nathanmcnulty/Passkey Login

Reusable GitHub Action to obtain an ESTS authentication cookie from an Entra passkey, preferring Azure Key Vault-backed signing and falling back to a local private key.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Stale
License: None

Inputs

name	description	required	default
credential-id	FIDO2 CredentialId (base64url or UUID)	yes	—
private-key	Local private key in PEM format or base64 encoded. Prefer Azure Key Vault instead.	no	—
user-handle	FIDO2 UserHandle (base64url)	yes	—
user-principal-name	User principal name (UPN) to authenticate (e.g. user@domain.com)	yes	—
key-vault-name	Azure Key Vault name holding the signing key for the passkey.	no	—
key-vault-key-name	Azure Key Vault key name used to sign the passkey assertion.	no	—
key-vault-access-token	Pre-obtained Key Vault access token. Usually not needed when azure/login has already run.	no	—
key-vault-client-id	Fallback service principal client ID for Key Vault access when not using azure/login.	no	—
key-vault-client-secret	Fallback service principal client secret for Key Vault access when not using azure/login.	no	—
key-vault-tenant-id	Tenant ID for Azure CLI token scoping or service principal fallback.	no	—
auth-url	Optional override for the Entra authorize URL.	no	—
proxy	Optional proxy URL for outbound requests.	no	—
export-auth-cookie	When true, masks and exports the authenticated ESTS cookie as an action output for later steps. Enabled by default because this action exists to obtain that cookie.	no	true

Outputs

name	description
authenticated	True when the script verified an authenticated ESTS cookie.
cookie-name	The ESTS cookie name returned by Entra when authentication succeeds.
user-principal-name	The authenticated user principal name.
signature-method	The signature method used for the FIDO assertion.
key-vault-name	The Key Vault used for signing, when applicable.
auth-cookie	The masked ESTS cookie value unless export-auth-cookie is set to false.