This article discusses how to configure the authentication behavior and Multi-Factor Authentication (MFA) requirements for SDP users in your account.
The Authentication policy defines how SDP users authenticate to your account: MFA, Single Sign-On (SSO), or username and password. In addition, you can choose the end-user authentication experience using the in-Client browser or the external default OS browser.
For Windows and macOS devices, you can configure whether users authenticate using the embedded browser or an external browser. The default setting is to use the embedded browser which provides the best end-user experience. MFA and SSO authentication is completed inside the Client and then seamlessly connects the device to the Cato Cloud.
Sometimes the network configuration of an account doesn't support the embedded browser. In these cases, you can set your account to use the external default OS browser for the device. The end-user starts the connection in the Client, and then users authenticate to the Cato Cloud with the OS browser.
To set the Client browser authentication for the account:
-
From the navigation menu, click Access > Client Access.
-
Expand the Authentication section.
-
In Browser Authentication, select one of these options:
-
In-Client Browser - SDP users authenticate to your account within the Client
-
External Browser - SDP users authenticate to your account with the OS browser
-
-
Click Save.
The following are best practices to following when choosing your Browser Authentication method:
-
The Embedded Browser is recommended except when conditional access requires a browser plugin that is only supported by an external browser.
-
Use the Embedded Browser when the Always-On is enabled to ensure proper functionality. Not all domains and IPs necessary for SSO authentication are allowed when using an external browser.
-
The embedded browser must be used in an ADFS environment, or SSO can not be used for authentication.
-
The embedded browser prevents an issue with SSO authentication with the external browser and HSTS enforcement. For more information, see SSO Authentication Fails When Using External Browser | localhost Error.
-
Use the external browser for authentication when using the Okta Verify app on either macOS or Windows.
Use the Authentication screen to define the authentication policy for SDP users in your account that connect with the Cato Client. For accounts that enable SSO, this is default authentication policy.
These are the authentication options:
-
SSO - SDP users authenticate with SSO using the Identity Provider (IdP) configured for your account
-
MFA - SDP users must authenticate using a code they receive from an SMS or an authenticator app (according to RFC-6238 for MFA)
-
User Name and Password - SDP users authenticate with the username and password for the Client (no MFA requirements)
You can also choose to override the MFA policy for individual SDP users, see below Overriding Authentication Settings for Specific Users.
If you are using Directory Services and you need to modify a SDP user's mobile phone number for advanced authentication, you must modify the phone number only in the IdP.
Note
Note: Multi-Factor Authentication (MFA) and Single-Sign On (SSO) are NOT supported for users that are provisioned with a registration code.
Working with Token Validity Settings
The Token Validity > Duration option depends on whether the device running the Cato client is "trusted" as follows:
-
If the user enabled trust for the device running the Cato Client (by selecting the Don't ask me again on this device/computer option on the Client when connecting to the Cato Cloud), then MFA is not required if the duration is still valid and the geolocation has not changed to a different country
-
If the user did not enable trust for the device running the Cato client (by clearing the Don't ask me again on this device/computer option on the client when connecting to the Cato Cloud), the duration setting has no effect and MFA is always required on this device
To configure the MFA policy for remote users:
-
From the navigation menu, click Access > Client Access.
-
Expand the Authentication section.
-
In the Method drop-down list, select MFA.
-
Configure the General select the Authentication Method for the policy:
-
Any - Each user selects the authentication method for themselves
-
Authenticator - Users must use an authentication app (such as Google Authenticator)
-
SMS - Users are sent an SMS text message with an authentication code
-
-
In the Token validity section, select the behavior for the MFA token in the Client:
-
Always Prompt - MFA is required whenever the user connects.
Users that are logged in must reauthenticate when the duration you define in Days or Hours (since they last logged in) is reached.
-
Duration - Users do not require MFA for the duration you define in Days or Hours.
-
-
Click Save.
You can customize different authentication settings for specific users and override the global authentication policy. Edit a user and then use the Authentication screen to customize the authentication method for that user.
To override the global authentication settings for a specific user:
-
From the navigation menu, click Access > Users.
-
Select the user, and from the navigation menu select User Settings > Authentication.
-
Select Override account Authentication settings.
-
Select the authentication Method for the user.
-
Configure the authentication settings for this user.
-
Click Save.
You can reset the MFA setting for users when necessary, such as installing the Client on a new device.
To reset the MFA settings for a user:
-
From the navigation menu, click Access > Users.
-
In the User list, select the check box next to the user's name.
-
From the Actions drop-down menu, select Reset MFA.
-
In the confirmation window, click OK.
-
The user receives an e-mail with a link to the Cato User Portal. After signing in to the portal, the user will need to activate MFA settings for the device.
0 comments
Please sign in to leave a comment.