topic Re: Enabling 2 Factor for specific user group in SASE and Remote Access

Enabling 2 Factor for specific user group

Mithu — Sun, 04 Jul 2021 08:48:45 GMT

Hi, Currently we are maintaining local users to log in to Remote VPN client, customer wants to enable two factor (Dynamic ID with third party SMS provider) for specific users only. Is it possible to enable for specific user group with dynamic ID?

Re: Enabling 2 Factor for specific user group

the_rock — Sun, 04 Jul 2021 16:30:57 GMT

I had been wondering exact same thing for a while now, so Im glad you posted this question...lets see if we can get a confirmation.

Re: Enabling 2 Factor for specific user group

MartinTzvetanov — Mon, 05 Jul 2021 07:03:15 GMT

You select the login scheme before entering the username, so it's not possible to configure different login schemes for different groups.

Re: Enabling 2 Factor for specific user group

Ruan_Kotze — Mon, 05 Jul 2021 08:08:35 GMT

This is my understanding as well, the scope of DynamicID is the gateway or cluster object, not user or groups.

Re: Enabling 2 Factor for specific user group

Benedikt_Weissl — Mon, 05 Jul 2021 13:22:45 GMT

You can use multiple authentication settings per gateway. Edit the gateway or cluster object, VPN Clients, Authentication, "multiple authentication client settings", create profiles for the different authentication factors.

Re: Enabling 2 Factor for specific user group

Ruan_Kotze — Mon, 05 Jul 2021 13:25:06 GMT

Correct, however OP wants to do different authentication schemes per user / group. For example Group A - Username & Password, Group B - Username & Password + SecureID.

Re: Enabling 2 Factor for specific user group

MartinTzvetanov — Mon, 05 Jul 2021 13:25:30 GMT

and how will you set profile 1 to be for user group1 and profile2 for group2?

Re: Enabling 2 Factor for specific user group

Benedikt_Weissl — Mon, 05 Jul 2021 13:36:35 GMT

You can change the authentication profile during site creation or afterwards

Re: Enabling 2 Factor for specific user group

MartinTzvetanov — Mon, 05 Jul 2021 13:39:27 GMT

The point is the GW to force me to use this profile based on my user/group, not what I configured when creating the site.

Re: Enabling 2 Factor for specific user group

Benedikt_Weissl — Mon, 05 Jul 2021 15:54:51 GMT

OP didn't mention anything about the gateway enforcing this. He just wants to enable DynamicID for specific users. This is possible by changing the site for those users and then setting "predefined_sites_only" to true via the gateways ttm file.

Re: Enabling 2 Factor for specific user group

MartinTzvetanov — Tue, 06 Jul 2021 08:02:50 GMT

What if you use SNX?