Thales friendly name extension

The Thales friendly name FIDO2 extension allows users or applications to associate a user-friendly name with a credential.

The friendly name can help users to distinguish their different credentials for a given application, even if they are all associated with a single account. For example, a user might have:

• A mobile device-bound credential
• A security key
• A computer-created credential synchronized by their platform provider The user can name each of these credentials with, for example, the device brand and model. In a self-service portal, the relying-party can list the credentials by their names, and can offer users the ability to rename or delete them.

Setting the credential's friendly name

The friendly name can be set when the credential is created. The application can either set the value based on the knowledge it has of the authenticator (such as iPhone 14), or ask the user to provide a meaningful name.

Using web APIs

The application can indicate in the attestation option request that it intends to set the friendly name for this credential, by adding the thalesgroup_ext_v1 to true in the request body:

{
  ...
  "extensions": {
    "thalesgroup_ext_v1": true
  },
  ...
}

Upon successful credential creation by the client-side authenticator, the application can set the chosen friendly name in the attestation result request body:

{
  ...
  "clientExtensionResults": {
    "thalesgroup_ext_v1": {
      "authenticatorDescription": {
        "friendlyName": "My PC passkey"
      }
    }
  },
  ...
}

Updating the friendly name

It is possible to modify the friendly name of a specific credential using the update authenticator credential admin operation, setting the friendlyName field of the request body.

Displaying friendly names

The main purpose of the friendly name is for credential management. The list authenticator credentials admin operation therefore returns the friendly names or each user's credentials in the friendlyName field of its response body.