Identity Services
Specops Secure Service Desk works on a principle of pre-enrollment. This means for the most part that user enrollment occurs by defining attributes in Active Directory. However, if you use Secure Service Desk with other Specops products, such as Specops uReset, the identity services defined in those policies can be used for Secure Service Desk as well.
To use various identity services to authenticate users, the identity service must be configured (enabled) in the administration console, and the user affected by the uReset policy must enroll in the uReset service. Once a user has enrolled, service desk agents can use the identity services in the policy to verify users’ identity.
The following identity services can be used to authenticate users in Specops uReset:
Standard
- Specops Fingerprint:Specops Fingerprint enables users to enroll and authenticate using devices with fingerprint scanners, such as smart phones and tablets. Users can press their finger to the fingerprint scanner on their device to instantly identify themselves. Users can also use Face ID to authenticate, if they own an iPhone X and above. In order to use this identity service, users must have the app installed on their mobile device.
- Specops Authenticator: Users can authenticate using the Specops Authenticator app. Users scan a QR code or enter a secret. Specops Authenticator then provides users with a six-digit one-time password, which must be entered in order to successfully authenticate.
- Mobile Code (SMS): Users will receive a one-time six-digit password via an SMS message, which must be entered in order to successfully authenticate.
- Email: the user’s email is used as an identity service by sending a code to the registered email address that the user then has to input in the field on screen. Email does not require enrollment, since it references the email address in the email attribute in AD (or any other attribute if it is overridden); it can only be used with domains associated with Specops Authentication.
- Personal Email: the user’s email is used as an identity service by sending a code to the registered email address that the user then has to input in the field on screen. Personal Email has to be registered at enrollment by the user and they may use any email address of their choosing.
- Trusted Network Locations:Trusted Network Locations is an identity service that allows administrators to designate certain IP ranges as Trusted Network Locations.
- Manager Identification: When a user authenticates using Manager Identification, an email or SMS message is sent to their manager. Their manager must then approve the authentication request. Administrators can customize the notification that is sent, by adding custom information to the request notification. To make use of Manager Identification, each user must have a manager assigned to them in Active Directory, and manager accounts must have an email address/mobile phone number associated with their profile in order to receive authentication requests from users.
- Secret Questions: Users can select questions from a predetermined list and specify the answers to them. They must then answer these questions in order to authenticate successfully.
3rd Party
- Duo Security: With Duo Security, users can authenticate using the Duo Security mobile app.
- Okta: Users can enroll and authenticate using their Okta account credentials.
- Symantec VIP: Users can authenticate using the Symantec VIP mobile app.
- Google Authenticator:Google Authenticator is an app that generates one-time passwords. A secret is generated and presented in the form of a QR code that the user scans. Google Authenticator then provides users with a six-to-eight-digit one-time password, which must be entered in order to successfully authenticate.
- Microsoft Authenticator:Microsoft Authenticator is an app that generates one-time passwords. A secret is generated and presented in the form of a QR code that the user scans. Microsoft Authenticator then provides users with a six-to-eight-digit one-time password, which must be entered in order to successfully authenticate.
- EFOS/SITHS (Sweden):EFOS/SITHS is a smart card-based authentication service, which enables employees (such as medical professionals) of authorities, municipalities, and county councils in Sweden to electronically identify themselves.
- Mobile BankID (Sweden): If users have the Mobile BankID app, they can use this to verify their identity.
Federated
- Google: Users can enroll and authenticate using their Google account credentials.
- Facebook: Users can enroll and authenticate using their Facebook account credentials.
- Microsoft Live: Users can enroll and authenticate using their Microsoft Live account credentials. Microsoft Live credentials are used to sign in to the Microsoft Cloud, including: Outlook, Office Online, OneDrive, Skype, Xbox Live, and the Microsoft store.
- Tumblr: Users can enroll and authenticate using their Tumblr account credentials.
- Twitter: Users can enroll and authenticate using their Twitter account credentials.
- Flickr: Users can enroll and authenticate using their Flickr account credentials.
- LinkedIn: Users can enroll and authenticate using their LinkedIn credentials.
Policy
A policy contains the rules required for enrollment and multi-factor authentication. A policy controls what identity services can be used, and how many must be used to verify the identity of a user. The system owner is responsible for configuring the rules in the policies.
Note that policies for Secure Service Desk only apply to service desk agents, not to users. End users need to be pre-enrolled with all associated identity services in order to be able to verify their identity.
