MDS Portal User Guide for Vendor Users

This guide is for Vendor Users who are using the MDS Portal. It provides instructions on account management as well as metadata statement management.

Refer to the FIDO Metadata Service page for general information about the Metadata Service. If your organization has not yet signed up for the MDS Portal, the person designated as the Vendor Admin (MDS Portal account admin) should visit the MDS Portal sign-in page to register an account.

User Management

Only Vendor Admins can access the Users screen. Vendor Users do not have this privilege. Vendor Users can only view their own account information.

User Registration

MDS Portal users can be added through self-registration or via invitation. The following table outlines when each method can be used.

Registration Method	Vendor Admin	Vendor User
Self-registration	Only for the first user of this Vendor.	All users after the first self-register only as Vendor Users.
Registration via invitation	Only Vendor Admin can invite another Vendor Admin.	Only Vendor Admin can invite another Vendor User.

Register by Invitation

If your Vendor Admin has already registered for an MDS Portal account, they can invite you to create an account as a Vendor User. If you have received an invitation email, follow the instructions included in the email to set up your account.

Self Registration

1. Visit the MDS Portal landing page (https://mymds.fidoalliance.org/).
2. Select Register.
3. On the following screen, agree to the terms and conditions by selecting Agree & Continue.
4. Use the form to enter your Company Info and Account Information.

5. Select Register.
6. Check your email for confirmation and follow the included instructions.

Dashboard Overview

The MDS Portal Dashboard is the landing page for all users when they sign in to the MDS Portal. The dashboard provides access to all features of the MDS Portal and displays notifications for any outstanding items that require attention.

The following lists describe the features available on the dashboard.

• Dashboard – Access your account information
• Metadata Management – View your metadata statement files and add new ones
• Security Issues – Use this form to notify the FIDO Alliance of any security issues pertaining to your products
• Account Settings – View and edit your personal information and security settings, such as an email address and password.
• Logout – Select to sign out of your MDS account.

Notifications

The notifications section of your dashboard displays any outstanding items that require your attention. You can select each item to view more details and take action as needed.

• Metadata Awaiting Submission – Lists any outstanding metadata statements that have been submitted
• Metadata Approval Requests – Lists requests that are awaiting approval
• Metadata Rejection Requests – Lists metadata statement requests that have been rejected
• Metadata – Submit metadata statements for authenticators

Authenticator Certification and Validation

If you would like to obtain FIDO certification for your authenticator, start by contacting certification@fidoalliance.org.

• If you already have a FIDO Certified authenticator, start with the Request Certification Validation section.
• If you do not have a certified authenticator and do not plan to certify your authenticator, you can skip to the section on metadata management. FIDO Certification is an optional service and is not required for listing your metadata statement. However, certification does offer multiple benefits for the vendor.

Certification pertaining to MDS only relates to authenticator certification. For information about other types of FIDO Certification programs, refer to FIDO Certification.

Request Certification Validation

Once certification is issued, you will receive acknowledgment of the level of authenticator. You should add new metadata statements. Once your statements are added and published, you can request certification validation. An MDS Admin will check to verify certification, add the level, and then update the report to certified if needed.

As of MDS version 3.1.1, certification can be listed for:

• L1-L3+ authenticators
• Federal Information Processing Standards (FIPS)

After certification is validated, metadata statement records cannot be updated by vendors. If you submit a metadata statement prior to completion of certification, once certification is complete, contact certification@fidoalliance.org to request changes or to request updated certification to enforce policies.

To request certification validation:

1. Navigate to the Metadata Management screen.
2. Select the desired record.
3. Select Validate Certification.
4. Select Status Report or Biometric Status Report.
5. Select the certification level.
6. Select Continue to submit or Cancel if you do not want to proceed.

The MDS admins will receive your request and follow up with you as needed.

If your metadata statement was already published in the MDS Portal, once certification is complete, you must contact support@mymds.fidoalliance.org to request changes to your metadata statement or to request updated certification to enforce policies.

Once certification is issued, navigate to the MDS Portal landing page to add new metadata statements.

Metadata Management

The Metadata Management screen is available to Vendor Admins and Vendor Users. This screen displays a list of all published and unpublished metadata statements that have been added to the MDS Portal.

The following table lists the available statuses for metadata statements and the actions that can be taken for each status.

	Possible Statuses
	New	Requested	Approved	Published	Rejected
Available Actions
Add new	X	X	X	X	X
Publish	X				
Cancel publish request		X			
Edit	X				X
Delete	X	X			
Update			X	X	
Show reason					X

Metadata Statements

You can add metadata statements for your authenticators to the MDS Portal. Once added, you can edit, delete, and publish your metadata statements as needed. Published metadata statements are included in the MDS BLOB and are available for relying parties to use for authenticator verification and (with the exception of an update to metadata statement details) cannot be edited or deleted by a vendor.

View Sample Metadata Statements

You can also view and edit the sample metadata statements in the MDS Portal.

To view a sample metadata statement:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select Add New.
3. Select one of the three samples: Sample FIDO2 Data, Sample UAF Data, or Sample U2F Data. The metadata statement populates in the preview window.

