Configuring a Security Key

Constraints

• Security keys added to IAM users can only be used for login protection.
• An IAM user can have a maximum of eight security keys added.
• Security keys can only be added to Huawei Cloud accounts and IAM users. HUAWEI IDs do not support security keys. For more information, see How Do I Know Whether I Am Logged In with a HUAWEI ID or Huawei Cloud Account?

Adding a Security Key

1. Log in to the IAM console as the administrator.
2. Click a username to go to the user details page.
3. Click the Security Settings tab and find Multi-factor Authentication (MFA).
4. Click Add MFA Device.
5. Enter an MFA device name. Only letters, digits, hyphens (-), and underscores (_) are allowed.
6. Select an MFA device. Select Security key for Device Type.
7. Click Next.
8. Select an authentication method for Windows Hello, such as PIN, face, or fingerprint.
   Figure 1 Setting up Windows Hello
   
   

   If your Windows device does not support enabling facial recognition and fingerprint, options such as Face and Fingerprint will not appear. FIDO2 will show you the options according to the authentication types supported by your device.

9. Enter the PIN (or recognize the face or fingerprint). After the system authentication is successful, a dialog box is displayed, indicating that the binding is successful. Click OK. The security key will be displayed in the MFA device list.
   Figure 2 MFA device added
   

10. To set up a FIDO2 security key, select Use another device in the dialog box and plug the security key into the USB port of your computer.
    Figure 3 Using another device
    

11. In the displayed dialog box, select Security key and click Next.
    Figure 4 Setting the security key
    

12. Click OK to confirm the settings.
    Figure 5 Confirming the settings
    

13. Click OK to install the security key.
    Figure 6 Installing the security key
    

14. Enter the PIN of the security key and click OK.
    Figure 7 Entering the PIN
    

15. Touch the security key.
    Figure 8 Touching the security key
    

16. After the verification is successful, a dialog box is displayed, indicating that the MFA device is added. Click OK. The security key will be displayed in the MFA device list.
    Figure 9 MFA device added
    

Unbinding a Security Key

1. Log in to the IAM console as the administrator.
2. In the user list, click a username or click Security Settings in the Operation column to access the user details page.
3. Click the Security Settings tab.
4. Click Unbind in the Operation column of the target security key.
5. In the displayed dialog box, enter YES in the text box.
   Figure 10 Confirming unbinding
   

6. Click OK.