Configure User Access and IdP User Settings

Keycard plugin provides capability to configure settings with which you can control users' access to devices where users can be Identity Providers or otherwise. This article explains the settings.

1. In Keycard configuration window, navigate to Keycard Settings on the left panel.
   

General Settings  

1. Allow Local User Login: Select an option to specify whether existing local users can log in, or if access should be restricted to local administrators or specific local users. Choose one from the following options in drop-down:
   
   1. Do not allow: Does not allow local user to login. This option will be visible if you are an IdP user.
   2. Enrolled User: Only the enrolled user can login to the device
   3. All Accounts (default): All the user accounts can login
   4. Administrator Accounts: The users belonging to Administrator are allowed to login. 
   5. Specify User Accounts: Specify the user accounts with which users can login. On selecting this option, a grid will be displayed where you need to enter Local user short names which have been previously configured, from the Device details > User Accounts section on Scalefusion Dashboard. You can search for a particular user which will populate list of users created. To add more than one user, click on New User link. If users are not configured (do not exist in UAM section), they can be configured from this section. Custom properties are also supported for configuring local users.
      
2. Compliance Check Frequency: Select a frequency to check whether the device is compliant with the conditions specified under Conditional Accessfor logged in user accounts. The frequency can be selected from one of the following:
   1. High: The compliance check is performed every 5 minutes. Selecting 'High' impacts the battery and device performance as the checks run very frequently. 
   2. Medium: The compliance check is performed every 30 minutes. 
   3. Low: The compliance check is performed every 60 minutes.
      
3. Automatic FileVault Login: If this setting is toggled on, it will bypass the Keycard login window. The users will get the FileVault login screen to login to the device. Important Points to note for this setting:
   1. FileVault should be enabled
   2. It is supported only on Apple Silicon devices
   3. If you have provided any conditional checks, those will be performed post login only
   4. Automatic FileVault login will automatically login a user only if the user is allowed to login based on local account settings of Keycard.
      
      
4. Save the account passwords locally: If this is enabled, the keycard will securely store the user's account password. As a result, during subsequent password sync operations, the system will validate whether the stored password matches the remote account password. If a password mismatch is detected, it will automatically get updated.
   On enabling this setting, for the first time, user will have to manually sync the password on the device by clicking on Sync Now inside Scalefusion MDM Client window > Settings or at the time logging in on the device.
   
   

How User settings work on device

Taking an example, if you have allowed local user login for All accounts, and pushed the configuration, then on the device you will get a list of all the local users. Select a user and enter password to login to the machine. This is also referred as offline login because you don't need internet access to login.

IdP User Settings

These settings are configurable if one of the following conditions are met:

• The account with which you have logged in on Scalefusion Dashboard, is an IdP account (Google Workspace / Microsoft Entra/ OneIdP / Okta / PingOne / OnPrem AD)  
  
  For OnPrem AD, the OPC setup should be done on Scalefusion Dashboard
• You have created a Directory in OneIdP (with custom and/or default domain) 
  Also, the users should be existing under User Enrollment section on Scalefusion Dashboard.
  
  Here are the settings:

1. New User Account Type: For a new user account created on the device, you can select the new user's account type whether it will be Standard or Administrator. The user should be existing in the User Enrollment section on Scalefusion Dashboard.
2. Password Sync: Synchronizes the remote account password with local account password after specified number of days to make sure that local account password and remote account password are the same. By default it is set to 3 days and can be selected anywhere between 1 to 30 days. 
3. Password Sync Reminder: This will notify user to complete sync password activity. Specify a time limit (in hours) and user will be notified to sync password within that timeframe. Reminder time can be set anywhere from 0 to 72 hours. Also, the users will not get logged off to perform the online login, the reminder window is shown to them to complete login.
   
   For example, if you have selected password sync frequency as 1 day, the following prompt will display on device when user tries to login with local user credentials.
   

Account Security Settings

Configure lockout rules to protect accounts against brute-force login attempts during offline logins. 

Number of failed attempts to lock local accounts and IdP based accounts during offline login: Select the threshold of incorrect password or login attempts (3, 4, 5, or 6 attempts) allowed before the account is temporarily locked. Select Not Required to disable account locking. 

• Unlock account after configured duration (in mins): Specify the duration (10, 15, 20, or 30 minutes) the account remains locked after reaching the maximum allowed      failed attempts.

How IdP user settings work on the device

When you push Keycard configuration on the device with IdP user settings configured, you need to enter IdP credentials to login. This is also referred as online login.

