Configuring QR code-based authentication for Active Directory-based actions
QR code-based authentication is a type of multi-factor authentication method that involves scanning a QR code with an app in order to verify one's identity. When authenticating into a service using MFA, users need to provide their account credentials upon validation of which a QR code will be displayed. Users simply need to scan this code using the authentication app on their mobile device. As scanning the code takes mere seconds making this a quick and simple method, it is widely employed for a variety of identity verification applications.
A much-needed implementation of QR-code based MFA would be during the Active Directory user actions. By default, domain logins and self-service actions like password reset and account unlock only require users to enter their domain account credentials. Including QR-code based authentication provides a boost of security that is essential during such sensitive actions. A perfect solution would be a product that features self-service actions like password reset, account unlock, and directory self-update that are secured by QR-code based authentication and other MFA methods.
ADSelfService Plus, an Active Directory self-service password management and single sign-on solution, is one such product. Its MFA feature secures not just self-service actions but also:
- Windows, macOS, and Linux logins.
- Enterprise application logins through single sign-on (SSO).
- Self-update of Active Directory profile information, subscription to mail groups, and employee search using ADSelfService Plus.
QR code-based authentication for MFA can be enabled with minimal steps in ADSelfService Plus
- Navigate to Configuration > Self-Service > Multi-factor Authentication > Authenticators Setup.
- From the Choose the Policy drop-down, select a policy.
Note: ADSelfService Plus allows you to create OU and group-based policies. To create a policy, go to Configuration > Self-Service > Policy Configuration > Add New Policy. Click Select OUs/Groups, and make the selection based on your requirements. You need to select at least one self-service feature. Finally, click Save Policy. Only users belonging to OUs and groups included in the policy can perform the self-service feature(s) selected. - Click QR Code-based Authentication section.
- Select Enable QR Code-based Authentication.
Enable QR code-based authentication for Active Directory password resets
- Go to Configuration → Self-Service → Multi-factor Authentication → MFA for Reset/Unlock.
- In the MFA for Reset/Unlock section, enter the number of authentication factors to be enforced, and select QR Code Based Authentication along with the other authentication techniques to be used.
- Click Save Settings.
Enable QR code-based authentication for Active Directory domain logins
- Go to Configuration > Self-Service > Multi-factor Authentication > MFA for Endpoints. In the MFA for Machine Login section, select QR Code Based Authentication from the drop-down.
- Click Save Settings.
Note: To enable MFA for Active Directory domain logins:
- The ADSelfService Plus login agent must be installed on client machines. Click here for steps on login agent installation.
- SSL must be enabled: Log in to the ADSelfService Plus web console with admin credentials. Navigate to the Admin > Product Settings > Connection. Select the ADSelfService Plus Port [https] option.
New to ADSelfService Plus?
Related Articles
Multi-factor authentication techniques in ADSelfService Plus
Let's take a look into the various authentication methods supported by ADSelfService Plus for enterprise multi-factor authentication (MFA). Why should you use MFA? Authentication based solely on usernames and passwords is no longer considered secure. ...Configuring Microsoft Authenticator for Active Directory-based actions
Microsoft Authenticator is an authentication method developed by Google that uses a time-based one-time-passcode (TOTP) in order to verify users' identities. It is often used as one of the multi-factor authentication (MFA) methods along with others ...Configuring MFA for FTD VPN using RADIUS
This guide provides steps for enabling multi-factor authentication (MFA) using RADIUS for Cisco's Firepower Threat Defense (FTD) product using ManageEngine ADSelfService Plus' MFA for VPN feature. To enable RADIUS-based authentication for Cisco FTD, ...Configuring RADIUS authentication for Active Directory-based actions
Traditional logins to resources on an organizational network involve only a username and password. However, if all the data breaches in recent years teach us anything, it is that they are not sufficient. Multi-factor authentication (MFA) has become ...Configuring TOTP authentication for Active Directory-based actions
Time-based one-time-password or TOTP is one of the most common methods used in multi-factor authentication (MFA). With this method, users are required to enter a passcode within a specific time from its generation. When users prove their identity in ...