How to enable Zoho OneAuth TOTP for MFA?
In enterprise networks, user identity verification is no longer carried out simply through usernames and passwords. This is because without additional authentication layers, i.e., multi-factor authentication, enterprise networks and resources become easy prey to credential-based attacks. This is why, in the current technological landscape, multi-factor authentication has become a mandatory part of every organization's authentication system.
A time-based one-time-passcode (TOTP) is a prevalent authentication method used for MFA. Zoho OneAuth, a multi-factor authenticator solution, offers a mobile-based TOTP authenticator for social and enterprise accounts. When implemented, the Zoho OneAuth OTP authenticator generates verification codes every 30 seconds, and users will have to enter the verification code within that time to complete authentication. In combination with credentials and other authentication methods such as biometrics, the TOTP authenticator proves to be a viable barrier against unauthenticated access.
Achieve holistic enterprise MFA with Zoho OneAuth
ManageEngine ADSelfService Plus supports the Zoho OneAuth OTP authenticator as a method to implement MFA during enterprise application logins along with:
- Local and remote Windows, macOS, and Linux logins.
- Microsoft Outlook Web Access and Exchange logins.
- Self-service password reset and account unlock.
Furthermore, implementing enterprise MFA with ADSelfService Plus provides the following benefits:
- Granular configuration: Implement MFA using particular authenticators for users belonging to specific groups, OUs, and domains.
- Adaptive MFA: The solution offers provisions to heighten, relax, or skip MFA during authentication based on IP address, time of access, geolocation, and device used.
- Detailed audit reports: Gain comprehensive insights on user activities such as identity verification failures and login attempts, and find users with weak passwords.
- Ensure 100% enrollment: Automate user enrollment by importing users' domain information through CSV files or force enrollment using login scripts.
How to configure MFA using Zoho OneAuth in ADSelfService Plus
Prerequisites:
- SSL must be enabled: Log in to the ADSelfService Plus web console with admin credentials. Navigate to Admin → Product Settings → Connection. Select the ADSelfService Plus Port [https] option. Refer to this guide to learn how to apply a SSL certificate and enable HTTPS.
- Access URL must be set to HTTPS: Navigate to Admin > Product Settings > Connection > Connection Settings > Configure Access URL and set the Protocol option to HTTPS.
- Endpoint MFA: Your ADSelfService Plus license must include Endpoint MFA. Visit the store to purchase the feature. (Applicable to MFA for machine and OWA logins)
- Install the ADSelfService Plus login agent: Click here to install the ADSelfService Plus login agent for Windows, macOS, and Linux on the machines where you want to enable MFA. (Applicable to MFA for machine logins)
Steps to configure:
- Navigate to Configuration → Self-Service → Multi-factor Authentication → Authenticators Setup.
- From the Choose the Policy drop-down, select a policy.Note: ADSelfService Plus allows you to create OU- and group-based policies. To create a policy, go to Configuration → Self-Service → Policy Configuration → Add New Policy. Click Select OUs/Groups and choose the OUs or groups to which you want to apply the policy. You need to select at least one self-service feature. Finally, click Save Policy.
- Click Zoho OneAuth TOTP.
- Click the Enable Zoho OneAuth TOTP button.
Enable Zoho OneAuth TOTP-based MFA for enterprise application logins
- Go to Configuration → Self-Service → Multi-factor Authentication → MFA for Applications.
- Select a policy from the Choose the Policy drop-down.
- In the MFA for Cloud Applications section, check the box next to Enable __ authentication factors, select the number of authentication methods, and select Zoho OneAuth TOTP along with any other configured authenticators from the drop-down.
- Click on the asterisk (*) next to the authentication method to set it as mandatory. You can also reorder the authenticators.
- Click Save Settings.
Enable Zoho OneAuth TOTP-based MFA for OWA
- Go to Configuration → Self-Service → Multi-factor Authentication → MFA for Endpoints.
- Click the Choose the Policy drop-down and select a policy. This will determine which authentication methods are enabled for which sets of users.
- In the MFA for OWA Login section, check the box next to Enable __ authentication factors, select the number of authentication methods, and select Zoho OneAuth TOTP along with any other configured authenticators from the drop-down.
- Click on the asterisk (*) next to the authentication method to set it as mandatory. You can also reorder the authenticators.
- Click Save Settings.
Step 2: Install the ADSelfService Plus MFA Connector
The Internet Information Services MFA extension must be installed in Exchanger Server to enable MFA for OWA and Exchange admin center logins. It triggers the request for the completion of other authentication factors after the primary password authentication is successful.
- Go to Configuration → Self-Service → Multi-factor Authentication → MFA for Endpoints.
- Navigate to MFA for OWA and click on the help icon.
- Download the ADSelfService Plus MFA Connector from the pop-up that appears.
- Copy the extension file (AdsspOWAIISModule.zip) to the Windows server that you have configured as the Exchange server. Extract the ZIP file’s content and save it in any location.
- Open PowerShell (x64) as an administrator and navigate to the folder where the content of the extension files is located.
- Execute the following command: PS C:\> .\setupIISMFAModule.ps1 Install
New to ADSelfService Plus?
Related Articles
How to enable offline MFA in ADSelfService Plus
ManageEngine ADSelfService Plus supports offline multi-factor authentication (MFA) for Windows machine logins, User Account Control (UAC) prompt elevation, and Remote Desktop Protocol (RDP) server authentication when the product server is ...Multi-factor authentication techniques in ADSelfService Plus
Let's take a look into the various authentication methods supported by ADSelfService Plus for enterprise multi-factor authentication (MFA). Why should you use MFA? Authentication based solely on usernames and passwords is no longer considered secure. ...Configuring TOTP authentication for Active Directory-based actions
Time-based one-time-password or TOTP is one of the most common methods used in multi-factor authentication (MFA). With this method, users are required to enter a passcode within a specific time from its generation. When users prove their identity in ...Configuring the ADSelfService Plus login agent for machine MFA and password self-service in Linux
Securing data and resources on the corporate network is of paramount importance to organizations. In a world where most corporate attacks originate at an endpoint, ADSelfService Plus offers 20 MFA factors to protect endpoints by allowing access only ...Enable biometric, QR code, push notification, and TOTP based verification for self-service password reset
Solution ADSelfService Plus supports multi-factor authentication (MFA) to verify and secure the identity and access of users. The ADSelfService Plus mobile app verifies the identities of users through the following authentication methods: Fingerprint ...