1. Taking an example of an account configured in google workspace, following will be the default screen in case of online login. Enter your email address on the login screen and click on the right arrow.
   
2. The next screen will be from google for authentication. Enter your credentials (email address and password) and click on Allow on the next screen
   
3. Once authenticated, a new user account will be created on the device with the user type (Standard or Administrator), as selected in the New User Account type in IdP User Settings, with which you can login on the device next time. The user will also be added in Device details > User accounts section.
   1. If a local user with the same username already exists on the device, then it will get linked to the existing user present on the device. Hence, it is up to the discretion of IT admins whether to have a new user created on the device or not. If they want a new user to be created then the username in User Enrollment section should be different from the users already existing on the device.
      
      
4. Local login: Local users can login to the device (offline) by entering their Username and password. On the default login screen, an additional link Local Login is there. Click on it and enter credentials.

Two Factor Authentication

Traditional login methods often rely solely on stored credentials, such as passwords or cached tokens, which can be vulnerable to misuse if a device is lost or compromised. To enhance user authentication and reduce the risk of unauthorized access, implementing a one-time password (OTP) requirement for offline login provides an added layer of verification. This approach not only strengthens security by requiring users to verify their identity through an additional factor but also ensures that only the legitimate user can access the system, even without an active internet connection.

With these options, you can now enforce users to enter an OTP from the Scalefusion Authenticator app from a managed mobile device (Android or iOS) or a 3rd party authenticator app during offline and online login in the Keycard login screen.

Pre-requisites

1. The user must have at least one managed device with the Scalefusion Authenticator app installed or access to a third-party authenticator app that can generate the required OTP. 
2.  The user(s) must be migrated to OneIdP.
3. Ensure that the Directory settings are configured to enable Multi-factor authentication

Enabling Two-Factor Authentication

1. Navigate to OneIdP > Keycard > click on Edit.
2. Go to Keycard settings > scroll down to the Two-Factor Authentication section.
3. Following are the settings:
   1. Select Platforms where MFA should be Enforced: Select the operating systems (Windows and/or macOS) where the MFA-specific settings will be applied when this configuration is assigned to a group or profile. The settings below become configurable only after at least one platform is selected.
      
      1. Enforce Two-Factor Authentication using an OTP or a grid pattern for online logins: Enable this setting to require users to complete two-factor authentication (2FA) by entering a One-Time Password (OTP) when signing in through your configured Identity Provider (IdP). Users can generate the OTP using any of the following: 
         1. Scalefusion Authenticator app 
         2. Any supported third-party authenticator application (such as Google Authenticator or Microsoft Authenticator). 
         3. OTP on phone  
         4. OTP from another managed device
         5. Grid pattern
      2. Enforce Two-Factor Authentication using an OTP for offline logins: Enable this setting to require users to enter a One-Time Password (OTP) when performing an offline login, ensuring an additional layer of authentication even when the device is not connected to the internet. Users can generate the OTP using either the Scalefusion Authenticator app or any supported third-party authenticator application. Access is granted only after the OTP is successfully verified.
      3. Configure Additional MFA options:Enable to configure additional MFA options for Keycard based logins.

         1. Allow users to configure & use Grid based pattern:Allows the user to setup a pattern using a Grid. On subsequent logins, users enter characters as per their secret pattern.

            This is not a secure method and should be used only for the cases where users already don't have access to other MFA option.

         2. Allow users to use Grid Pattern only on Desktop devices: This setting will enforce Grid authentication only on desktop devices, and not on laptops or virtual machines.
            Grid authentication is enforced only on desktop devices and bypassed on laptops and virtual machines (VMs). If this setting is disabled, Grid authentication applies to all desktops, laptops, and VMs.

         3. Configure minimum length for Grid based pattern: Choose between 6, 8, 10, or 12 characters.

         4. Enforce users to to configure additional PIN: Require an additional PIN (4, 5, or 6 Digits) before entering the Grid pattern.

4. Click on Update.
   
   
   

User experience for Offline Logins

A. User(s) have a managed mobile device with the Scalefusion Authenticator app installed

1. Once the setting is successfully applied to the device, the user(s) may see the following message when they try to log in locally on the device.
   
2. They will be asked to complete an online login to synchronize the settings with the device.
3. If the user(s) already have a managed mobile device (Android or iOS) with the Scalefusion Authenticator app installed, they can use the OTP from that device for their next local login.
   

