Free Multi-Factor Authentication. Using and SMS in Enterprise/Random Password Manager (E/RPM)

Transcription

1 Free Multi-Factor Authentication Using and SMS in Enterprise/Random Password Manager (E/RPM)

2 The controlled release of sensitive credentials in a privileged identity management (PIM) system requires absolute assurance that only the right person is given access to sensitive data (strong authentication). To verify the identity of a user, multi-factor authentication is used to not only assure that they know a shared secret such as a user name and password (1st factor), but that they also have possession of some sort of ever changing element that is delivered only to that user via a mechanism such as a token, pager, or device (2nd factor). Lieberman Software s Enterprise Random Password Manager and Random Password Manager (known collectively as E/RPM), supports a wide variety of multi-factor solutions including: multi-vendor hardware and software tokens, as well as non-token solutions such as and SMS solutions. This rich set of choices assure that multi-factor authentication is available to all users irrespective of the form factor or delivery of the 2nd authentication factor. Overview One of the easiest and least expensive solutions for multi-factor authentication options is the automatic delivery of a time-limited token code value via an message or text message (SMS). One of the great things about E/RPM is that the entire life cycle creation, assignment and transmission of tokens is fully automated and can be configured in minutes for all of your users. This delivery solution also provides your organization with a free or nearly free (depends on the cost of /SMS) multi-factor solution. When configured within E/RPM, the or SMS token code (one-time and time limited code usually 6 or 8 digits long) is transmitted to a user immediately after successfully providing a correct user name and password to the web interface, and/or on starting the Win32 console. In these scenarios, further access to the program is not available until the correct token code is typed in to the web site or console. Message From Enterprise Random Password Manager (Version: ) Message from DPL2K864 Your login requires token authentication Token Code: Token code is valid for 15 minutes Example: message containing Token Code Example: Token code entry screen for web interface - 2 -

3 The Prerequisites To Use /SMS Tokens You must be running version of Enterprise/Random Password Manager or later You must be using Microsoft Windows Active Directory (AD) as your directory server If the option is used, the attribute for each user s account must be populated with a valid address (generally this comes from your AD Exchange Configuration, but Exchange is not a requirement) If the SMS option is used, the Pager attribute for each user s account must contain an SMTP value for their cell phone/pager The E/RPM product must be properly configured for sending The E/RPM web site(s) must be enabled for OATH token verification For controlling access to the web site, the user must belong to a group (global delegation rule) that requires web OATH authentication (or is explicitly listed as needing OATH authentication) For controlling the Win32 console, you must explicitly define the user for OATH authentication in the Delegate Console Access dialog - 3 -

4 How Automatic Token Provisioning Works When a user logs on to the web site and completes their user name and password authentication successfully, the program will then search for an OATH token assigned to them by their authenticator (i.e. domain name) and user name. If no token is found for a user, the following steps occur: A new token is created, it is given a random token ID based on a generated GUID (i.e. {B585DF ABD4-02DCCC9A9616}), Token type is set to one of the TOTP types previously selected A new random seed is generated for the token The delivery method of the token (SMS or ) is set for the token User name and authenticator is assigned to the token for this user If a token is found (or was just created) for a user that is configure for or SMS token value delivery, once the token has been found: A token code (6 or 8-digit value) for the token is generated and sent via or SMS Statistics for the token are updated Timer is started to automatically time out the token after a fixed period of time (generally 15 minutes). Once a token is used, it cannot be reused since the token verification process updates the token statistics to inhibit the use of older or the just used token - 4 -

5 Automated Provisioning of /SMS Users for Multi-Factor Authentication Assuming that all prerequisites have been completed for OATH use of SMS/ tokens Enabling the E/RPM web sites for OATH authentication (covered in this guide) Configuring user/group identities to require OATH authentication (covered in this guide) Accounts are configured for /SMS in AD You can configure E/RPM to automatically configure and provide token codes to all users automatically. Manual per-user configuration is possible; however, we will only be covering fully automatic token creation, assignment, and token value transmission in this guide. The advantage of this methodology is that all E/RPM users can be provisioned for multi-factor authentication in less than 5 minutes without the use of tokens. The following process will configure E/RPM to automatically create, assign and configure time-based tokens to users that don t already have tokens assigned to them. The token values for these internally maintained software tokens will be automatically transmitted to authorized users via the default mechanism selected

6 Hands-On Part 1: Automatic Configuration of /SMS Tokens 1) Start E/RPM Console 2) Select the Delegation Token Configuration menu option: 3) On the Token Configuration dialog select the Global Token Options Options menu option: 4) Select the New Token IDs option for New tokens have randomly generated GUID IDs Each user will receive a new automatically generated token with a unique and randomly chosen cryptographic seed, as well as unique token ID number. Normally, tokens are 8 digit values, but in this case we will create a much longer complex token ID to guarantee that each is unique

