MinervaNeue works as well.
I tested it on a desktop with Firefox 68.7 too. Same behavior. With Vector skin you get a modal window asking to use your device for authentication, but that does not appear with MinervaNeue.
I have not found a place to report a bug so I try to do it here.
I have downloaded mediawiki 1.35.0 and then WebAuthn as well and enabled it. First I set up OATHAuth for authentication which worked well. Then I have wanted to switch to my Yubikey (why not support both methods?), enabled it, it said okay, then I could not login the next time with "verification failed".
This has happened on an Ubunut 20.04 LTS, php 7.4, GMP installed. The database is of an existing wiki, update.php was run.