MFA (Multi-Factor Authentication)

Multi Factor Authentication (MFA) is an authentication method that compels the user to provide two or more factors of authentication to gain access of a resource. MFA is core component of a strong Identity and Access Management (IAM) policy.

To prevent attacker from accessing PK Protect data multi-factor authentication can be used in addition to a user’s Active Directory account password and email address. The PK Protect supports two methods of MFA i.e., smartcard/X.509 certificate and Time-Based One Time Password (TOTP).

In TOTP, user connects to a device through a tool like Google Authenticator. The authenticator provides a code for limited time that user needs to enter. This timing prevents an attacker from brute-forcing by the help of a code.

To access MFA, go to Identities > MFA.

MFA Policies

A list of existing MFA policies, including Site-wide Default policy appears on the MFA Policies panel. The Site-wide Default covers the users and groups which are not defined in another policy.

For existing MFA policies, the following actions can be performed:

1. Edit - Click this button to edit the details of a policy. You cannot edit the details of the name field for Site-wide Default policy.
2. Delete – Click this button to delete the policy.
3. Status – Click this button to view the list of all devices which are associated with the policy. On clicking, it redirects to the Device screen that can be accessed via Archive > Devices.

Adding an MFA Policy

To create new user MFA policy, click Add button and configure following settings:

1.     General Settings

1. Enter the name of the policy in the Name
2. Enter the name of the users or groups in Users/Groups field to apply this policy. You can make use of Advanced Definitions to identify the user and groups.

2.     MFA Requirement

The following sections allow administrators to define the elements of how and when MFA will be required.

Require MFA – Selecting this checkbox will enforce MFA for the users defined in the policy and will reflect the settings defined in the following sections.

For each MFA settings there is a ‘Mode’ and ‘Grace Period’

Mode – Defines the location where the MFA validation is executed.

• Server – The server will be used to validate the MFA token, this applies to both TOTP and certificate based authentication.
• Client – The client will locally valid the MFA token through proof of a digital signature.
• Either – The server or client will authenticate the MFA token; depending which method is available and/or is able to perform the authentication first.
• Off - The associated setting for MFA is disabled.

Grace Period – This defines a period of time (in seconds) that subsequent activities can be completed, without requiring the end user to MFA again. Different grace periods can be defined for each MFA setting.

3.     Certificate Settings

If you want to use certificate-based authentication through smartcard or other means, check the Allow Certificate-based Authenticator checkbox. These settings control how to implement and control the interactions with the digital certificate.

4.     TOTP Settings

Select Allow TOTP Authenticators to allow users to use a Time-Based One Time Password (TOTP) token. Admins can customize the message displayed to users when certain circumstances exist. If Custom Message field is left blank, it will deliver default message in that situation.

Click Save to make the changes effective or click Cancel.

Setting up Multi-Factor Authentication- For End Users

After an admin creates MFA policies, end users must configure their account to operate using MFA. The steps required vary for different operating system platforms, click the links below to access the setup instructions for your particular operating system.

Windows

MacOS

Linux

Linux

Android

Managing Multi – Factor Authenticators

An admin can delete an existing device from the MFA screen if device is lost or stolen. The Manage Multi-Factor Authenticators feature helps an admin to search for the system user. In turn, PEM displays a list of all MFA authenticated devices for this user.

Follow the below steps to search for system user:

1. Click Manage Multi-Factor Authenticators The screen is redirected to Manage Multi-factor Authenticators panel.
2. Search the system user by entering their email address or name.
3. Click Lookup This will list down all the MFA authenticated devices for the user.
4. Click Close button to go back to MFA screen.

Following is the description of the columns:

Check Certificate

This feature allows the admin to confirm whether a user certificate is registered with PEM and complies with the default Site-wide policy. To check the certificate, follow the below steps:

1. Click Check Certificate The screen is redirected to Check Certificate panel.
2. Enter the existing user information in Fill User Info field or upload a certificate in Choose Cert File field which you want to test.
3. Enable the Check if acceptable to create MFA Pair option if you want to confirm whether the certificate file will work to authenticate a device.
4. Click Submit button to test the Universal Principal Name (UPN), email address, serial number and matches the assigned policy.

If the result is successful, then it returns the user’s UPN, email address, serial number and assigned policy.

Manage PKCS11 Drivers

The Public Key Cryptography Standard (PKCS) #11 defines the interface which is used for communication between SSL and PKCS11 modules. Users must setup a PKCS11 configuration before using PEM with MFA. Since the locations of the PKCS11 libraries vary, therefore PEM lets you define commonly used locations. The PK Protect Agent fetches the list from the PEM and look for the appropriate PKCS11 libraries when setting up an MFA.

To setup PKCS11 configuration, follow the below steps:

1. click Manage PKCS11 Drivers This redirects the screen to PKCS11 Drivers panel.
2. Enter the name of the label in Label
3. Enter the platform.
4. Enter the architecture in the Architecture
5. Enter the path in the Path field where PKCS11 Driver is kept.