Authentication

Configuring TOTP authentication for Active Directory-based actions

Time-based one-time-password or TOTP is one of the most common methods used in multi-factor authentication (MFA). With this method, users are required to enter a passcode within a specific time from its generation. When users prove their identity in a service with TFA or MFA using TOTP, they first have to provide their accounts' username and password. If the credentials provided are valid, a TOTP is generated specifically for that session in the authentication app. Users have to enter this TOTP in the field provided within the given time.

Users in any organization tend to enter passwords during Active Directory domain logins and enterprise application logins frequently. The main purpose of these passwords is to prohibit attackers from obtaining access to sensitive data. However, many users are not adequately vigilant regarding online security. Having to maintain multiple passwords leads to users creating simple ones that professionals can crack in a matter of seconds. MFA is a solution to this issue. Instead of using just a password, additional authentications like TOTP can be used. A major advantage of TOTP is that if the password is not entered within the specified time, it expires. Thus, even if attackers lay their hands on the user's Active Directory or enterprise application password, they will not be able to get the TOTP and enter it before it expires. With such advantages, employing TOTP during self-service password resets and account unlocks would be a good move.

ADSelfService Plus, an Active Directory self-service password management and single sign-on solution offers this feature. The solution supports over 15 MFA methods, including TOTP, Google Authenticator, fingerprint authentication, security questions and answers, and YubiKey Authenticator, to validate user identity during:

1. Active Directory self-service password reset or account unlock actions via the ADSelfService portal, ADSelfService Plus mobile app, and native Windows/macOS/Linux login screen.
2. Windows, macOS, and Linux logins.
3. Enterprise application logins through single sign-on (SSO).
4. Self-update of Active Directory profile information, subscription to mail groups, and employee search using ADSelfService Plus.

TOTP Authentication for MFA can be enabled with minimal steps in ADSelfService Plus

• Navigate to Configuration → Self-Service → Multi-factor Authentication → Authenticators Setup.
• From the Choose the Policy drop-down, select a policy.

  Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy. Only users belonging to OUs and groups included in the policy can perform the self-service feature(s) selected.

• Click the TOTP Authentication section.
• Select Enable Time-based One-time Password Authentication.

Enable TOTP authentication for Active Directory password resets

1. Go to Configuration → Self-Service → Multi-factor Authentication → MFA/TFA Settings. In the MFA for Reset/Unlock section, enter the number of authentication factors to be enforced, and select TOTP Authentication along with the other authentication techniques to be used.
2. Click Save Settings.

Enable TOTP authentication for Active Directory domain logins

1. Go to Configuration → Self-Service → Multi-factor Authentication → MFA/TFA Settings. In the Endpoint MFA section, select TOTP Authentication from the drop-down.
2. Enable the Bypass TFA if ADSelfService Plus is down option.
3. Click Save Settings.

Note:

To enable MFA for Active Directory domain logins:

• The ADSelfService Plus login agent must be installed on client machines. Click here for steps on login agent installation.
• SSL must be enabled: Log in to the ADSelfService Plus web console with admin credentials. Navigate to the Admin tab → Product Settings → Connection. Select the ADSelfService Plus Port [https] option.

Learn more about ADSelfService Plus and its Multi-factor Authentication feature.