Configure Identity Platform and Login for Endpoints

Endpoint Name

Set the name of the endpoint.

Endpoint Description

Optional. Provide a description about this endpoint.

Authentication Policy

Set the login workflow and authentication policy for the endpoint.

Data Store

Set the data store to authenticate and allow user access to the endpoint.

Start typing to bring up a list of data store names. You can enter more than one data store.

Groups

Use one of the following options:.

Realm Number

Select the Realm Number to use for this application.

OTP validation property

Set this to the value you set in the data store AUX ID property, like Aux ID 3.

This is the Aux ID used to communicate with the Identity Platform to validate a one-time passcodes (OTP) from emails, phone calls, SMS, Help Desk, and notification passcode.

Installer configuration Name

Set the name of the installer configuration.

This name is displayed in a list that could be very long, depending on how many endpoints you set up. Be sure to use a name that is easy to identify.

Endpoint / Host Name

Set to the name of the endpoint you created on the Endpoint Details page in Step 2.

This connects the endpoint to communicate with the Identity Platform through the API.

Allow self-signed certificate

Turn on this option only in test or lab environments where the server has a self-signed certificate.

When turned on, it turns off all certificate validations. To establish communication, the HTTP client then accepts valid certificates, self-signed certificates, expired certificates, invalid root certificates, certificates without matching common names, and so on.

Do not turn on this option for production environments. In production, the option introduces critical security risks, like the potential "Man in the middle" attack which grants users access to a system without validating their credentials, and lets unauthorized users steal OATH seeds. If the option is set in production, it sends you a warning message that the option is enabled.

After installing an endpoint with this option set, it remains effective until you uninstall the endpoint. Then, reinstall the endpoint using a configuration file with this option turned off.

Install Login for Endpoint without connection to Identity Platform

Turn on this option, for example, to to allow a third-party organization to configure machines for your end users. If the third-party organization does not have a connection to the Identity Platform, this option allows them to complete the configuration.

When turned on, set the Grace Period and specify the number of days for password-only login. This setting is on the Multi-Factor Methods tab.

Alternatively, to achieve the same results for self-service password reset (SSPR) without a connection to the Identity Platform, on the Multi-Factor Methods tab, use these settings:

Endpoint Operating System

Select the operating system of the endpoint:

Endpoint Type

Select the type of endpoint:

Self-service password reset-only mode

Available only for Windows endpoint

Turn on this option to set up a self-service password reset (SSPR) option for end users to select on their login screen.

When this option is on, it deactivates all other options on the page. If you want the Password Reset link plus all the Login for Windows features (MFA, adaptive engine, etc.), configure the following:

Ask for second-factor authentication when run as Administrator

Available only for Windows endpoint

Indicate whether a user who logs in with "Run as administrator" on the same machine used to log into a regular user account must authenticate again.

Enable passwordless authentication

Available only for Windows endpoint

Select this check box to allow end users to use a fingerprint reader to authenticate by using any enrolled fingerprint.

This is not the setting for second factor biometric authentication in the SecureAuth Authenticate app.

On Login for Windows and Login for Mac, see Use fingerprint recognition on mobile in the End user login experience topic.

On Login for Linux, see Approve login notification for fingerprint recognition in the End user login experience topic.

Enable offline authentications

Indicate whether end users can authenticate when offline.

SecureAuth uses OATH seeds to validate OATH-based methods (like TOTP or HOTP) when end users log in. Most use cases require SecureAuth to store OATH seeds, and if they are not stored, end users cannot login while offline. In a scenario where, for example, a server is always online, you might not want to cache the OATH seed. This prevents a leak or theft of the OATH seed.

Enable adaptive authentications

Indicate whether to allow adaptive authentication.

This setting acts similar to Adaptive Authentication settings in the Identity Platform. You can limit how admins and users log in in several ways, for example, by username, group, IP, and so on.

Suggests use of an OATH-based method on first login regardless of your Adaptive Policy settings

Set this option to display a message that suggests end users authenticate for the first login by using an OATH-based method, such as TOTP, HOTP, etc. This ensures that they can log in when offline.

Login for Endpoints requires end users to use one OATH-based method, if at least one method is available to end users. If at least one OATH-based method is not available to end users, they can use any other available method, but offline login will not be available.

Enable smart card authentication as first factor

Available only for Windows endpoint

If your organization has smart card authentication enabled on Windows workstations, you can select this check box to use it as the first factor in Login for Windows.

To learn more, see this Microsoft article on virtual smart cards.

Grace period

Indicate whether there is a grace period (with a set number of days) in which end users can use a password-only login to a machine.

After end users set up their second-factor methods, they can dismiss the password-only login screen.

For a detailed description with a use case, see First login with password only section in the End user login experience topic.

