WebAuthn: configurable RP ID to support multiple hostnames (e.g. internal + external URL)

[rafiwicht]

I have a some kind of wierd setup. I need to expose Authentik internally and externally using different domains. Proxy setup, login, everything works as expected. The only issue is, that the WebAuthn devices / passkeys only work on the hostname they were enrolled on. My users normally use the internal URL to enroll their devices, so externally they can only use TOTP.

As far as I can understand (I'm not an expert) Authentik derives the Relying Party ID from the request's hostname, so each hostname gets its own RP ID. To fix this issue, I need to possiblity to set the RP ID in the setup and validation stages.

I also looked a little bit into Related Origin Requests. Maybe that would solve it better.

Questions

• Is there already a supported way to do this that I've missed?
• What are your thoughts on that feature?