Actualize: Passkey Login

Actualize: Passkey Login adds WebAuthn-based passkey authentication to Shopware 6. Both storefront customers and Shopware Administration users can sign in without entering a password. The existing password login remains available as an alternative.

Account holders set up their own passkeys: after signing in, they register a passkey in their customer account or personal administration profile and confirm the operation with their password. Passkey sign-in is then available on the corresponding login page. Supported discoverable credentials allow users to sign in without entering a username first.

Customers and administration users can register, rename and remove their own passkeys. Authorised administrators can also revoke passkeys belonging to other users and customers, but cannot create passkeys on their behalf. Customer and administration credentials are strictly separated: a customer passkey cannot grant access to the Administration.

The extension also accommodates shops with multiple storefront domains. Each passkey is bound to the domain on which it was registered. This domain binding is a key component of WebAuthn’s phishing-resistant authentication.

KEY FEATURES AT A GLANCE

• Passwordless passkey login for storefront customers.
• Passkey authentication for Shopware Administration users.
• WebAuthn-based, phishing-resistant authentication.
• Usernameless sign-in with discoverable credentials.
• Register, rename and remove personal passkeys in the customer account or administration profile.
• Password confirmation when managing personal passkeys.
• Revocation of customer and administration passkeys by appropriately authorised administrators.
• Strict separation between customer and administration credentials.
• Domain-bound passkeys for shops with multiple storefront domains.
• Display of each passkey’s last successful use.
• Warnings for possibly cloned passkeys when supported authenticators report suspicious signature counters.
• Logging of administrator revocations and diagnostic events.
• Continued availability of password-based login.

Actualize: Passkey Login is suitable for merchants who want to offer customers and their administration team an additional passwordless sign-in method without removing the existing password login.

IMPORTANT NOTICE

According to the project documentation, the extension targets Shopware 6.7.x and requires PHP 8.4 or higher. Passkey functionality requires a covered HTTPS domain and a browser with WebAuthn support. On domains that are not covered, or in browsers without the required support, the standard password form remains available.

Administration users signed in through SSO cannot manage their own passkeys because these operations require password confirmation. Revoking other administration users’ passkeys is also restricted when signed in through SSO. If the Administration permits SSO login only, passkey login is unavailable as well.

Deployments with multiple application servers require shared storage for both the challenge cache and the locks enforcing single use. The default local filesystem configuration is not sufficient for clustered deployments.

Resetting a password does not remove existing passkeys. Suspicious passkeys must therefore be revoked separately if an account is compromised. Possible-clone detection only applies to authenticators with a suitable signature counter; synchronised passkeys without that counter are not flagged through this mechanism.

OPEN SOURCE AND LICENSE NOTICE

This plugin is based on the open-source project ActPasskey by Actualize and is distributed through our platform. Unless stated otherwise, this plugin is provided under the terms of the MIT License. The original copyright notice and the full license text must be retained unchanged in the plugin package when redistributed.

Copyright (c) Actualize

The software is provided “as is”, without warranty of any kind, to the extent permitted by applicable law. The terms of the MIT License apply. The full license text is included in the plugin package and is available at: https://github.com/actualizer/ActPasskey/blob/main/LICENSE.