Skip to main content

Manage password authenticators

There are two types of password authenticators in IDaaS: IDaaS passwords and Active Directory (AD) passwords.

Use this page to understand how each password type is validated, which policy controls apply, and when to use password-based authentication in resource rules.

IDaaS passwords​

IDaaS passwords are manually or automatically assigned to users on IDaaS.

Active Directory (AD) passwords​

Active Directory (AD) passwords are passwords that have already been assigned to a user on their corporate directory and not through IDaaS. AD password authentication requests are sent from IDaaS to the password agent on the gateway. The password agent uses the password entered by the user to authenticate that user with AD.

  • Active Directory passwords can be used to authenticate to an application depending on the resource rule of the application. Users with AD password can have an IDaaS password assigned to them. However, during authentication, the password used by the user is checked against their Active Directory account.
  • AD passwords can be used to log in the same way that an IDaaS password is used. The user enters their AD password when prompted by IDaaS to log in to their account or application.
  • Updates to passwords synchronized from a directory are reflected in IDaaS after directory synchronization occurs.
  • The password restrictions set out by the password authenticator settings do not impact the AD passwords that can be used.
note

Configure RADIUS resource rules based on how you want Active Directory (AD) passwords to be validated:

  • If your VPN server validates AD passwords directly, configure the VPN server for direct AD authentication and set External Authentication as the First Factor in the IDaaS resource rule.
  • If you want IDaaS to validate AD passwords, set Password as the First Factor in the resource rule.

Password security​

The plaintext password from the client is passed to IDaaS using TLS 1.2+ to protect it with the exception of RADIUS clients configured to use MSCHAPv2 where a hash of the password is passed instead.

If the password to be authenticated is managed in your directory​

  • The plaintext password is passed from IDaaS to your Enterprise Service Gateway. The password is protected in transit using TLS 1.2+.
  • The agent on the Gateway validates the password by attempting an LDAP authentication request against your directory. The directory connection can be configured to use LDAPS.

If the password to be authenticated is managed in IDaaS​

  • Passwords in IDaaS are stored either as a PBKDF2-derived value or as a cleartext password value. A cleartext password value is required when you use MSCHAPv2 with RADIUS. In both cases, the IDaaS database is encrypted with per-tenant encryption keys.
  • The password is validated by IDaaS.

For both password authentication management in your directory or in IDaaS, the authentication response is processed in IDaaS and the authentication result is returned to the client.

Multiple passwords​

IDaaS supports multiple passwords, called Named Passwords, and each can have its own policy. The default password is IDaaS-managed for unsynchronized users. For synchronized users, AD and LDAP passwords are managed in the directory. Unsynchronized users can also have IDaaS-managed Named Passwords.

For example, a bank user has multiple passwords:

  • A password to use the ATM
  • A password for online (web) banking

Each password has a different policy. The online banking password must be at least 12 characters long and can contain any type of character. The ATM password is 4 characters long and only contains numeric digits.

In this example, the user needs two different passwords—one for ATM and one for online banking, each with different policy settings.

Password functionality​

The password functionality available to administrators is based on their system-defined role, as described in the following table:

Name of rolePassword functionality available
Auditor
  • View-only access to existing passwords and configured password settings.
  • Assign passwords to their own account from the User Portal.
Super Administrator
  • Complete control over the passwords assigned to users (including their password history).
  • Modify the password authenticator settings and the resource rules that define when passwords are used.
Issuance Administrator
  • Complete control over the passwords assigned to IDaaS Issuance users (including their password history).
  • Modify the password authenticator settings and the resource rules that define usage.
Issuance OperatorCan only reset their own password.
Help Desk Administrator
  • Manage passwords assigned to other user accounts (including clearing the password history).
  • Cannot modify the password authenticator settings or resource rules related to them.
User-defined roles
  • Password functionality available depends on the settings of each role.
  • Click the name of a user-defined role to determine the level of password functionality available.

Topics in this section​