YubiKey on Synology

[AlCar]

I just set up a Synology server and used a YubiKey for 2FA. If I login through the domain using DDNS, everything works perfectly. If I attempt to login through the local IP on the network I can not log in with the hardware key. Does anyone know why this is? Do hardware keys always need to be associated with a domain or is this something specific to Synology?

 

[PHolder]

Yubikeys can work in a number of modes. (They're like a platform with different modules that get permanently loaded into the key, but can change over time as new keys get manufactured.) The Yubikey initial mode, when they first came to market, had them working like a keyboard and typing in the 2FA code into the field when the button was pressed. For that mode to work, it required access to the Internet for the server, because the server needed to contact Yubikey's server to verify the code. I presume you're not using this mode, but if you are, then it could be possible that the needed access to the Yubikey server would be blocked?

More likely you're using another mode, the same one that is used for PassKeys. In this case your Synology should be keeping a public key that corresponds to the private key securely stored in the Yubikey. In the FIDO2 spec, this was done using the "site" URL as part of the data stored, and so would need to match in order for the key/server to be willing to generate a verification code. Since you mentioned that you can log in through the domain, this domain is likely stored with the key data and that is your issue.

Can you associate more than one key with your account. i.e. Can you generate one with the domain and one without so that it can match in either case?