Why XFA asks you to confirm it's you

On a trusted device, XFA usually signs you in without asking anything. Your organization can ask XFA to check that it's really you at the device as well. XFA then asks you to confirm it's you, with your fingerprint, face or password, each time you sign in.

Beta

This is in beta. XFA only asks when your organization has turned it on for the application you sign in to.

Why XFA asks

A trusted device proves which device you sign in from, not who is using it. Confirming proves that it's you at the device, and not someone else who picked it up.

XFA asks once per sign-in.
Your fingerprint, face and password never leave your device, and XFA never sees them. XFA only learns that your device confirmed it's you.
If you cancel, you are not signed in. Sign in again to try again.

How to confirm

The sign-in page shows "Confirm it's you on this device with your fingerprint, face or password." Your device then shows its own prompt, "Confirm it's you to sign in to [application]", with the name of the application you sign in to.

macOS: use Touch ID, or type your Mac login password.
Windows: use Windows Hello (face, fingerprint or PIN). Without Windows Hello, type your Windows account password.
Linux: touch the fingerprint reader. Without an enrolled fingerprint, or if you wait, type your account password.
iPhone and iPad: use Face ID or Touch ID, or type your device passcode.
Android: use your fingerprint or face, or your PIN, pattern or password.

On a computer, XFA must be running to ask. If you see "XFA could not ask you to confirm it's you. Open XFA and try again.", open XFA and sign in again.

When your device can't confirm it's you

A device that has no way to confirm it's you cannot be used to sign in. The sign-in page then says "This device can't confirm it's you." and tells you what is missing. Fix it as below, then sign in again.

iPhone and iPad: set a passcode

Open Settings, then Face ID & Passcode (or Touch ID & Passcode), and tap Turn Passcode On.

Android: set a screen lock

Open Settings, then Security (or Security & privacy), and set a Screen lock: a PIN, pattern or password. The names differ per brand.

Windows: set up Windows Hello or a password

Open Settings, then Accounts, then Sign-in options. Set up a PIN (Windows Hello), a fingerprint or face recognition, or a Password.

XFA asks for your password through your desktop's password prompt. GNOME, KDE, Cinnamon, XFCE and most other desktops have one. Over SSH, or in a minimal window manager without one, XFA cannot ask. Sign in from your normal desktop session.

Linux: run one setup command

To ask for your password, XFA registers a small policy file with your system. The deb, rpm and Nix packages do this when they install. A tarball install runs without admin rights, so it cannot. The sign-in page then says "XFA can't ask for your password on this computer yet." and shows a command to run once as root. It asks for an administrator password:

sudo sh -c 'f=$(mktemp) && curl --proto =https --tlsv1.2 -fsS -o "$f" https://distribution.xfa.tech/xfa-native-desktop-application/polkit/tech.xfa.verify-user-9daa4e5134b1f39035c0dd8b24ec87f2f8e66b29f712f199446194e8a1bfea1a.policy && echo "9daa4e5134b1f39035c0dd8b24ec87f2f8e66b29f712f199446194e8a1bfea1a  $f" | sha256sum -c - && install -o root -g root -m 0644 "$f" /usr/share/polkit-1/actions/tech.xfa.verify-user.policy; s=$?; rm -f "$f"; exit $s'

It downloads XFA's policy file, checks its fingerprint (SHA-256) so that only the exact file XFA published is accepted, and installs it as root in /usr/share/polkit-1/actions/. If the check fails, nothing is installed. Then sign in again.

NixOS: add XFA to the system configuration

An XFA installed per user with nix profile cannot register the policy file. The sign-in page then says that XFA is installed for your user only, and asks you to add XFA to your NixOS system configuration and rebuild.

In the inputs of your flake.nix:

inputs.xfa.url = "https://distribution.xfa.tech/xfa-native-desktop-application/nix/xfa.tar.gz";
inputs.xfa.inputs.nixpkgs.follows = "nixpkgs";

In your system configuration:

environment.systemPackages = [ inputs.xfa.packages.${pkgs.stdenv.hostPlatform.system}.default ];

Your NixOS configuration needs the flake inputs for this line: pass them to your modules with specialArgs = { inherit inputs; }; in nixpkgs.lib.nixosSystem, and add inputs to the module arguments. If your system uses configuration.nix without a flake, follow If your system uses configuration.nix instead.

Then apply it:

sudo nixos-rebuild switch

Update XFA

If you see "Update XFA on this device to sign in.", your version of XFA is too old to ask you to confirm. Update XFA, then sign in again. See How to update XFA.

Contact your IT help desk. Your administrator can turn off this check for the application, and XFA then signs you in without asking again.