ESET Secure Authentication Cloud (Early Access) Owner's manual

ESET Secure Authentication Cloud

Early Access

User guide

Click here to display the online version of this document

ESET Secure Authentication Cloud Early Access was developed by ESET, spol. s r.o.

For more information visit https://www.eset.com.

in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise without

permission in writing from the author.

ESET, spol. s r.o. reserves the right to change any of the described application software without prior notice.

Technical Support: https://support.eset.com

REV. 9/5/2023

1 Overview 1 ...........................................................................................................................................

2 Changelogs 1 .......................................................................................................................................

3 Quick-start guide 2 ...............................................................................................................................

4 Requirements 3 ....................................................................................................................................

4.1 Supported Operating Systems 3 .....................................................................................................

4.2 Supported Web Browsers and Resolution 4 ......................................................................................

4.3 Supported Web Applications 4 ........................................................................................................

4.4 Supported Mobile Phone Operating Systems 5 .................................................................................

4.5 Installation Requirements 6 ...........................................................................................................

4.5 ESA components and OS compatibility 8 ................................................................................................

4.6 Firewall exceptions 9 .....................................................................................................................

4.7 Handling cloned computers 10 .......................................................................................................

4.8 IP addresses used by ESET Secure Authentication Cloud Early Access 10 ............................................

5 Installation 11 ......................................................................................................................................

5.1 Invitations 11 ...............................................................................................................................

5.2 Live installer 13 ............................................................................................................................

5.3 Install the Windows Login plugin 15 ................................................................................................

5.4 Install the Remote Desktop plugin 16 ..............................................................................................

5.5 Install the Web App plugin 18 .........................................................................................................

5.6 Change, repair, remove installation 19 ............................................................................................

5.7 Remote Installation via ESMC 19 .....................................................................................................

5.8 MSI arguments 20 .........................................................................................................................

5.9 Upgrade installation 21 .................................................................................................................

6 Getting started with ESET Secure Authentication Cloud Early Access Web Console 22 .......................

6.1 Multitenancy 22 ............................................................................................................................

6.2 User Management - Provisioning 23 ................................................................................................

6.2 User Status 27 ............................................................................................................................

6.2 Import users from ﬁle 29 .................................................................................................................

6.2 Self-enrollment 31 ........................................................................................................................

6.3 Notiﬁcations 35 ............................................................................................................................

7 Authentication options 36 ....................................................................................................................

7.1 Mobile Application 37 ....................................................................................................................

7.2 Push Authentication 38 .................................................................................................................

7.3 Hard Tokens 42 .............................................................................................................................

7.4 FIDO 46 .......................................................................................................................................

7.5 Master recovery key 47 .................................................................................................................

7.6 Delivery options 48 .......................................................................................................................

8 Credential providers supported by ESA 49 ...........................................................................................

9 Windows Login Protection 49 ...............................................................................................................

10 Remote Desktop Protection 52 ..........................................................................................................

10.1 Allowing Non-2FA Users 53 ...........................................................................................................

10.2 Usage 53 ....................................................................................................................................

10.3 Remote Desktop Web Access 54 ...................................................................................................

10.4 Remote Desktop Gateway and ESA RADIUS 55 ................................................................................

11 Web Application Protection 58 ...........................................................................................................

11.1 Conﬁguration 58 .........................................................................................................................

11.2 Usage 59 ....................................................................................................................................

12 Identity Provider Connector 60 ..........................................................................................................

12.1 Conﬁgure Identity Provider Connector in ESA Web Console 63 .........................................................

12.2 IdP Connector Conﬁguration Examples 66 ......................................................................................

13 RADIUS server and VPN Protection 74 ...............................................................................................

13.1 RADIUS Conﬁguration 74 ..............................................................................................................

13.2 RADIUS Usage 78 ........................................................................................................................

13.3 VPN Authentication Options 78 .....................................................................................................

13.3 SMS-based OTPs 78 .....................................................................................................................

