Entra ID 的硝基配置¶

Compatible Nitrokeys
✓ active	✓ active	⨯ inactive	⨯ inactive	⨯ inactive	⨯ inactive	⨯ inactive	⨯ inactive

Compatible Nitrokeys

The Nitrokey 3 and Nitrokey Passkey support provisioning credentials for Microsoft Entra for seamless employee on-boarding in enterprise scenarios.

设置 ¶

需要一个 Microsoft Entra 应用程序，才能通过编程方式注册用户凭据。在此，我们为您提供相应的配置指南，前提是您具备相应的权限。

Login to Entra Admin portal. Take a note of the primary domain which you will need later. Go to App Registrations on the left blade.
选择“新注册”。
创建一个新应用并设置名称。点击“注册”。
请在此处记下客户端 ID 和租户 ID。稍后您会用到它们。转到应用程序面板中的“API 权限”。
Click on Add a permission.
Select Microsoft Graph.
选择“应用权限”。
Search for UserAuthenticationMethod.ReadWrite.All and select it.
Search for User.ReadWrite.All and select it (Only if you want to be able to create users from pynitrokey). Click on the Add Permissions button.
请核对已授予的权限。
点击“授予管理员同意”，然后予以批准。
返回应用主页，然后从左侧面板中选择“证书和密钥”
点击“新建客户端密钥”
输入名称和有效期，然后点击“添加”
请记下客户端密钥（之后将无法查看该密钥）。
在左侧窗格中单击“身份验证方法”。
Select Passkey (FIDO2).
Click on the Configure tab.
Click on Default Passkey profile
取消勾选“强制验证”（仅当您使用的硝基未获得 FIDO Alliance 认证时。在撰写本文时，仅硝基 3A Mini 具备此项认证。）
Click Save.

You have taken note of the Tenant ID, Client ID, Client Secret and Primary Domain as a part of the process. Make a config.json file with the information. An example is shown below.

{
    "tenant": "49d2c4c8-9144-49ea-b5f3-fc11b848cd72",
    "client": "e9f25c9c-3870-4aa8-9659-a40f09de093e",
    "secret": "************************************",
    "domain": "Cryptane.onmicrosoft.com"
}

使用方法 ¶

You may use the pynitrokey utility to provision a Nitrokey for an user in your tenant.

nitropy fido2 provision-credential entra -c config.json <username> --create-user

Here the <username> could be the Email ID of the user (User principal in terms of Microsoft) or a part of it till before the @ sign. The --create-user flag directs the tool to create the user if it does not exist in the Entra Tenant.

$ nitropy fido2 provision-credential entra -c config.json aditya --create-user
Command line tool to interact with Nitrokey devices 0.12.3
Warning: It is recommended to execute nitropy with admin privileges to be able to access Nitrokey 3 and Nitrokey FIDO 2 devices.
Waiting 5 secs for Graph API to update
User aditya created on Entra
Enter PIN:
Touch your authenticator device now...
Entra credential for aditya pre-registered on NK3 A56F0 with Credential ID owBYLNXsrDZ104I2MyCtuxmXKAd0Um56t3Byx5VfMz-Vs1Azy1re4Rdf-foMsc7vAUw7lJgCoG1VSdl2mBoCUHWGpTH-YkjEJ4UC4YlIEdk1.

Verification ¶

用户可使用新分配的 Nitrokey 登录其 Microsoft 账户。请访问`，并参考“使用 Nitrokey 登录 Microsoft 的示例”<passwordless-microsoft.html#sample-login-to-microsoft-with-the-nitrokey-fido2>`__，了解如何使用这枚新分配的 Nitrokey 进行登录。

您可以按照以下步骤，在 Entra 管理门户中验证已配置的凭据。

在 Entra 管理中心左侧面板中，转到“用户”选项。
If the user was created with the --create-user flag you may be able to find the entry on the list. If it is a pre-existing user, it would also be there. Click on the user to which the credential was enrolled.
Click on Authentication methods on the user blade.
将显示包含硝基 UUID 前 5 个字符的已注册凭据。您可以点击三个点，然后点击“查看详情”，以查看该已注册凭据的详细信息。
将显示有关该凭证的更多信息。您可以对其进行验证。

Entra ID 的硝基配置¶

设置¶

使用方法¶

Verification¶

设置 ¶

使用方法 ¶

Verification ¶