You can edit the metadata statement in this window or copy and paste it into your code editor. To clear all text from the preview window, select Reset.

Add New Metadata Statements

There are two ways to add your metadata statement to the MDS Portal. You can either upload a .txt or .json file or copy and paste the code from your file.

To add a new metadata statement by uploading a file:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select Add New.
3. Select Sample FIDO2, Sample UAF, or Sample U2F to view the required format for each file type.
4. Select Choose File to upload a .txt or .json file.
5. Use your OS to select and upload the file you want to use. The metadata statement from the file will populate in the preview window.
6. Select Analyze.
7. You will receive notification that the validation either passed or failed. If the validation fails, check your file for any issues.
8. When validation succeeds, select Save.
9. You should see a Success notification and the metadata statement displays within your list.

The metadata statement now appears in the Metadata Management list with a status of New. While in this status, the statement can be edited or deleted.

To add a new metadata statement by copying and pasting:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select Add New.
3. Select Sample FIDO2, Sample UAF, or Sample U2F to view the proper code format for each file type.
4. If needed, select Reset to remove all code from the text entry box.

5. Paste your code into the text box.
6. Select Analyze.
7. You will receive notification that the validation either passed or failed. If the validation fails, check your file for any issues.
8. When validation succeeds, select Save.
9. You should see a Success notification and the metadata statement displays within your list.

The metadata statement now appears in the Metadata Management list with a status of New. While in this status, the statement can be edited or deleted.

Edit Metadata Statements

You can edit metadata statements that have a status of New or Rejected. With the exception of updating the attestation root certificate, the code for published metadata statements cannot be edited. You can update metadata statement details for published metadata statements.

To edit a metadata statement:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the metadata statement that you want to edit.
3. Select Edit.
4. Edit the statement in the pop-up window.
5. Set the Attestation Root Certificates by entering data in the Attestation Root Certificates field.

6. Select the checkbox next to the text I understand that change of Authenticator Version, and addition of the new Attestation Root Certificates can NOT be reversed.
7. Select Update.
8. You will receive notification that the validation either passed or failed. If the validation fails, check your file for any issues.
9. When validation succeeds, select Save.
10. You should see a Success notification.

The metadata statement now appears in the Metadata Management list with a status of New. While in this status, the statement can be edited or deleted.

Update Metadata Statement Details

You can update metadata statement details to edit certain details for published metadata statements. The fields you can update include friendly names, description, alternative descriptions, authenticator version, icon, logo, and attestation root certificates.

To update a metadata statement:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the metadata statement that you want to edit.
3. Select Update.
4. Enter new data in the fields you want to update.

5. Read the notification that change of authenticator version, and addition of the new attestation root certificates can NOT be reversed and select the checkbox.
6. Select Update or select Cancel if you do not want to proceed.

Update an Attestation Root Certificate

With the exception of updating the attestation root certificate, the code for published metadata statements cannot be edited. If your root certificate expires or is replaced, you will need to enter the new root certificate in the metadata statement.

To update an attestation root certificate:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the metadata statement that you want to edit.
3. Select Update.
4. Enter the new attestation root certificate in the Attestation Root Certificates field.

5. Enter any other new data in the fields you want to update.
6. Read the notification that change of authenticator version, and addition of the new attestation root certificates can NOT be reversed and select the checkbox.
7. Select Update or Cancel if you do not want to proceed..

Search Metadata Statements

You can search metadata statements using data from the following fields:

• ID
• Protocol
• Name
• Version
• Saved by

To search your metadata statements:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the Search box.
3. Enter the text you want to use to search.

Results start to populate immediately as characters are entered.

View Metadata Statement Details

You can view the metadata statement, logos, and status reports for an authenticator.

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the statement you want to view.
3. Select Close when you are done.

Refresh the Metadata Management screen

To update your view to include any recent changes you can refresh the Metadata Management screen.

On the Metadata Management screen, select Refresh to update the records.

Delete Metadata Statements

You can only delete metadata statements that have a status of New.

To delete a metadata statement:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the metadata statement that you want to delete.
3. Select Delete.

4. In the pop-up window, select Delete to remove the statement or Cancel if you do not want to proceed.

Publish Metadata Statements

Once your metadata statement is approved, you can request publication them so that it is available in the MDS BLOB.

To publish a metadata statement:

1. From your MDS dashboard, select the Metadata Management tab.
2. If you have not done so already, update your metadata statement fields Attestation Root Certificates and for U2F devices update the Attestation Certificate Key Identifiers.
3. Select the statement you want to publish from the list.
4. Select Publish.
5. Read the Publish Metadata Statement and select Confirm to continue or Cancel if you do not wish to proceed.
6. You will receive a Success notification that states that publication of the metadata statement was requested.
7. An email will be sent to the MDS Admins for approval.
8. Once the metadata statement submission is approved for publication, you will receive an email notification. If the submission is denied, you will receive an email with next steps.
9. You now need to add the Attestation Root Certificates. To do so, select the statement you want to update.

