To strengthen user logon security, Log360 supports two-factor authentication. Once enabled, Log360 will require users to authenticate using one of the authentication mechanisms below in addition to the Active Directory credentials whenever they log in.
Navigate to Admin → Administration → Logon Settings.
Click the Two-factor Authentication tab.
Toggle the Two-factor Authentication switch to the ON position.
Select the authentication methods of your choice from the list provided.
Note:
If multiple authentication options are enabled, then the user will be asked to choose one at the time of logging in.
Make sure you configure the authentication option you’ve chosen by entering all the required details. Click here for the steps.
Click Save Settings.
Email Verification
When this option is selected, Log360 sends a verification code via email to the user’s email address. The user has to enter the verification code to successfully login.
Configuration steps:
Configure mail server settings if not done already.
Enter a Subject for the email.
Enter the Message in the box provided.
Set the priority as per your requirement.
Click Macros link at the bottom to insert them in the email message.
Once you are done, click Save Settings.
Once enabled, users will be asked to enroll for two-factor authentication by entering their email address during login.
SMS Verification
When this option is selected, Log360 sends a verification code via SMS to the user’s mobile number. The user has to enter the verification code to successfully login.
Configuration steps:
Configure SMS server settings if not done already.
Enter the Message in the box provided.
Click Macros link at the bottom to insert them in the SMS.
Once you are done, click Save Settings.
Once enabled, users will be asked to enroll for two-factor authentication by entering their mobile number during login.
Google Authenticator
Google Authenticator adds an extra layer of protection to the reset password/unlock account process. Once enabled, users will be required to enter a six-digit security code generated by the Google Authenticator app for identity verification.
Configuration Steps:
Just click Enable Google Authenticator
Click Save Settings.
Once enabled, users can enroll themselves for two-factor authentication using the Google Authenticator app.
RSA SecurID
RSA SecurID is a mechanism developed for performing two-factor authentication for a user to a network resource. Users can use the security codes generated by the RSA SecurID mobile app, hardware tokens, or tokens received via mail or SMS to log in to Log360.
Configuration steps:
Log in to your RSA admin console (e.g., https://log360-rsa.testdomain.com/sc).
Go to Applications. Under Authentication Agents, Click Add New.
Add Log360 Server as an authentication agent and click Save.
Go to Access. Under Authentication Agents, click Generate Configuration File.
In Log360, under RSA SecurID configuration, click Browse and select the sdconf.rec file.
Click Save Settings.
Once enabled, users will be asked to
Duo Security
If your organization uses Duo Security for two-factor authentication, it can be integrated with Log360 to secure logins. Users can approve or deny the Log360 login requests using a push notification or by entering the six-digit security code generated by the Duo mobile app. Authentication via Duo Security can be configured in two ways in Log360: Web v2 SDK and Web v4 SDK.
Web v2 SDK uses a traditional Duo prompt which will be displayed in an iframe in Log360, whereas Web v4 SDK uses Duo's OIDC-based universal prompt with a redesigned UI that redirects users to Duo for authentication.
Duo Security has phased out Web v2 SDK, so it is recommended to switch to Web v4 SDK, which features the new Universal Prompt.
Prerequisites
Add the API hostname and admin console (e.g., https://admin-325d33c0.duosecurity.com) as a trusted site or intranet site in the users' machine if they are using older versions of Internet Explorer.
Please follow these steps in the Duo Admin Panel to migrate from Web v2 SDK, which uses the traditional prompt, to Web v4 SDK, which employs the new Universal Prompt.
Web v4 SDK configuration steps
Note: It is required to have a secure connection to set up the Web v4 SDK authentication. Please make sure that you have enabled HTTPS connection.
Go to Applications and click Protect an Application.
Search for Web SDK and click Protect.
Copy the Client ID, Client secret, and API hostname values.
In Log360, navigate to Admin > Logon Settings > Two-Factor Authentication > Duo Security.
Check the Enable Duo Security box and select Web v4 SDK for Integration Type.
Paste the Client ID, Client secret, and API hostname obtained from the Duo Admin Panel in the respective fields.
Enter the same username pattern used in Duo Security in the Username Pattern field.
Click Save.
Steps to migrate to the new Universal Prompt
In the Duo Admin Panel, select the Web SDK application, which was previously configured for Log360, and copy the Integration key, Secret key and API hostname values.
Scroll down to the Universal Prompt section. The App Update Ready message will be displayed, indicating that Universal Prompt can now be activated for Log360.
In Log360, navigate to Admin > Logon Settings > Two-Factor Authentication > Duo Security.