B. User(s) do not have a managed mobile device with the Scalefusion Authenticator app installed

1. Once the setting is successfully applied to the device, the user(s) may see the message (as shown above in point 1)when they try to log in locally on the device.
2. They will be asked to complete an online login to synchronize the settings with the device.
3. In this case, where the user(s) don't have a managed device, they can set up a 3rd party authenticator app on their device.
4. However, for this to work, you will have to enable the option "Enable MFA using third-party authenticator app" in Directory Settings.
   1. Navigate to OneIdP > Directory.
   2. Click on the 3-dots for the concerned domain > Settings.
      
   3. Go to the Multi-factor Authentication tab and select the Enable MFA using third-party authenticator app option.
      
   4. Click on Save.
5. Please note that the user must complete the online login using an OTP generated by a third-party authenticator app.
6. Once this is done, on the next local login, they can use the OTP from a 3rd-party authenticator app.
   

Grid Authentication Experience on Device

1. Online Login with Grid Authentication

Online login occurs when you authenticate through OneIdP on the Keycard lock screen using Add work account.

A. Initial Grid Registration & Setup Flow 

If Grid Authentication is enabled and you haven't set up a pattern yet, you will be guided through registration:

1. Initiate Setup: After entering your IdP username and password, select the Grid Authentication option on the MFA screen. 

• If the user already has an MFA setup after login they would have to enter the OTP from the authenticator app that was already configured for their MFA. On the OTP challenge window, select the checkbox "Configure Grid Authentication before finishing Login" before submitting your code. Once your code is verified, you will automatically be directed to set up your Grid pattern.

2. Setup Grid Pattern:

1. A 7x7 grid containing randomized characters is displayed.

2. Think of a secret pattern (e.g., a straight line or specific corners) that meets the minimum required length.

3. Enter the characters corresponding to your pattern in the input field and confirm them.

3.Configure PIN (If Enforced):

If required, a prompt will ask you to set up a numeric PIN (0–9) matching the required length.

4. Complete Setup (Verification Test):

1. A new 7x7 grid will appear.

2. Enter your PIN (if you set one), followed immediately by the characters that match your pattern on this new grid.

B. Subsequent Online Login

1. Device Classification: Keycard automatically identifies if the device is a desktop Mac (e.g., Mac mini, iMac). If the admin has restricted Grid Authentication to desktops, this option will not appear on MacBooks.

2. Authenticating with Grid:

If you also have an Authenticator app configured, the system will default to standard OTP verification. Click Try another Method and select Grid Based Pattern to switch to the grid challenge.

3. Solving the Challenge:

1. View the newly randomized 7x7 grid.

2. Enter your PIN (if configured) followed immediately by the characters that match your secret pattern, then click Login.

Offline Login with Grid Authentication

Offline login occurs when you log in locally to your Mac without an active internet connection.

A. Completing the Offline Grid Challenge

1. The user selects their local or IdP account on the lock screen and enter your password.

2. On the MFA prompt, if you have multiple methods set up, select Grid based MFA.

3. A 7x7 grid filled with randomized characters will appear on the screen.

4. In the input field, enter your PIN (if you set one up) followed by the characters that match your secret pattern on the grid. Then, click the login arrow. Example: If your secret pattern is the top three squares, type your PIN, followed immediately by the three characters currently shown in those top squares.

5. Switching Methods: If you prefer to use a code from your Authenticator app instead, click Switch to Authenticator to go back to the standard OTP field.

B. Account Lockout Protection

Triggering Lockout: 

1. If an incorrect password, OTP, or Grid combination is entered too many times, the account is locked. 
2. You will see an alert message: 
   "Uh!Oh! Too many invalid login attempts. The account is locked. Sign in with you email or Try again later."
   
3. Lockout Behavior: All further login attempts are blocked until the designated unlock duration (e.g., 10 to 30 minutes) has passed. Once the timer expires, you can attempt to sign in again.

Password Management and Synchronization Behavior

Managed User Scenarios

Q1: What happens when a managed user changes their password locally?
A password sync reminder prompt will appear.

Q2: What must the user do after changing the password locally?
The user must enter their IdP credentials and the new local password.

Q3: What happens after completing the password sync process?
The password will sync with the IdP, and the effective password will revert to the IdP password.

Administrator-Initiated Actions

Q1: What happens if a managed admin or local admin changes a user’s password locally?
The user will encounter an error during the next offline login attempt.

Q2: How can the user regain access after this issue?
The user must perform an online login via Keycard to regain access.