10. Select Update to edit the details contained within the selected metadata statement.
11. Use the **Attestation Root Certificates** field to enter the certificates. Fill in with your data attestationRootCertificates (attestationCertificateKeyIdentifiers only for U2F).

12. Select the checkbox next to the text I understand that change of Authenticator Version, and addition of the new Attestation Root Certificates can NOT be reversed.
13. Select Update when you are done or Cancel if you do not want to proceed.

The metadata statement status updates to Requested in the Metadata Management list.

The metadata statement goes back to MDS Admin for final approval. Once an MDS Admin approves publication, all vendor users (admins and users) receive an email notification that the metadata statement is approved.

The statement status updates to Published and displays on the Authenticators screen. At this point, the statement is added to the MDS BLOB.

Cancel Publication Request

For metadata statements with a status of Requested, you can request cancellation of the publish request.

To cancel a publication request:

1. From your MDS dashboard, select the Metadata Management tab.
2. Select the statement you want to remove from the publication queue.
3. Select Cancel Publish Request.
4. Select Confirm to cancel the request or Cancel if you do not want to proceed.

The statement is removed from the publication queue and the status reverts to New.

Export MDS Portal Records

From the MDS Portal, you have the option to export your records to a CSV file. For Vendor Users, this feature is only available on the Metadata Management screen.

To export records:

1. From the MDS Portal, select the screen you want to export data from.
2. Select Export.

The CSV will generate and download to your device automatically.

Security Issues

You can use the Security Issues tab in the MDS Portal to report any security issues that you come across. These include, but are not limited to, common vulnerabilities and exposures — anything with Common Vulnerabilities and Exposures (CVE) associated with it.

1. From the MDS Portal, select the Security Issues tab.
2. Use the Type dropdown to select the type of issue you want to report.
   1. User verification bypass – Indicates that malware is able to bypass the user verification. This means that the authenticator could be used without the user’s consent and potentially even without the user’s knowledge.
   2. Attestation key compromise – Indicates that an attestation key for this authenticator is known to be compromised. The relying party SHOULD check the certificate field and use it to identify the compromised authenticator batch. If neither the batchCertificate nor the certificate field are set, the relying party should reject all new registrations of the compromised authenticator. The authenticator manufacturer should set the date to the date when compromise has occurred.
   3. User key remote compromise – This authenticator has identified weaknesses that allow registered keys to be compromised and should not be trusted. This would include both, e.g. weak entropy that causes predictable keys to be generated or side channels that allow keys or signatures to be forged, guessed or extracted.
   4. User key physical compromise – This authenticator has known weaknesses in its key protection mechanism(s) that allow user keys to be extracted by an adversary in physical possession of the device.
   5. Other – Any other type of security issue not listed here.
3. From the Authenticator dropdown, select the authenticator for which you want to report a security issue.
4. In the Security Issue Details field, enter the information you want to provide.
5. Select Send to submit the report.

Account Settings

From the account settings screens, you can view and update your personal information, change your password, and manage your passkeys.

Personal Info

On this screen you can view and update personal information related to your account.

To update your name or phone number:

1. Navigate to the Account Settings screen.
2. From the Personal Info tab, select the field you want to update.
3. Enter the new name or phone number.
4. Select Save to update your information.

To update your email address:

1. Navigate to the Account Settings screen.
2. In the New Email field, enter the new email address.
3. Select Change to update your information.

Security

On the security screen, you can manage passwords and passkeys for your account.

Change Password

To change your password:

1. Navigate to the Account Settings screen.
2. Select the Security tab and locate the Change Password section.
3. In the Current Password field, enter your current password.
4. In the New Password field, enter your new password.
5. In the Confirm New Password field, enter your new password again.
6. Select Save to update your information.

View Passkeys

To view your passkeys:

1. Navigate to the Account Settings screen.
2. Select the Security tab.

The Passkeys section lists all passkeys you have registered with your MDS Dashboard account.

Add A Passkey

It is a good idea to have more than one passkey registered to your account in case you lose access to one of them.

To add a passkey:

1. Navigate to the Account Settings screen.
2. Select the Security tab.
3. In the Passkeys section, select Add passkey.
4. Follow the prompts to register a new passkey.

Edit Passkey Name

To edit a passkey name:

1. Navigate to the Account Settings screen.
2. Select the Security tab.
3. In the Passkeys section, find the passkey you want to edit and select Edit.
4. Enter the new name for the passkey.
5. Select Save to update the passkey name or Cancel if you do not wish to proceed.

Delete A Passkey

If you have registered more than one passkey, you can delete any passkeys that you no longer want to use.

To delete a passkey:

1. Navigate to the Account Settings screen.
2. Select the Security tab.
3. In the Passkeys section, find the passkey you want to delete and select Delete.
4. Select Delete to update the passkey name or Cancel if you do not wish to proceed.

Change Password

To change your password:

1. From the MDS Dashboard, navigate to the Account Settings screen.
2. Enter your current password in the Current Password field.
3. Enter your new password in the New Password field.
4. Enter your new password in the ConfirmNew Password field.
5. Select Save to update your password.