Click Web v4 SDK and paste the Integration key, Secret key, and API hostname values in the Client ID, Client Secret, and API Host name fields respectively.
Once the Web v4 SDK is configured in Log360 and a user authenticates through the frameless Duo v4 SDK, the App Update Ready message in Duo Admin Panel will be updated and the New Prompt Ready message will be displayed.
Select Show new Universal Prompt to activate the universal prompt for Log360.
RADIUS Authentication
Remote Authentication Dial-In User Service (RADIUS) is an industry standard client/server authentication protocol that enhances security by protecting networks from unauthorized access.
RADIUS based two-factor authentication for Log360 can be configured in just two simple steps.
Configuration Steps:
Step 1: Integrate RADIUS with Log360
Log in to RADIUS server.
Navigate to clients.conf file.(/etc/raddb/clients.conf).
Add the following snippet in the clients.conf file.
Enter the IP address or the name of the RADIUS server.
Enter the port number for RADIUS authentication.
Select the protocol used for RADIUS authentication from the drop-down list.
Provide the security key that was added to the clients.conf file in RADIUS server.
Set the RADIUS user name pattern.
Set a duration for authentication request time-out duration.
Click Save Settings.
Note: Username Pattern is case sensitive. Please make sure you select the exact pattern (uppercase or lowercase) you use in your RADIUS server.
Microsoft Authenticator
Administrators can add Microsoft authenticator as an additional factor for verifying identities during login.
Configuration Steps:
Click Enable Microsoft Authenticator.
Click Save Settings.
Once enabled, users can enroll themselves for two-factor authentication using the Microsoft Authenticator app when they log in to the application.
Custom TOTP Authenticator
In addition to the authenticators mentioned above, you can also add a custom TOTP authenticator as a means of verifying identities, provided the application satisfies the following criteria:
The application can provide passcodes of varying lengths (6, 7, or 8 characters).
The application supports any password hashing algorithm that Log360 utilizes (SHA1, SHA256, and SHA512).
Configuration steps:
Select Enable Custom TOTP Authenticator.
Enter the name of the authenticator application.
Select the Passcode Length and the Passcode Expiration Time from the available options.
Select the Password Hashing Algorithm of the TOTP authenticator.
Provide the format in which the username will be displayed in the authenticator.
Select the logo of the authenticator. The supported formats for the image are PNG, JPG, JPEG, BMP, and GIF. Please ensure the dimensions of the logo does not exceed 45x45 pixels and the size is less than 2MB.
Click Save.
Note: If the values for the passcode hashing algorithm, passcode expiration time, or the passcode length fields are modified, the user enrolment data for the configured custom TOTP authenticator will be deleted. The enrolment data will also be deleted when this configuration is disabled.
Once enabled, users can enrol themselves for two-factor authentication using the Custom TOTP Authenticator when they next log in to Log360.
Backup Verification Codes
Backup verification codes allow users to log in when they don’t have access to their phone or face issues with one of the second-factor authentication method. When enabled, a total of five codes will be generated. A code once used will become obsolete and cannot be used again. Users also have the option to generate new codes.
Enabling backup verification code
To enable backup verification code, put a check against the Backup Verification Code box.
Registering for backup verification code
Once enabled, users will be notified to configure their codes when they log in to Log360. On clicking Configure Now, they will be taken to the two-factor authentication settings page.
Users need to click the Manage Backup Verification Codes link to view the codes.
Users can also download the codes as a text file, print them, get it delivered to their personal email address, or generate new codes.
Using the backup verification code to login
To use backup verification codes during login, users need to click the Use backup verification codes link in the second-factor authentication page.
In the backup verification code page, they need to enter one of their backup verification codes and click Verify Code to login.
Managing users for two-factor authentication
As an admin, you can view which authentication method users have enrolled for and remove users’ enrollment for two-factor authentication using the Manage Users option.
To do so, follow the steps below:
Under the Two-factor Authentication tab, click Enrolled Users.
In the TFA Enrolled Users pop up, you can view the list of users enrolled for two-factor authentication and the authentication method they have chosen.
To remove a user, select the user and click the Delete icon.
To personalize two-factor authentication method for domain users
Domain users enrolled for two-factor authentication can modify their preferred authentication method and manage trusted browsers by following the steps below:
Go to the My Account profile icon at the top left corner.
Select the Two Factor Authentication option.
To modify authentication mode, click Modify Authentication mode.
To manage trusted browser, click Manage Trusted Browsers.
Click here to expand
Download PDF