How-To: Bootstrap Security Keys for Users in Keytos Shield

Learn how to bootstrap security keys in Keytos Shield, so your IT help desk can install a user’s identity on a YubiKey with Keytos Connect before shipping the key to the user.

Overview - What is Security Key Bootstrapping in Keytos Shield?

Bootstrapping lets your IT help desk set up a user’s security key for them. Instead of shipping a blank key and having the user enroll it, a credential manager installs the user’s identity on the key in Keytos Connect, and then ships the key, ready to use. This is useful for new hires who don’t have a working credential yet, or for users who need a replacement key quickly.

Bootstrapping follows the normal request flow, with one extra step before the key ships:

  1. The user requests a security key.
  2. An administrator approves the request and assigns a key from your inventory.
  3. A credential manager bootstraps the key with the user’s identity.
  4. You ship the key to the user, or hold it for pickup.

Prerequisites for Bootstrapping Security Keys in Keytos Shield

  1. You have completed Keytos Shield identity security onboarding.

  2. You have the Owner or Identity Administrator role on your Keytos Shield subscription, so you can see Admin access in Keytos Connect.

  3. IT help desk is turned on, and you are a credential manager. In the Shield portal, go to Identity settings > Enrollment and recovery. Under How do you want users to create or recover their security key?, check IT help desk, and then add yourself, or a group you belong to, under Credential managers. Credential managers can onboard security keys on behalf of users, but can’t assign keys. Click Save changes.

    Keytos Shield Enrollment and recovery settings with IT help desk checked and the Credential managers list of users who can bootstrap security keys

  4. You have registered the security key in your inventory, and you have it plugged in to the computer running Keytos Connect.

Step-by-Step Guide - How to Bootstrap a Security Key in Keytos Shield

Step 1 - How Users Request a Security Key

The user requests a security key in Keytos Connect by clicking Request a new key on the Identity management page and filling in the key type, where to receive it, and why they need it. If an administrator makes the request instead, it’s approved automatically, and you can skip to Step 3.

Step 2 - How to Approve the Security Key Request

  1. Open Keytos Connect and sign in with your administrator account.

  2. On the Identity management page, under Admin access, click Manage security keys.

    Keytos Connect Identity management page with a connected security key and Manage security keys highlighted under Admin access

  3. Under Open requests, review the request’s Requester, Assign to, Key type, Address, and Reason.

  4. Click Approve, and then click Confirm. To reject the request instead, click Deny.

    Keytos Connect Open requests tab showing a security key request for a YubiKey 5 USB C NFC with the Approve button highlighted

Step 3 - How to Assign a Security Key to the Request

After you approve a request, Keytos Connect takes you to the Assign a key page.

  1. Plug in or tap a security key of the requested Key type, or type its serial number in the Enter security key serial number box.

    Keytos Connect Assign a key page waiting for a security key, with the Security key card highlighted and the Skip assigning key option below

    Don’t have a key in hand yet? Click Skip assigning key. The request moves to Approved requests, where you can click Assign later.

  2. Check that the key shows as Connected and its Model matches the requested Key type, and then click Confirm.

    Keytos Connect Assign a key page showing a connected YubiKey 5 USB C NFC with its serial number and the Confirm button highlighted

  3. Keytos Connect confirms the security key is assigned. Click Done, but don’t ship the key yet. Bootstrap it first.

    Keytos Connect Ship the key page confirming the security key is assigned to the user

Step 4 - How to Bootstrap the User’s Identity on the Security Key

  1. On the Identity management page, under Admin access, click Bootstrap security keys.

    Keytos Connect Identity management page with Bootstrap security keys highlighted under Admin access

  2. Plug in or tap the security key you assigned in Step 3.

    Keytos Connect Bootstrap security keys page with the Security key card highlighted, waiting for a security key to be inserted

  3. Check that the Identity and Domain name show the user the key is assigned to, and then click Install identity.

    Keytos Connect Bootstrap security keys page showing the connected key, the user's identity and domain name, and the Install identity button highlighted

  4. Read the confirmation, and then click Install.

    Keytos Connect confirmation dialog warning that installing an identity clears all identities on the security key, with the Install button highlighted

  5. Keep the security key plugged in while Keytos Connect installs the identity in four steps. When prompted:

    • Remove and reinsert the security key once while Keytos Connect resets it.

      Keytos Connect Installing identity in the security key dialog asking to remove and reinsert the security key once during step 1 of 4

    • Touch your security key when it blinks.

      Keytos Connect Installing identity in the security key dialog asking to touch the security key when it blinks

  6. Wait while Keytos Connect installs the user’s certificates. When it finishes, it returns to the Bootstrap security keys page.

    Keytos Connect Installing identity in the security key dialog showing step 3 of 4, installing the second certificate

Step 5 - How to Get the Security Key to the User

  1. Unplug the security key and ship it to the address on the request, or hold it for pickup in the office.
  2. Let the user know their key is on the way. The key arrives Blocked, so before they can use it, the user requests an unblock and sets their own PIN in Keytos Connect.
  3. When the user’s unblock request comes in, approve it.