Authentication

Configuring push notification for Active Directory--basedbased actions

Push notification is a method of authentication which involves users receiving an alert on their mobile devices. When push notification is configured as a multi-factor authentication (MFA) method, users need to have a push notification app installed on their mobile devices. During authentication, they provide their account credentials following which they receive a push notification via the app. When they accept the notification, they are authenticated. Push notification is one of the more secure methods of authentication since it does not involve entering passcodes. Also, with push notification, users have the option of denying the push notification if they have not initiated the authentication process and can take action against the attempted breach. Push notifications are also quick as they only involve a tap of a finger.

Active Directory-based user actions like domain logins, password changes, self-service password resets and self-service account unlocks are sensitive activities that require more than the default username and password (or just username in case of password resets!). MFA ensures that users verify their identity at multiple levels, using methods like push notifications that do not involve credentials. This helps prevent attacks like phishing and brute force.

If admins do not prefer employing push notification alone and need to include additional methods of authentication like SAML authentication, and fingerprint authentication, then ADSelfService Plus is the right solution. ADSelfService Plus, an Active Directory self-service password management and single sign-on solution, in a one-stop product that includes self-service password resets and account unlocks that can be secured by any of the 15 supported MFA methods. Some of them are push notification, Google Authenticator, YubiKey Authenticator, and RSA SecurID.

Besides Active Directory self-service actions, ADSelfService Plus also employs MFA during:

1. Windows, macOS, and Linux logins.
2. Enterprise application logins through single sign-on (SSO).
3. Self-update of Active Directory profile information, subscription to mail groups, and employee search using ADSelfService Plus.

Push notification for MFA in ADSelfService Plus can be enabled with minimal steps

1. Navigate to Configuration → Self-Service → Multi-factor Authentication → Authenticators Setup.
2. From the Choose the Policy drop-down, select a policy.

   Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy. Only users belonging to OUs and groups included in the policy can perform the self-service feature(s) selected.

3. Click the Push Notification Authentication section.
4. Select Enable Push Notification Authentication.

   

Note:

1. Users need to download the ADSelfService Plus iOS or Android mobile app to use this authentication technique.
2. This is a device-based enrollment. If users install the app on another device, they need to enroll again.
3. If a user performs a self-service password reset or account unlock from a mobile site, users cannot use Push Notification Authentication to prove their identity.

Enable push notification for Active Directory password resets

1. Go to Configuration → Self-Service → Multi-factor Authentication → MFA/TFA Settings. Go to MFA/TFA Settings. In the MFA for Reset/Unlock section, enter the number of authentication factors to be enforced, and select Push Notification Authentication along with the other authentication techniques to be used.
2. Click Save Settings.

Enable push notification for Active Directory domain logins

1. Go to Configuration → Self-Service → Multi-factor Authentication → MFA/TFA Settings. In the Endpoint MFA section, select Push Notification Authentication from the drop-down.
2. Enable the Bypass TFA if ADSelfService Plus is down option.
3. Click Save Settings.

Note:

To enable MFA for Active Directory domain logins:

• The ADSelfService Plus login agent must be installed on client machines. Click here for steps on login agent installation.
• SSL must be enabled: Log in to the ADSelfService Plus web console with admin credentials. Navigate to the Admin tab → Product Settings → Connection. Select the ADSelfService Plus Port [https] option.

Learn more about ADSelfService Plus and its Multi-factor Authentication feature.