AuthLite Interactive Documentation
Home
Contents
CLOSE
AuthLite Interactive Documentation
Quick Start: Install and protect Domain Admins AuthLite Features Supported Tokens
How AuthLite uses YubiKeys
Installation and Upgrading
What platforms are supported? Prerequisites and Installation Linux systems MacOS machines
Configuration
Licensing AuthLite Set up User Groups
Configuring AuthLite to use your Group Pairs
Setting up the "Group for New Users"
Enforce 2-factor Logons
Use Group Policy to enforce 2-factor on Windows servers/workstations Secure Administrative Accounts with 2-factor Authentication Enforce 2-factor on File Shares using Access Control Lists (ACLs) Permit 1-factor Network Access to a Server Partial enforcement of a server (e.g. Exchange) with "Forced 2-factor Processes" Enforce non-Windows machines with "Forced 2-factor Computers" Enforce 2-factor logon to Office 365 with AuthLite LDAP logon support/enforcement
Windows Workstation (Endpoint) Protection
Cached (Offline) Workstation logon with YubiKeys Cached (Offline) Workstation logon with OATH tokens Zero-client two-factor workstation logons Workstation Safe mode operations
Remote Desktop
2FA over Remote Desktop Protocol 2FA with Remote Desktop Gateway / RemoteApp / RDWeb / RD Web Client
Replay Windows to support RDP and other re-authenticating protocols Replay Behavior setting VPN and RADIUS Configuration
Using IAS/NPS for RADIUS with AuthLite Microsoft VPN Client settings Wireless 802.1x Authentication DirectAccess and NetMotion Mobility XE Configure Watchguard SSL VPN with AuthLite
2FA for File Shares Active Directory Deployment Notes
Token Management
First: Configure Token Settings Provisioning Tokens Administratively
YubiKeys (Soft) OATH Tokens (Hardware) OATH Tokens OnlyKeys
User Self-Service
"Enroll in AuthLite" Windows program SET UP the Self-Service Web Portal USING the Self-Service Web Portal
View/Edit Existing Tokens Delegate Token Management Recovery Tokens Multiple OTP Tokens for the Same User Multiple users with the same OTP Token Password Operations
How to Log In Troubleshooting
CLOSE

Cached (Offline) Workstation logon with YubiKeys

Windows workstations typically permit cached logon when the machine is away from the LAN.  This is what is meant by "Offline", rather than referring to anything about a connection to the Internet (which AuthLite never needs).

A randomly-generated challenge/response secret is associated to each YubiKey, and gets programmed into a YubiKey's second identity slot. This option is called “support offline logins” in the admin UIs, and “AuthLite Challenge/Response” in the Key Programmer app.  The Windows "Enroll in AuthLite" UI automatically sets up keys this way (no option needed).

The HMAC-SHA1 challenge/response is checked before letting the user log in. For normal online logons, this challenge/response secret is retrieved from the domain controller and synchronized to the workstation. It is not necessary for the YubiKey to be plugged in directly to the workstation (it can operate as a remote keyboard e.g. with RDP or virtual machines).

During cached logons, the AuthLite software communicates directly with the plugged-in YubiKey to do the challenge/response procedure. Any (properly programmed) YubiKey that was assigned to the user at the time they last logged in to this workstation on the LAN will also be able to log in with cached mode.

Ramifications for YubiKeys

Programming YubiKeys to support AuthLite offline logons will “use up” both identity slots in the YubiKey, and destroy any other (old) information that was previously loaded onto the key.

  1. The first identity slot will contain the one-time passcode identity for entering OTPs as keystrokes. This identity is triggered each time the gold contact on the key is pressed. The OTPs generated can be used to log in to any AuthLite-aware system or network.1

  2. The second identity slot will contain a challenge/response secret that gets automatically used by AuthLite when logging in to workstations that are offline from the domain.

---

1Provided the intermediate software supports long enough username/password values. AuthLite OTPs are normally 64 characters. They can be programmed shorter but will in all cases be at least 34 characters long (that shortest length would support a maximum of 255 keys in your whole domain.)