FIDO2 Security Keys
Using a FIDO2 Security Key with RBI
Overview
Keeper's Remote Browser Isolation (RBI) now supports hardware security key passthrough, allowing users to authenticate with FIDO2-compatible devices (such as a YubiKey) while browsing through an RBI session. This means users who are required to authenticate with a hardware key on enterprise sites like Microsoft Azure can do so seamlessly without leaving the isolated browsing environment.
How it Works
When a user accesses a website through an RBI session that requires hardware key authentication, Keeper relays the WebAuthn request from the remote browser back to the user's local browser. The user's physical hardware key is detected locally, and the authentication is completed as if they were browsing directly — keeping the session fully isolated while preserving the native authentication workflow.
Requirements
Browser — This feature is currently supported on Google Chrome only. Firefox, Safari, and Brave are not supported at this time.
Keeper components:
Keeper Vault 18.6.0 or later
An updated Keeper Gateway
Operating System Setup — Before hardware key passthrough will work in an RBI session, your machine must be configured to allow it.
macOS: Open Terminal and run the following command, replacing the URL with the address you use to access the Keeper Vault, NOT the URL for the site you access via RBI:
defaults write com.google.Chrome WebAuthenticationRemoteDesktopAllowedOrigins -array "https://your-vault-url.com"Windows: Open a terminal with administrator privileges and run the following command, replacing the URL with the address you use to access the Keeper Vault, NOT the URL for the site you access via RBI:
reg add "HKLM\SOFTWARE\Policies\Google\Chrome\WebAuthenticationRemoteDesktopAllowedOrigins" /v 1 /t REG_SZ /d "https://your-vault-url.com" /fThis registry change requires administrator privileges. Contact your IT administrator if needed.
Troubleshooting
Hardware key is not detected
Confirm you are using Google Chrome as your browser
Verify the configuration uses the correct Vault URL
Confirm the hardware key works outside of the RBI session by testing it directly in the Keeper Vault
PIN prompt does not appear
This is typically resolved by a full system reboot
Ensure the registry or preference setting is applied correctly for your environment
Supported Environments
macOS + Chrome
✅ Yes
Windows + Chrome
✅ Yes
Firefox
❌ Not supported
Safari
❌ Not supported
Brave
❌ Not supported
Last updated