AuthLite Interactive Documentation
Quick Start: Install and protect Domain Admins AuthLite Features Supported Tokens Installation and Upgrading Configuration Token Management How to Log In Troubleshooting

Windows workstations typically permit cached logon when the machine is away from the LAN.  This is what is meant by "Offline", rather than referring to anything about a connection to the Internet (which AuthLite never needs).

A randomly-generated challenge/response secret is associated to each YubiKey, and gets programmed into a YubiKey's second identity slot. This option is called “support offline logins” in the admin UIs, and “AuthLite Challenge/Response” in the Key Programmer app.  The Windows "Enroll in AuthLite" UI automatically sets up keys this way (no option needed).

The HMAC-SHA1 challenge/response is checked before letting the user log in. For normal online logons, this challenge/response secret is retrieved from the domain controller and synchronized to the workstation. It is not necessary for the YubiKey to be plugged in directly to the workstation (it can operate as a remote keyboard e.g. with RDP or virtual machines).

During cached logons, the AuthLite software communicates directly with the plugged-in YubiKey to do the challenge/response procedure. Any (properly programmed) YubiKey that was assigned to the user at the time they last logged in to this workstation on the LAN will also be able to log in with cached mode.

Ramifications for YubiKeys

Programming YubiKeys to support AuthLite offline logons will “use up” both identity slots in the YubiKey, and destroy any other (old) information that was previously loaded onto the key.

  1. The first identity slot will contain the one-time passcode identity for entering OTPs as keystrokes. This identity is triggered each time the gold contact on the key is pressed. The OTPs generated can be used to log in to any AuthLite-aware system or network.1

  2. The second identity slot will contain a challenge/response secret that gets automatically used by AuthLite when logging in to workstations that are offline from the domain.


1Provided the intermediate software supports long enough username/password values. AuthLite OTPs are normally 64 characters. They can be programmed shorter but will in all cases be at least 34 characters long (that shortest length would support a maximum of 255 keys in your whole domain.)