TomEE - Passkey as a second factor

This demo authenticates in two steps: a password (first factor) followed by a passkey / WebAuthn assertion (second factor).

1. Register a passkey - log in with your password, then enrol an authenticator.
2. Log in - password, then passkey, then reach the protected page.
3. Protected page - only reachable once both factors have passed.

Demo users: jon / doe and iron / man.

Passkeys require a secure context: use http://localhost or HTTPS.