7 5) Select 8 Digit TOTP. You must select a default token type that is time based (TOTP) to be able to select the delivery type for the token value. The SMS/ option requires that you select a default token type that must be either TOTP 6-Digit or TOTP 8-Digits. 6) Select Send to user based on field in Active Directory You can select either SMS or as the default type. The default is not to send out tokens via SMS or , so this value MUST be changed from its default to work properly. NOTE: If you are going to use SMS messaging, you must populate the Pager field in Active Directory with the SMTP address of a user s device. This article in Wikipedia explains how to populate the Pager field. For example the pager field for a user might be: @vtext.com to send the token code to the Verizon phone with the number ) Click the OK button to save the settings. E/RPM will now send an message to each authorized user of E/RPM. Note that you still need to configure Delegated Global Permissions as well as enable the web site to use OATH authentication

8 Hands-On Part 2: Assigning the global delegation requirement for OATH token authentication to users and groups 1. Enable the group/user requirement for OATH authentication a) Go to the Delegation Web Application Global Delegation Rules menu option b) Select the user for OATH authentication (i.e. pl\administrator), or a group they belong to, set the checkbox Require OATH, and click the Apply Permission Changes button. c) Repeat the group/user assignments for all users that require OATH authentication IMPORTANT NOTE: You must configure the requirement of OATH authentication to either every user or a group that contains all of the users of this program. If you don t do this, they will not be challenged with an OATH token requirement. d) Click on the OK button - 8 -

9 Hands-On Part 3: Enabling the OATH authentication requirement for the web site 1. To configure the web site to authenticate with OATH tokens, repeat the following steps for all web sites deployed. a. Click on the Manage Web App button on the main dialog. b. Select each web instance that will require OATH token authentication for all logons c. Right click and select Change web application options for the selected instance d. Click on Yes to accept the settings overwrite e. Click on the Security tab f. Check the checkbox: Enable OATH token checks for web application logins based on permissions g. Click OK - 9 -

10 Hands-On Part 4: Testing Web Authentication and Automatic Token Generation 1) We assume the preceding steps have been completed: a. Active directory has an address for each user logging into E/RPM. b. Delegate Global Rights have been set up to require OATH authentication for all users of this application either by user name or group they are a member of. c. Web site is enabled for OATH authentication d. Global token options have been configured for: i. an 8-Digit TOTP token ii. token value is the default delivery option iii. Token ID generation is set to create a GUID for new tokens 2) Open the Token Configuration dialog via the menu: Delegation Token Configuration and there should be no entries in it. 3) Close the Token Configuration dialog by clicking on OK. 4) Logon to the E/RPM web site

11 5) You should immediate receive a challenge screen for a token code: 6) You or the user should receive an with your token code: 7) Copy in or type in the token code and click the Login button: 8) You should then be logged in as expected:

12 9) Let s confirm that a token was created, assigned and a code issued 10) Open the Token Configuration dialog via the menu: Delegation Token Configuration and there should be one entry: 11) Double-click on the top entry (or highlight it and click the Edit button) and you will see that a new token was created, and assigned to the user with all of the AD properties automatically assigned without any manual configuration:

13 Summary A new unique token such as shown above will be generated for each new user that logs on to E/RPM (and does not already have a token assigned to them). The token value for each user s token will be sent to each user automatically via or SMS (depending on how you have configured it) as long as they properly authenticate initially via the web page. The grreat thing about this configuration option is that you don t have to manage tokens and your multi-factor authentications are free (or nearly free depending on your communication costs)

14 About Lieberman Software Lieberman Software Corporation, established in 1978 as a software consultancy, has been a profitable, management-owned organization since its inception. Lieberman Software pioneered privileged account password management software, releasing its first product to this market in Since that time, the company has continuously updated and expanded its privileged password solutions while growing its customer base to include many of the world s most secure enterprises. Lieberman Software is a Microsoft Gold Certified Partner and has technical partnerships with such other industry leaders as Cisco, Novell, Red Hat, Hewlett-Packard, IBM, RSA and Intel. The company is headquartered in Los Angeles, CA, and maintains a regional office in Austin, TX. All product development, testing, and support operations are based in the United States. For more information, visit Call (USA and Canada) or (International) sales@liebsoft.com Oath Specifications Web site for OATH Initiative for Open Authentication: Membership list for OATH: Official specs for OATH tokens: HOTP: TOTP: E/RPM follows the following best practices for token authentication: TOTP: HOTP: P (USA/Canada) P (01) (Worldwide) F (01) Avenue of the Stars, Suite 425, Los Angeles, CA Lieberman Software Corporation. Trademarks are the property of their respective owners