Authentication
Authentication is the process of verifying the identity of a user. Typically, this requires the user to make a claim about their identity by entering their username and password.
Enrollment
Users are required to enroll with Specops Authentication. The enrollment process will vary for each type of identity service.To enroll with a personal identity service such as Google, users will need to follow the link from the Specops web application to the Google web page, and log in with the email address and password associated with their Google account.
Multi-factor authentication
Multi-factor authentication requires more than one method of authentication from independent categories of credentials: something you know (i.e. password), something you have (i.e. Mobile device), and something you are (i.e. Fingerprint). Specops uReset goes beyond two-factor authentication by supporting a broad range of identity services that can be used to increase security and flexibility. The solution not only supports common authenticators, such as questions and answers, and mobile verification codes, but also various digital identity services ranging from personal identity services (e.g. LinkedIn) to company identity services (e.g. salesforce.com), in addition to higher trust methods such as Smart Cards. The Specops multi-factor authentication model is dynamic. Users can choose which identity services they want to combine for enrollment and authentication, as long as they meet the requirements of the policy. Users enrolled with more identity services than required for their authentication will have authentication choice. This guarantees that end-users will always have the ability to satisfy the authentication policy, even if an identity service is unavailable (e.g. not having their mobile phone nearby).
Administrators can select, based on role and security policy, which identity services/authenticators they want to extend to end-users to verify their identity when resetting or unlocking their accounts. Such flexibility can ensure that varying security and flexibility needs are met. For example:
- For users that have a low-level security clearance, but a high flexibility need, such as students, IT admins can allow them to authenticate with a few personal identity services such as their Google ID.
- For users that have a higher level security clearance, such as financial aid administrators or senior level executives, IT admins can assign policies that enforce a higher number, or a stronger combination of identity services. This approach provides administrators with the flexibility they need to enforce policies that translate to greater security and efficiency.
Policy
A policy contains the rules required for enrollment and multi-factor authentication. A policy controls what identity services can be used, and how many must be used to verify the identity of end-users. The system administrator is responsible for configuring the rules in the policies.
Identity services
Identity services enable users to securely identify themselves when signing in. Identity services fall into multiple categories, including: username and password, social ( LinkedIn, Tumblr), and higher trust ( Google Authenticator, Microsoft authentic, Duo Security Security).
To use various identity services to authenticate users, the identity service must be configured (enabled) in Authentication Web, and the user affected by the policy must enroll with the identity service. Once a user has enrolled, they can use the identity service to authenticate. Specops Authentication uses data from user objects in Active Directory to read and write information used in the system.
- Duo
- Mobile Code
- Specops:ID
- Yubikey
Standard
- Specops:ID: this is an app that allows users to use their mobile device's biometrics (fingerprint, facial recognition etc.) to authenticate.
- Mobile Code (SMS): Users will receive a one-time six-digit password via an SMS message, which must be entered in order to successfully authenticate.
3rd Party
- Duo Security: With Duo Security, users can authenticate using the Duo Security mobile app.
- Yubikey: The Yubikey is a hardware authentication device. Users can authenticate by generating One Time Passwords (OTP) with their Yubikey (only if the Yubikey supports Yubico OTP as a security function). For more information on Yubikey, refer to the Yubikey page.