5.3. RADIUS with OneTouch Scenario Setup

Home Prev	EasyAccess 4.3 Getting Started Guide	Next

This section describes how a OneTouch authentication scenario is configured. The Clavister OneTouch product is a downloadable app that allows authentication of a connection to a NetWall firewall as an additional factor to username and password credentials. Authentication with username and OneTouch only, without a password, is possible and is discussed separately in Section 6.7, Passwordless Federation Authentication.

A link is established once between the OneTouch app and the EasyAccess server. When the user then needs to be authenticated later, EasyAccess pushes a message to the app asking for confirmation of the login. The user sends a confirming message back to EasyAccess with a single button press. EasyAccess then completes authentication of the connection.

The setting up of the OneTouch scenario involves the following steps:

A. Create the global OneTouch configuration object in Easy Access.

B. Create a RADIUS OneTouch scenario.

C. Enroll users for OneTouch. This is done by the administrator using the WebUI or by the users themselves through self service.

The steps in the above list will now be described in detail.

A. Create the global OneTouch configuration object

A OneTouch object needs to be created. There can only be a single global OneTouch object created for each EasyAccess installation and this will be automatically associated with any OneTouch scenario that is created. Go to Scenarios > System and select the add button next to One Touch.

Figure 5.14. Create the Global OneTouch object

An EasyAccess guide now opens that will collect the required data for OneTouch in a series of steps. The first guide step allows the issuer name to be specified. This name will be displayed by the OneTouch client.

Figure 5.15. Specify the OneTouch Issuer

The next guide step allows the external URL to be specified. This will be used as a prefix for building callback URLs for use by the One Touch client for both activation and fetching assignments. The URL may be the actual endpoint of the EasyAccess server but can also be a logical endpoint redirected to the actual server by a firewall or reverse proxy. Using such redirection is recommended.

The URL prefix should be chosen with care since this value cannot be changed for activated clients. HTTPS should be used as the URL protocol.

Figure 5.16. Specify the External URL Prefix

The next guide step asks if push notifications should be enabled. This would normally by activated. If it is not activated then OneTouch will work but the client device will not receive notifications that the OneTouch app has received an assignment. If the feature is not activated here it cannot be switched on later by the administrator or in the self service function.

Figure 5.17. Enable Push Notifications

In the final guide step, select Create to save the scenario.

Figure 5.18. Save the OneTouch Configuration

B. Create a RADIUS OnTouch scenario

To create the scenario go to Scenarios > RADIUS and then press the plus button on the scenario called Username, password and OneTouch.

Figure 5.19. Add RADIUS with OneTouch Scenario

A guide will now open to gather the required data for this scenario. In the first guide step, specify a suitable name for this scenario along with an optional description.

Figure 5.20. RADIUS with OneTouch Scenario - Name and Description

In the next guide step, select a user store. In this example, the LDAP store created in Chapter 4, LDAP Server Setup will be selected. It is also possible to select the Create new option to create a user store connection on the fly.

Figure 5.21. RADIUS with OneTouch Scenario - User Store Selection

Now, specify a filter to find the user. In this case, it is enough to use the username. The Search base defines the root on the LDAP server where the users are found.

Figure 5.22. RADIUS with OneTouch Scenario - LDAP User Filter

The RADIUS connection to use is now specified next. This determines the RADIUS requests that EasyAccess will listen for. In this example, the connection defined in Section 5.1, Basic RADIUS Scenario Setup is selected. Alternatively, a new RADIUS connection could be specified on the fly by selecting Create new.

Figure 5.23. RADIUS with OneTouch Scenario - RADIUS Selection

The next guide step allows the acceptable IP addresses of connecting RADIUS clients to be specified. In addition the shared secret password that the client needs can be specified along with an optional Attribute Selector. The attribute selector is used if different authentication methods can be chosen. For example, a valid value might be 44=SMS.

Figure 5.24. RADIUS with OneTouch Scenario - RADIUS Client Filter

In the next guide step, select Create to save the scenario.

Figure 5.25. Create RADIUS Token Scenario

The EasyAccess server is now ready to accept authenticating RADIUS connections. It will be automatically associated with the OneTouch configuration that was created in step A.

C. Enroll users for OneTouch

Enrolling users for OneTouch can be done in one of the following ways:

Users can enroll themselves using the self service function. The self service function must be enabled for this and this is discussed further in Chapter 8, Self Service Setup.
The administrator can enroll users through the EasyAccess WebUI. This is discussed next.

To enroll users in the EasyAccess WebUI, go to Scenarios > Applications > One Touch Enrollment and press the plus button.

Figure 5.26. OneTouch User Enrollment

An EasyAccess guide will open to collect the data required. The first step asks for a user store that contains users.

Figure 5.27. OneTouch Enrollment - User Store Selection

Specify the search settings for the user store. The search base is the search starting point in the directory tree. It can be entered manually or selected by using the Choose option. Searching is done using the scope "SUB". This value is mandatory, with LDAP DN as the required syntax.

The attribute used to identify users (such as uid, email or samaccountname) must also be specified.

Figure 5.28. OneTouch Enrollment - User Search Settings

Specify if push notifications are to be enabled. These are used for notifying users of pending assignments and are normally enabled.

Figure 5.29. OneTouch Enrollment - Enable Push Notifications

In the final guide step, select Create to save the enrollments.

Figure 5.30. OneTouch Enrollment - Saving

After saving the OneTouch configuration, the object parameters are presented and can be edited. Some parameters can be changed that could not be set in the guide. For example, the OneTouch connection URI value can be changed.

Figure 5.31. OneTouch Enrollment - URI Value

Regardless how enrollment is done, users themselves must still create a link between their tOneTouch app installation and EasyAccess. If the OneTouch URI is left as the default value of activateonetouch then this is done by the user opening the following URL in a web browser.

	https://<EasyAccess-server-DNS-name>:8443/activateonetouch

Note that the URI must begin with the "/" character and it must be unique within the EasyAccess instance.

Under the Tokens tab, the maximum number of allowed tokens for a user can be specified. Leaving this field blank means the number is unlimited.

Figure 5.32. OneTouch Enrollment - Maximum Tokens

When all changes are complete, press the Save link and the EasyAccess server will restart with the changes applied.

Figure 5.33. OneTouch Enrollment - Save Configuration

After installing the OneTouch app and either being enrolled by the administrator or enrolling through self service, the user can now initiate connection to the OneTouch URI and link the app to EasyAccess.