From 2473e1bfdeeb0ea7cc47a14811c29cc4801c8038 Mon Sep 17 00:00:00 2001
From: Chloe Surett <chloe@surett.me>
Date: Mon, 17 Nov 2025 11:57:09 -0500
Subject: ssh: T7483: Add fido2 PubkeyAuthOptions

---
 interface-definitions/service_ssh.xml.in | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

(limited to 'interface-definitions')

diff --git a/interface-definitions/service_ssh.xml.in b/interface-definitions/service_ssh.xml.in
index 9fd9e32c3..7a1348404 100644
--- a/interface-definitions/service_ssh.xml.in
+++ b/interface-definitions/service_ssh.xml.in
@@ -61,6 +61,25 @@
               <valueless/>
             </properties>
           </leafNode>
+          <node name="fido">
+            <properties>
+              <help>FIDO2 SSH options</help>
+            </properties>
+            <children>
+              <leafNode name="pin-required">
+                <properties>
+                  <help>Require FIDO2 keys to attest that a user has been verified (e.g. via a PIN)</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+              <leafNode name="touch-required">
+                <properties>
+                  <help>Require FIDO2 keys to attest that a user is physically present</help>
+                  <valueless/>
+                </properties>
+              </leafNode>
+            </children>
+          </node>
           <node name="dynamic-protection">
             <properties>
               <help>Allow dynamic protection</help>
-- 
cgit v1.2.3