Login when the network is unavailable

You can log in to the system with an authenticator even without a physical network connection. Logging in with a cached authenticator is similar to logging in with an authenticator when the network is available.

To configure login when the network is unavailable:

1. Configure session caching with group policies or in the registry.
2. Enable caching and configure the authenticator validity period in Management Console.
3. Configure the session storage period in the cache.

Prerequisites

Login when the network is unavailable is possible in the following cases:

• Your account has been granted permission to cache authenticators.
• Authenticators were cached at the first login to the system with an authenticator.
• A login with a cached authenticator was performed while the network was available.

Configure session caching

When there is no connection to Core Server, users can authenticate in Windows Logon in the offline mode. For this, a session cached on the user computer is used.

To configure login with a cached session, use the Session public key settings policy.

In registry

1. Open Registry Editor on the computer.
2. Open Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID\AM\CacheServer.
3. Create the SessionPublicKey string parameter.
4. Set the parameter to the value of the public key generated during the Core Server installation. You can find the public key value in the SessionPublicKey.pub file or in the Core Server Web.config configuration file, in the sessionEncryptionSettings section, in the publicKey parameter.
5. Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Axidian-ID.
6. Create the ServerAvailability section in it.
7. In this section, create three parameters of the DWORD type:
   • IsEnabled with the value 1
   • CheckResultTtlMs with the required check result lifetime value in ms
   • CheckWaitTimeoutMs with the required check result waiting timeout value in ms

In Group Policy Editor

1. Add the AxidianID.SessionPublicKey.admx policy file from the Axidian Access <version number>\Misc\ADMX Templates folder to the computer with Core Server and Windows Logon installed.
2. Open Group Policy Editor.
3. Open Computer Configuration → Administrative Templates → Axidian ID → Cache server.
4. Enable the Session public key settings policy.
5. In the policy properties, in the Session public key field, enter the value of the public key generated during the Core Server installation. You can find the public key value in the SessionPublicKey.pub file or in the Core Server Web.config configuration file, in the sessionEncryptionSettings section, in the publicKey parameter.
6. Go to Computer Configuration → Administrative Templates → Axidian ID → Client Connection.
7. Enable the Axidian EA\ESSO server availability check policy.
8. In the policy parameters, set the values for the Check result waiting timeout (ms) and Check result lifetime (ms) settings.

Enable caching and configure the authenticator validity period

You can enable caching and set the validity period of cached authenticators in the application settings of a policy or a user in Management Console. If the validity periods are not specified, caching is valid indefinitely.

If the Number of days parameter is set for cached authenticators, their validity period is counted from the time of the last login to Windows Logon with the network available, using any authenticator except Windows Password.

For example, if the period is set to 10 days and the login was performed at 10:00 on 12.04.2025, the cached authenticators are valid from 10:00 on 12.04.2025 until 10:00 on 22.04.2025.

If the validity period of cached authenticators has expired and Core Server is unavailable, the following message appears when you try to log in: Login error. The user data caching period has expired.

Configure the session storage period in the cache

For short-term connection losses to Core Server, you can configure the period during which the session can be reused.

During the specified period, the session is stored in the cache and can be reused when a new server connection is requested. The server availability check is not repeated; the cached check result is used instead.

After the storage period expires, the session is terminated. A new session is created at the next server connection request.

To configure the session storage period in the cache:

In registry

1. Open Registry Editor.
2. Open Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Axidian-ID\SrvLocator2.
3. For the SessionHoldPeriodMs parameter of the DWORD type, set the required value. The default value is 180,000 ms (3 minutes).

In Group Policy Editor

1. Open Group Policy Editor.
2. Open Computer Configuration → Administrative Templates → Axidian ID → Client Connection.
3. Enable the Server connection settings policy.
4. In the policy properties, set the required value for the Session object hold period (ms) parameter. The default value is 180,000 ms (3 minutes).