13.3 Mobile Application 79 ...................................................................................................................

13.3 Hard Tokens 79 .........................................................................................................................

13.3 Migration from SMS-Based OTPs to Mobile Application 80 ............................................................................

13.3 Non-2FA Pass-through 80 ...............................................................................................................

13.4 ESA Authentication Methods and PPP Compatibility 80 ....................................................................

13.5 Verifying ESA RADIUS functionality 81 ...........................................................................................

13.5 Make sure your ESA RADIUS Service is running 81 ...................................................................................

13.5 Conﬁgure your RADIUS Server 82 ......................................................................................................

13.5 Verify functionality (localhost) 83 ......................................................................................................

13.5 Verify network connectivity from another machine (optional) 84 ....................................................................

13.5 I received an Access-Reject 85 .........................................................................................................

13.5 I received a connection error 86 .......................................................................................................

13.5 I experienced timeouts 87 ..............................................................................................................

14 RADIUS PAM modules on Linux/Mac 88 ..............................................................................................

14.1 Create ESA RADIUS clients via API 88 ............................................................................................

14.2 PAM conﬁguration 92 ..................................................................................................................

14.3 Other RADIUS conﬁgurations 95 ....................................................................................................

15 IP address whitelisting 97 ..................................................................................................................

16 AD FS 99 ............................................................................................................................................

16.1 AD FS Policies 101 ......................................................................................................................

17 Custom integration via API and SDK 102 ...........................................................................................

17.1 API 103 ......................................................................................................................................

17.1 Integration Overview 103 ..............................................................................................................

17.1 Conﬁguration 103 ......................................................................................................................

17.2 SDK 105 .....................................................................................................................................

17.2 Integration Overview 106 ..............................................................................................................

17.2 SDK License Activation 106 ............................................................................................................

17.2 SDK in practice 107 ....................................................................................................................

17.2 Using the SDK 107 .....................................................................................................................

17.2 SDK System Integration 107 ...........................................................................................................

17.2 Database requirements 108 ...........................................................................................................

17.2 Reading and Writing 2FA Data 108 ....................................................................................................

17.2 Update Login UI With 2FA Methods 109 ...............................................................................................

17.2 Update the Management UI to Enable/Disable 2FA For Users 111 ...................................................................

17.2 Additional Components 111 ...........................................................................................................

17.3 Summary of diﬀerences 111 .........................................................................................................

18 Auditing and Licensing 112 ................................................................................................................

18.1 Reports 112 ...............................................................................................................................

18.2 Auditing 114 ...............................................................................................................................

18.3 License Overview 115 ..................................................................................................................

18.4 License States 115 ......................................................................................................................

18.5 License Enforcement 116 .............................................................................................................

19 Troubleshooting 116 ..........................................................................................................................

19.1 Windows Login protection does not work 117 ................................................................................

20 Known issues 118 ..............................................................................................................................

21 Glossary 118 ......................................................................................................................................

22 Terms of Use 119 ...............................................................................................................................

22.1 ESA Cloud Components EULA 123 .................................................................................................

22.2 Data Processing Agreement 129 ...................................................................................................

22.3 Standard Contractual Clauses 131 ................................................................................................

23 Privacy Policy 155 ..............................................................................................................................

1

Overview

ESET Secure Authentication Cloud Early Access (ESAC EA) adds Two-Factor Authentication (2FA) to Microsoft

Active Directory domains or local area network, meaning a one-time password (OTP) is generated and provided

along with the generally required username and password. Or a push notification is generated and has to be

approved on the user's cell phone running Android OS, iOS, or Windows once the user has successfully

authenticated using their general access credentials. Or other authentication option is required.

Push notifications require Android 4.1 and later, along with Google Play services 10.2.6 and later, or iOS.

ESAC EA introduces multitenancy.

