Skip to main content

MFA

Authentication parameter settings​

Important

The policy must be applied to all Core Servers and to all client machines.

  1. Open Registry Editor.
  2. Open the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\BSPs\MFA section.
  3. Create the BSPChain parameter of the REG_MULTI_SZ type and specify the identifiers of the authentication providers to be used in the chain. Specify each identifier in curly brackets and on a new line, without spaces or other characters.
List of supported providers for Windows Logon and Enterprise SSO
SMS OTP {EBB6F3FA-A400-45F4-853A-D517D89AC2A3}
Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}
Software OTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
Windows Password {CF189AF5-01C5-469D-A859-A8F2F41ED153}
Z2 USB {CB5109DA-B575-422C-8805-524FE12B02F5}
Futronic {A0EF00AD-1EEB-4D48-8BCF-06E19CD5585F}
smart card or USB token {0AF65AD8-DB77-4B64-B489-958D9B36E28C}
HID OMNIKEY {4B15AF52-A795-4CA6-B7CD-CDB8ABF2D2C2}
Axidian Key {DEEF0CB8-AD2F-4B89-964A-B6C7ECA80C68}
Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
Secured TOTP {F15FD7EC-19EA-4384-846E-A2D0BE149FA2}
List of supported providers for NPS RADIUS Extension
Hardware OTP {AD3FBA95-AE99-4773-93A3-6530A29C7556}
Hardware TOTP {CEB3FEAF-86ED-4A5A-BD3F-6A7B6E60CA05}
Secured TOTP {F15FD7EC-19EA-4384-846E-A2D0BE149FA2}
Software TOTP {0FA7FDB4-3652-4B55-B0C0-469A1E9D31F0}
Windows Password {CF189AF5-01C5-469D-A859-A8F2F41ED153}
Passcode {F696F05D-5466-42b4-BF52-21BEE1CB9529}

  1. Create the MFADeviceName parameter of the REG_SZ type and specify the name for the created chain.

    Information

    This value is displayed in the name of the MFA device for the user and in the system events.

RADIUS Extension policy settings​

When integrating with the RADIUS Extension module, the MFA authentication method is called One-string authenticator. With this multifactor authentication method, users are provided with a single field for entering all factors. Each authentication factor is entered into the input field in one line, with or without a separator.

OTP length​

Allows you to set the one-time password length if no separator is used in the provider chain. If the policy is enabled, the one-time password is separated from the permanent password by defining the number of characters in the password. The specified length is applied to all one-time password providers in the chain.

  1. Open Registry Editor.
  2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius\MFA section.
  3. Create the OTPLen parameter of the REG_DWORD type and specify the value that matches the value in the One-time password length policy (the value 6 or 8).

Separator character​

Allows you to set the character that separates the authenticators. Any single character can be used as a separator: digits, lowercase and uppercase Latin and Cyrillic letters, special characters (including the space).

Important

If the authenticator already contains the separator character, the user must duplicate the separator character when entering it in the form. For example, the authenticator is password\example and the one-time password is 395816. The following must be entered in the input form: password\\example\395816.

Information

If both the OTP length and the Separator character policies are enabled, the Separator character policy takes priority.

  1. Open Registry Editor.
  2. Open or create the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\Radius\MFA section.
  3. Create the Separator parameter of the REG_SZ type and specify the character that separates the permanent password and the one-time password.

Support for smart card policies​

If the chain contains providers such as Smart Card Provider, IronLogic Z2USB Provider, or OMNIKEY Provider, the Smart card removal behavior and Timeout of the action performed on smart card removal policies are supported.