Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

SafeNet Agent for Windows Logon

User choice of authenticator and FIDO authentication

search

Please Note:

User choice of authenticator and FIDO authentication

  • User choice of authenticator (UCA): UCA allows users to select from their available authentication methods during Windows logon. When a user signs in, they are presented with a list of the authentication methods they have enrolled in SafeNet Authentication Service Private Cloud Edition (SAS PCE).

Note

To disable UCA, set the value of the DisableUCA registry key to 0. For more information, see Registry settings.

  • FIDO authenticators: SAS PCE leverages FIDO (Fast IDentity Online) standards to provide secure, simplified passwordless and multi-factor authentication (MFA) for enterprises. This integration helps minimize password-related risks, prevent phishing attacks, and enhance the overall user experience.

  • Platform-based authenticators such as Windows Hello, Device Bound Passkeys, and biometric sensors are not compatible.

  • Remote Desktop Protocol (RDP), outgoing RDP connections, and Credential User Interface (CredUI) operations are not supported.
  • The FIDO authenticator does not support offline authentication.

You must configure FIDO before users can use the FIDO authentication.

Note

FIDO authentication is only available when UCA is enabled.

System requirements

To use the UCA and FIDO feature, the following requirements must be met:

Client-side requirements

  • Agent File and Encryption Key File

Supported authentication tokens

All OTP-based authenticators currently supported by SafeNet Trusted Access (STA). For example, MobilePASS+, GrIDsure, FIDO, and hardware tokens.

Server-side requirements

Note

During step 8 of the FIDO server deployment (applicable to both Docker and Podman deployments), you must add the following entries to tenants-config.yaml.

The sae block is the existing entry in the file. Add your SAE issuer URL as a new sibling entry under issuers:, as shown below.

Replace https://your-sae-url/realms/your-realm-name with your actual SAE issuer URL. Replace all <<Update Me>> placeholders with the Key ID and Key Value obtained from the Operator Realm setup for FIDO.

tenants:
  operator:
    issuers:
      sae:
        issuer_type: internal
        jwt:
          max-validity-secs: 900
          clock-tolerance-secs: 2
        key-ids:
            "<<Update Me>>":
              key-value: "<<Update Me>>"
              algos: RS256
              roles-retained:
                enable-verification: false
      "https://your-sae-url/realms/your-realm-name":
        issuer_type: internal
        jwt:
          max-validity-secs: 900
          clock-tolerance-secs: 2
        key-ids:
            "<<Update Me>>":
              key-value: "<<Update Me>>"
              algos: RS256
              roles-retained:
                enable-verification: false
  • API Gateway

Note

We have provided the sample configuration of API gateway with KrakenD that you can use as a reference.

On this page