NIOS 2-Factor Authentication

[#1]

Your enterprise has implemented two-factor authentication for all access to computer systems.  In a nutshell, two-factor authentication is something you know and something you have.  The ‘something you know’ can be a password.  The ‘something you have’ can be a token card or a certificate.  A cyber criminal would need both to gain access.  Knowing the password is not enough.

You can configure NIOS to use the two-factor authentication method to authenticate users based on X.509 client certificates. In two-factor authentication, NIOS first negotiates SSL/TLS client authentication to validate client certificates. It then authenticates the admins based on the configured authentication policy. You must first configure an authentication policy, and then configure and enable the certificate authentication service for the two-factor authentication to take effect. NIOS uses certificate authentication service as the authentication policy.

Prerequisites

• (Optional) OCSP (online certificate status protocol) responder.
• Microsoft Active Directory server with Certificate Authority.

Please consult with your PKI (public key infrastructure) expert on the certificates.

Authentication data flow for 2-factor authentication on the Infoblox appliance

1. The client workstation issues an HTTPS request to the FQDN or IP address of the Infoblox appliance.
2. The Infoblox appliance sends a certificate request to the client.
3. Optionally, the certificate on the client is sent to the Infoblox appliance.
4. Infoblox appliance then sends the public part of the certificate to the OCSP responder to determine certificate validity.
5. If successful, the Infoblox appliance will generate a nuance (i.e. random bits of characters) and encrypt that with the public part of the certificate.
6. The Infoblox appliance will send that nuance to the client to decrypt.
7. If the client decrypts the nuance and sends the decrypted nuance back to the Infoblox appliance and is matched up successfully, then that proves the client has the exact public and private key.
8. The Infoblox appliance will use a user group lookup against the Active Directory server.
9. Depending upon the attribute passed in the certificate (i.e. SAN, subject alternate name) account name or SAN UPN (user principle name) passed to the Active Directory server.
10. The Infoblox appliance talks with the Active Directory server via a service account.
11. Authentication successful.

Setting up 2 factor authentication on NIOS appliances

1. Log into the Infoblox GUI.
2.  

• 
  Navigate to Grid à Grid Manager à Toolbar à Certificates à Manage Certificates.

3. Click on the ‘+’ button to upload the certificates from the Certificate Authority chain.
4. If different from step 3, upload the OCSP CA chain from your OCSP responder.
5.  

• 
  Navigate to Toolbar à Grid Properties à Edit à DNS Resolver.

6. Click on the button to enable DNS resolver.
7. Click on the ‘+’ button to add the IP address of the Active Directory server.
8. Click Save and Close.
9.  

• 
  Navigate Administration à Authentication Server Groups à Active Directory Services.

10. Hit the ‘+’ to add an entry.
11. Enter the name of the Active Directory Service.
12. Enter the name of the Active Directory Domain.
13.  

• 
  In the Domain Controllers section, click on the + button to add a server. Use the fully qualified domain name of the server.

14. Change the encryption to SSL.
15. Click on the ‘test’ button. If it is successful, click on the ‘add’ button.
16. Click ‘Save and Close’.
17. Navigate to Certificate Authentication Services.
18.  

• 
  Click on the ‘+’ button to add Certificate Authentication Service.

19. Add a name for the service.
20. Uncheck Username/password request.
21. Click on the button to Enable remote lookup for user membership.
22. In Authentication service, add the name of the active directory service.
23. Add the username that was created in AD server for the Infoblox appliance to log into the AD server. The username is a service account. The service account user needs to be able to search the user attributes to get the member of objects.
24. Click on Next.
25.  

• 
  Click on the ‘+’ button to add and an OSCP responder IP address. In this example, the OCSP Check Type is set to manual. However, you most likely will use AIA and manual, defining some local OCSP responders and using AIA from the user’s certificate.

26. Enter the port number that was configured on the OCSP server. This port number would come from your PKI (public key infrastructure) expert.
27. Add the certificate for the OCSP server if you want to use the test button.
28. Click on the test button.
29. If successful, click Add.
30. Click Next.
31.  

• 
  Click on the ‘+’ button to add the CA certificates from the certificate store that will used to authenticate users.

32. Click save and close.
33. Navigate to Administration à Administrators à Authentication Policy.
34.  

• 
  Click on the ‘+’ in Authenticate users section.

35. Click on the Certificate Authentication Service button.
36. Choose the Authentication Server Group that was created before.
37. Click the Add button.
38. You should get a message stating 2-factor authentication enabled.

The last thing that needs to be done is to install your certificate onto your browser.  Please consult your PKI expert to install certificates onto your browser.

Summary

Many network enterprises and service providers are implementing 2-factor authentication to increase security access to applications.  This blog shows how the 2 factor authentication data flow works between the Infoblox appliance and OCSP responders and/or Microsoft Active Directory servers.  In addition, the steps to configure 2-factor authentication on the Infoblox appliance are documented in this blog.