How To: Set Up Multiple Second-Factor Authentications via Realm-Chaining

Version Affected: All

 

Overview

Some IT Security policies require a user to complete more than one second-factor authentication (2FA) before being fully authenticated — often on self-service portals, to help confirm the user's identity and deter hijacking attempts. SecureAuth Identity Provider (IdP) can be configured to do this using a technique called Realm-Chaining.

Configure Realm-Chaining

Realm-chaining works by forwarding the user to another realm once they have successfully completed authentication on the current one. A token (cookie) is passed along with the user to maintain their identity as they move between realms. By linking realms together this way, you can in principle chain an unlimited number of 2FA steps for a single user — but best practice is to chain no more than three realms together.

The steps below chain two realms, SecureAuth1 and SecureAuth2, starting from a minimally-configured web.config file that can already connect to an appropriate data store.

First Realm — SecureAuth1:

1. In the Workflow tab, set Public/Private Mode to Public Mode Only, and Authentication Mode to Second Factor Only.
2. In the Custom Front End section of the Workflow tab, set Receive Token to Send Token Only, Require Begin Site to False, and Token Data Type (Send) to User ID.
3. Click the Token Settings link in the same section, and set Pre-Auth Cookie to PreAuthToken01 and Post-Auth Cookie to PostAuthToken01.
4. In the same section, under Machine Key, click Generate New Keys.
5. In the Post Authentication tab, set Authenticated User Redirect to Use Custom Redirect, with Redirect to set to ../SecureAuth2/SecureAuth.aspx.

Second Realm — SecureAuth2:

1. In the Workflow tab, set Public/Private Mode to Public Mode Only, and Authentication Mode to Standard.
2. In the Custom Front End section of the Workflow tab, set Receive Token to Token, Require Begin Site to True, Begin Site URL to ../SecureAuth1/SecureAuth.aspx, and Token Data Type (Send) to User ID.
3. Click the Token Settings link in the same section, and set Pre-Auth Cookie to PostAuthToken01 and Post-Auth Cookie to PostAuthToken02.
4. In the same section, under Machine Key, copy in the key values generated for SecureAuth1 in step 4 above.
5. Configure the Post Authentication tab however fits your environment.

With both realms configured this way:

• The user starts at SecureAuth1, is prompted for a User ID, then completes 2FA.
• Once authenticated via 2FA, the user is redirected to SecureAuth2.
• In SecureAuth2, the user is prompted for another 2FA.
• Once authenticated via this second 2FA, the user is prompted for their password.
• Once the correct password is supplied, the user is redirected to the Post Authentication page configured in SecureAuth2.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.