Breadcrumbs

RAEP - Overview

VeridiumID for Active Directory enhances the security of Windows client machines by integrating Multi-Factor Authentication (MFA) methods, such as TouchID (iPhone), Fingerprint (Android), and Veridium 4 Fingers TouchlessID, with primary authentication through Microsoft Active Directory. This solution supports both physical and virtual domain-joined desktops and laptops, providing a robust and user-friendly authentication experience.

The following diagram illustrates the basic architecture of VeridiumID Active Directory Integration:

image-20230324-124529.png


Component Descriptions:

  • Credential Provider (Windows Plugin):

    • This Windows plugin allows users to authenticate using VeridiumID's various authentication methods. It integrates seamlessly with the Windows login process.

  • Veridium Mobile App:

    • The mobile application enables authentication through QR code scanning, push notifications, or Time-based One-Time Passwords (TOTP).

  • VeridiumID Server:

    • This is the core component of the VeridiumID solution.

    • It manages security configurations, the database, and controls each authentication session.

    • Hosted on Linux and typically placed in a Demilitarized Zone (DMZ), it is accessible both internally and externally.

    • It requires connectivity to Active Directory (LDAP) to retrieve user information.

  • Veridium EP (Enrollment Proxy):

    • This component is responsible for enrolling device certificates to domain-joined computers.

    • During startup, the computer requests a device certificate through the bopslogonservice.

    • Veridium EP verifies the request and forwards it to the internal Certificate Authority (CA) on the VeridiumID Server.

    • The resulting certificate is used by the Credential Provider to authenticate calls to the VeridiumID Server.

  • Veridium RA (Registration Authority):

    • This component facilitates communication with the Microsoft CA.

    • After successful authentication on the VeridiumID Server, the Credential Provider requests the Veridium RA to enroll a user certificate.

    • The certificate is enrolled by the Microsoft CA.

    • The resulting user certificate is presented to the Domain Controller to authenticate the user.

Workflow Summary:

  1. User Authentication: Users initiate a login attempt on their Windows client machine.

  2. Credential Provider Interaction: The Credential Provider prompts the user for authentication using VeridiumID methods.

  3. Mobile App Authentication: Users authenticate using the Veridium mobile app (QR, push, TOTP).

  4. VeridiumID Server Validation: The VeridiumID Server validates the authentication.

  5. Device Certificate Enrollment (EP): The Veridium EP enrolls a device certificate for the client machine.

  6. User Certificate Enrollment (RA): The Veridium RA enrolls a user certificate from the Microsoft CA.

  7. Domain Controller Authentication: The user certificate is presented to the Domain Controller for login.

Key Benefits:

  • Enhanced Security: Multi-factor authentication strengthens security by requiring multiple verification methods.

  • Improved User Experience: Passwordless and biometric authentication options simplify the login process.

  • Seamless Integration: VeridiumID integrates smoothly with existing Active Directory infrastructure.

  • Flexible Deployment: Supports both physical and virtual desktop environments.

Important Considerations:

  • Ensure proper network connectivity between all components.

  • Configure appropriate firewall rules to allow necessary communication.

  • Maintain up-to-date versions of all VeridiumID components.