Bypass interval

Available only for Windows endpoint

Define whether end users must authenticate again with a second factor after a set period of time, if they lock their workstation.

For example, the time is set for 32400 seconds (9 hours). The end user locks their workstation after working for 8.5 hours. That evening, the end user decides to unlock their workstation and finish a few tasks. More than 9 hours have passed, so the end user will need to authenticate with a second factor.

User Bypass

Define whether to allow end users to bypass second factor authentication. Usernames defined in the list will not be prompted for authentication.

The endpoint supports the following username field syntax:

To add more than one username in the field, press Enter after each entry.

Code example in json file:

"user_bypass":[".\\username", "username", "username@domain.local"]

Require multi-factor authentication when:

Logging in with physical access

Windows: Logging in via remote desktop protocol

Linux / Mac: Logging in via Remote Connection (SSH)

User MFA Policies - When user belongs to groups

Select this check box to bypass MFA or request MFA for users who belong to a group.

Users must belong to a local or domain group that you specify in the text box. Add local users only to the local group.

To add more than one group in the field, press Enter after each entry. See the following formats for group names. All endpoints support the following syntax.

Code example in json file to bypass MFA for users in groups:

"mfa_policies": {
        "user_groups": {
           "policy": "bypass_mfa",
           "groups": ["Domain Admins@myDomain.com", "ITAdmins@myDomain.com", ".\\Administrators"]
}

Code example in json file to request MFA for users in groups:

"mfa_policies": {
        "user_groups": {
           "policy": "request_mfa",
           "groups": ["Domain Admins@myDomain.com", "ITAdmins@myDomain.com", ".\\Administrators"]
}

User MFA Policies - When user belongs to organizational units

Available only for Windows endpoint

Select this check box to bypass MFA or request MFA for users who belong to an organizational unit.

Users must belong to an organizational unit that you specify in the text box.

To add more than one organizational unit in the field, press Enter after each entry. See the following organizational unit name formats.

Code example in json file to bypass MFA for users in groups:

 "user_organizational_units": {
           "policy": "bypass_mfa",
           "organizational_units": ["OU=eng,OU=it,DC=domain,DC=company,DC=com", "OU=developers"]
 },

Personalization

Auto add pre-logon access providers

Available only for Windows endpoint

Select this check box to allow a pre-login access provider so that end users can connect to VPN clients before logging into Login for Windows.

Hide retry options

Available only for Windows endpoint

Select this check box to hide the "retry the connection" button on the login screen when Login for Windows is offline.

Custom error message

Select this check box to personalize the error message for end users who are locked out of their accounts. For example, you could enter a message like the following:

"For assistance, please contact Acme Help Desk at 949-555-1212, help@acme.com, or https://helpdesk.acme.com."

Request Timeout

Set the timeout in seconds, that the Login for Endpoint waits for HTTP requests to respond. The default is 30 seconds. Use this option to reduce network wait times, because after it reaches the specified timeout value, it ends the network connection for HTTP requests.

For example, if the endpoint tries to contact the Identity Platform, and cannot for any reason, the endpoint ends the network connection after reaching the timeout value. If this timeout value is not set, the endpoint keeps trying to reach the Identity Platform.

LDAP Request Timeout

Available only for Windows and Linux endpoints

Set the timeout in seconds, that the Login for Endpoint waits for LDAP requests to respond. The default is 30 seconds. Use this option to reduce network wait times, because after it reaches the specified timeout value, it ends the network connection for LDAP requests.

For example, if the endpoint tries to contact the data store, and cannot for any reason, the endpoint ends the network connection after reaching the timeout value. If this timeout value is not set, the endpoint keeps trying to reach the data store.

Code example in json file:

"ldap_timeout": 30,

Prompt end user to change password before expiration

Available only for Windows endpoint

Select this check box to prompt end users to change their password before it expires in "x" number of days.

In the text box, set the number of days to warn the user before their password expires.

For example, end users will see a warning message at the login prompt similar to the following image.

Password Reset

Enable update password link on the login interface

Available only for Windows endpoint

Select this check box to set up a self-service password reset (SSPR) link for end users to select on their login screen.

In the text box, specify either the SecureAuth Identity Platform realm or the web page URL the user can access for resetting a password.

If you use this setting, you will need to clear the Self-service password reset-only mode check box on the Multi-Factor Methods tab.

Alternate Credential Providers

Allow default operating system provider

Available only for Windows endpoint

Select this check box to add the default credential provider on the login screen. This allows end users to log in by using a password and second factor with the SecureAuth credential provider. Or, they can use a password only with the default credential provider.

This option helps new teams starting out with Login for Windows to have a default credential provider option for end users to authenticate as a fallback.

Allow other credential providers

Available only for Windows endpoint

Select this check box to allow the use of non-SecureAuth credential providers and other credential providers, like card scanners. Be aware of the following, especially the first item: