changed admin look for webauth options

ISHIELD_WEBAUTHN_NOTES.md

@@ -25,6 +25,20 @@ times out. Registering the key without a configured PIN works. YubiKeys with an
 existing PIN work correctly in the same environment, and the iShield works on
 webauthn.io.
 
+The timeout was subsequently reproduced on a clean Debian 13 test instance and
+narrowed down further:
+
+| Existing WebAuthn credentials | Policy | iShield registration |
+| --- | --- | --- |
+| none | `discouraged` | succeeds without PIN |
+| at least one YubiKey | `discouraged` | times out |
+| at least one YubiKey | `preferred` | succeeds with PIN |
+
+The registered YubiKey was physically disconnected during the failing iShield
+attempt. Removing only the YubiKey registration makes the iShield work with
+`discouraged` again. This isolates the additional trigger to the non-empty
+`excludeCredentials` list sent by Vaultwarden, rather than USB device contention.
+
 Vaultwarden deliberately changes the registration and authentication policy to
 `userVerification: discouraged`, since WebAuthn is being used as a second factor.
 The iShield advertises `makeCredUvNotRqd: yes`, so the client is allowed to try

src/static/templates/admin/settings.hbs

@@ -26,6 +26,16 @@
                             {{#case type "text" "number" "password"}}
                             <label for="input_{{name}}" class="col-sm-3 col-form-label">{{doc.name}}</label>
                             <div class="col-sm-8">
+                                {{#if (eq name "webauthn_2fa_user_verification")}}
+                                <select class="form-select conf-text" id="input_{{name}}" name="{{name}}">
+                                    <option value="discouraged" {{#if (eq value "discouraged")}}selected{{/if}}>Discouraged</option>
+                                    <option value="preferred" {{#if (eq value "preferred")}}selected{{/if}}>Preferred</option>
+                                </select>
+                                <div class="form-text">
+                                    Discouraged avoids requesting a PIN or biometric check for standard WebAuthn 2FA.
+                                    Preferred asks compatible authenticators for user verification and can improve compatibility with some security keys.
+                                </div>
+                                {{else}}
                                 <div class="input-group">
                                 <input class="form-control conf-{{type}}" id="input_{{name}}" type="{{type}}"
                                     name="{{name}}" value="{{value}}" {{#if default}} placeholder="Default: {{default}}"{{/if}}>
@@ -33,6 +43,7 @@
                                     <button class="btn btn-outline-secondary input-group-text" type="button" data-vw-pw-toggle="input_{{name}}">Show/hide</button>
                                 {{/case}}
                                 </div>
+                                {{/if}}
                             </div>
                             {{/case}}
                             {{#case type "checkbox"}}