Software

Ask something
Discussion Locked

"Token" based authentication in Windows Environment

0 helpful
12 replies

by dumphrey

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Anyone have any experience with this type of system? I would love to be able to set up usb "tokens" for each employee, so as to remove the need for complex passwords. I could keep the recovery key (copies of the tokes) in an encrypted vault.
I guess what I am looking for is a system of generating public/private keys for use in authenticating users in a win2k3 environment. Preferably by putting them on a usb key which is checked for on boot. For all I know, this may already be part of IAS...
Anyone have any experience they would like to share or pointers on more reading?
My current "budget" does not allow for a commercial product, so I may be SOL.

12 replies

by andre.j.hawkins

Sounds like the USB approach might be tricky, especially if your customers are far flung and forgetful (complex passwords). Then there's the question of what happens if the tokens fall into the wrong hands. Are you thinking about some sort of 2-factor authentication that requires at least some small password?

by kumar.jeff

There is a new class of token-less 2-factor coming along. As an example, check out https://www.phonefactor.com/terminalservices from phonefactor

by brian.samuela

A few limits, like number of apps you can support and number of users. We upgraded but even the paid version isn't that expensive.

by andre.j.hawkins

We tried it, experimenting with the free version for terminal services. Trying to sell the management team on why we should role it out a little more broadly...

by brian.samuela

WEll, one of your requirements is token-less, and that's your argument IMHO. Cost to manage tokens can be substantial. Physical purchase, management, training can be substantial. Let your management try that on for size.

by bwilliams

Anakam has a token-less solution that resides in your environment that leverages multiple channels to get the second factor to the end-users. Meets all of the applicable federal guidelines.

by andre.j.hawkins

W/ Phonefactor consider that your user manages hardware, while you don't manage tokens or certificates. Self-serve is a beautiful thing that saves you money and headache.

by nimmo

Take a look here we have been using these for a while now.

http://www.authanvil.com/

by kumar.jeff

The higher the number of remote users, the more it makes sense to avoid tokens. If you think of OWA as an app to be accessed by every single employee, that can probably add up pretty quick. The good thing about these solutions (like PhoneFactor) is it can scale much more easily.

by brian.samuela

Yep, that plus the fact that OWA essentially pre-supposes that mail will be accessed on non-controlled PC's. BTW, the free PhoneFactor agent for OWA allows for any number of users.

by nimmo

The tokens we use are only in effect when accessing the server directly either or via a remote desktop applications. However RWW is effected because once again you are accessing the systems directly.

This discussion is closed to new replies.