WebAuthn passthrough support for FreeRDP plugin?

Questions Royal TS (for Windows)
1

I might be missing an obvious checkmark or option somewhere, but I will give it a try anyways.

Using the RoyalTS 26 beta 24, I can choose between “FreeRDP” and “Microsoft RDP ActiveX” based protocols. When using the Microsoft one, my WebAuthn passthrough works. (Confirm by using a hardware key (Yubikey) and load webauthn.io in the browser to check).

There is no specific checkbox for this in the redirect UI, it just seems to work. The native mstsc.exe has a specific checkbox for this.

When choosing the FreeRDP based plugin, this redirection is not working.

I know this has been an issue to get working on FreeRDP based implementations earlier, and the only RDP client on Linux i have this working on is “Thincast”. So there might be some inspiration to get from there on how to make this work though FreeRDP.

This feature missing causes some workflows to be a bit of an hassle with all the new security requirements popping up on different arenas. At this point it is not a hard requirement on my workflows, but i foresee it becoming more essential in a relative short time.

Using the Microsoft plugin is of course a valid option for my requirements, so this is not a dealbreaker as long as that plugin also stays supported.

-Hans-Olav-

2

Thanks for reporting this. FreeRDP now includes WebAuthn redirection support, but Royal TS wasn’t forwarding the setting to the FreeRDP plugin. We’ve prepared a change that exposes WebAuthn / Security Keys under Redirection → General for both renderers. This change is not released yet.

During testing, we found that the current FreeRDP implementation on Windows is not equivalent to Microsoft’s ActiveX implementation. FreeRDP uses libfido2 for authenticator operations, and its current integration has a compatibility gap with Windows Hello and system-managed authenticators.

This limitation is in the underlying FreeRDP/libfido2 integration. Royal TS cannot support this scenario through FreeRDP until that native authentication path supports it correctly. For now, please continue using the Microsoft RDP plugin for Windows Hello authentication.

You can also open an issue in the FreeRDP repository and ask about Windows Hello support through WebAuthn redirection.