Two-factor Authentication

To strengthen user logon security, AD360 supports two-factor authentication. Once enabled, AD360 will require users to authenticate using one of the authentication mechanisms below in addition to the Active Directory credentials whenever they log in.

Setting up 2-factor authentication

Log in to AD360 as an administrator.
Navigate to Admin → Administration → Logon Settings.
Click the Two-factor Authentication tab.
Toggle the Two-factor Authentication switch to the ON position.
Select the authentication methods of your choice from the list provided.

Note:
- If multiple authentication options are enabled, then the user will be asked to choose one at the time of logging in.
- Make sure you configure the authentication option you’ve chosen by entering all the required details. Click here for the steps.
Click Save Settings.

Email Verification

When this option is selected, AD360 sends a verification code via email to the user’s email address. The user has to enter the verification code to successfully login.

Configuration steps:

Configure mail server settings if not done already.
Enter a Subject for the email.
Enter the Message in the box provided.
Set the priority as per your requirement.
Click Macros link at the bottom to insert them in the email message.
Once you are done, click Save Settings.

Once enabled, users will be asked to enroll for two-factor authentication by entering their email address during login.

SMS Verification

When this option is selected, AD360 sends a verification code via SMS to the user’s mobile number. The user has to enter the verification code to successfully login.

Configuration steps:

Configure SMS server settings if not done already.
Enter the Message in the box provided.
Click Macros link at the bottom to insert them in the SMS.
Once you are done, click Save Settings.

Once enabled, users will be asked to enroll for two-factor authentication by entering their mobile number during login.

Google Authenticator

Google Authenticator adds an extra layer of protection to the reset password/unlock account process. Once enabled, users will be required to enter a six-digit security code generated by the Google Authenticator app for identity verification.

Configuration Steps:

Just click Enable Google Authenticator
Click Save Settings.

Once enabled, users can enroll themselves for two-factor authentication using the Google Authenticator app.

RSA SecurID

RSA SecurID is a mechanism developed for performing two-factor authentication for a user to a network resource. Users can use the security codes generated by the RSA SecurID mobile app, hardware tokens, or tokens received via mail or SMS to log in to AD360.

Configuration steps:

Log in to your RSA admin console (e.g., https://ad360-rsa.testdomain.com/sc).
Go to Applications. Under Authentication Agents, Click Add New.
Add AD360 Server as an authentication agent and click Save.
Go to Access. Under Authentication Agents, click Generate Configuration File.
Download AM_Config.zip (Authentication Manager config).
Extract sdconf.rec from the ZIP file.
In AD360, under RSA SecurID configuration, click Browse and select the sdconf.rec file.
Click Save Settings.

Once enabled, users will be asked to

Duo Security

Duo Security is a two-step verification service that provides additional security while accessing applications. Users can use the six digit security codes generated by the Duo mobile app or push notification to log in to AD360.

Configuration Steps:

Log in to your Duo Security account (e.g., https://admin-325d33c0.duosecurity.com) or Sign up for a new one and login.
Go to Applications. Click Protect an Application.
Search for Web SDK. Click Protect this Application.
Copy the Integration key, Secret key, and API hostname to AD360.
Click Save Settings.

Note: Please make sure you select the exact username pattern you use in Duo Security.

Note: If you are using older versions of Internet Explorer, then add the API hostname (e.g., https://api-325d33c0.duosecurity.com) and admin console (e.g., https://admin-325d33c0.duosecurity.com) as a trusted or intranet site.

RADIUS Authentication

Remote Authentication Dial-In User Service (RADIUS) is an industry standard client/server authentication protocol that enhances security by protecting networks from unauthorized access.

RADIUS based two-factor authentication for AD360 can be configured in just two simple steps.

Configuration Steps:

Step 1: Integrate RADIUS with AD360

Log in to RADIUS server.
Navigate to clients.conf file.(/etc/raddb/clients.conf).
Add the following snippet in the clients.conf file.

client AD360ServerName
{
ipaddr = xxx.xx.x.xxx
secret = <secretCode>
nastype = other
}
Restart RADIUS server.

Step 2: Configure AD360 for RADIUS

Select RADIUS Authentication option.
Enter the IP address or the name of the RADIUS server.
Enter the port number for RADIUS authentication.
Select the protocol used for RADIUS authentication from the drop-down list.
Provide the security key that was added to the clients.conf file in RADIUS server.
Set the RADIUS user name pattern.
Set a duration for authentication request time-out duration.
Click Save Settings.

Note: Username Pattern is case sensitive. Please make sure you select the exact pattern (uppercase or lowercase) you use in your RADIUS server.

Managing users for two-factor authentication

As an admin, you can view which authentication method users have enrolled for and remove users’ enrollment for two-factor authentication using the Manage Users option.

To do so, follow the steps below:

Under the Two-factor Authentication tab, click Manage Users.
In the TFA Enrolled Users pop up, you can view the list of users enrolled for two-factor authentication and the authentication method they have chosen.
To remove a user, select the user and click the Delete icon.

To personalize two-factor authentication method for domain users

Domain users enrolled for two-factor authentication can modify their preferred authentication method and manage trusted browsers by following the steps below:

Go to the My Account profile icon at the top left corner.
Select the Two Factor Authentication option.
To modify authentication mode, click Modify Authentication mode.
To manage trusted browser, click Manage Trusted Browsers.