ESA Components

The ESAC EA product consists of the following components (usually referred to as ESA Components):

• ESAC EA Web Console, an all-in-one management tool, is used to configure ESET Secure Authentication

Cloud Early Access, manage users and download installers

• The Windows Login plug-in provides 2FA for Windows computers

• The Remote Desktop plug-in provides 2FA for the Remote Desktop Protocol

• The RADIUS Server for VPN Protection adds 2FA to VPN authentication

• The Web Application plug-ins provide 2FA to various Microsoft Web Applications

• The AD FS plug-in provides 2FA for Active Directory Federation Services

• The Identity Provider Connector

• The ESAC EA Authentication Server includes a REST-based API that can be used to add 2FA to custom

applications

Changelogs

ESET Secure Authentication Cloud Early Access

New:

• Authentication Server along with the Web Console is available in the cloud (no manual deployment needed)

• Live installer

• Multitenancy

2

Quick-start guide

Verify system requirements and installation prerequisites

Complete or verify each installation prerequisite before proceeding to step 2.

• Verify outbound connectivity of the computers/services to be protected to esa.eset.com and esac.eset.com

on TCP port 443

• Verify your servers and clients to protect by 2FA are running the following supported software:

oOperating systems

oWeb browsers

oMobile phone operating systems

Register with ESET Business Account and import an eligible ESA license

• Register at eba.eset.com and import an eligible ESET Secure Authentication (ESA) license

Enable self-enrollment or import users manually

• To automatically enroll users, enable self-enrollment and configure the default authentication options.

Alternatively, import users manually.

Install ESA components

Create an invitation and install all applicable ESET Secure Authentication (ESA) components on the appropriate

devices.

• Windows Login Protection

• Remote Desktop Protection

• VPN Protection

• Web Application Protection

• Identity Provider Connector (SAML)

• AD FS

Complete user provisioning

If self-enrollment is not enabled, complete user provisioning manually.

3

Requirements

To get started with ESET Secure Authentication Cloud Early Access:

1. Register with ESET Business Account at eba.eset.com and log in.

2. Add a valid ESET Secure Authentication license.

3. Open esac.eset.com in a new browser tab.

To protect computers in an offline environment with 2FA, use the on-premise version of ESET Secure

Authentication and activate it with an offline license.

ESA components can communicate with the Authentication Server via both IPv4 and IPv6.

Required ESA Component version

ESA Components version 3.0.61 or later must be used with ESET Secure Authentication Cloud Early Access.

Limited support for end-of-life third-party products

ESET Secure Authentication Cloud Early Access provides limited support for compatible third-party

products that reached the end of their support lifecycle.

Supported Operating Systems

Below is a list of supported operating systems (OS) in general. For component-specific OS support, refer to

installation requirements.

Server operating systems (server OS)

• Windows Server 2008*

• Windows Server 2008 R2 SP1*

• Windows Server 2012

• Windows Server 2012 R2

• Windows Small Business Server 2008

• Windows Small Business Server 2011

• Windows Server 2012 Essentials

• Windows Server 2012 R2 Essentials

• Windows Server 2016

• Windows Server 2016 Essentials

• Windows Server 2019

• Windows Server 2019 Essentials

4

• Windows Server 2022

Client operating systems (client OS)

• Windows 7

• Windows 8

• Windows 8.1

• Windows 10 (including 22H2 Update)

• Windows 11 (including 22H2 Update)

Supported Web Browsers and Resolution

The ESET Secure Authentication Cloud Early Access Web Console has optimal functionality in the following

browsers:

Microsoft Internet Explorer 11

Google Chrome latest

Mozilla Firefox latest

Microsoft Edge latest

Safari latest

Functional details

The execution of JavaScript needs to be enabled in your web browser.

The minimum resolution required is 1024x768.

Supported Web Applications

ESET Secure Authentication Cloud Early Access provides 2FA for the following Microsoft products:

• Microsoft Exchange 2007

oOutlook Web Access - Exchange Client Access Server (CAS)

• Microsoft Exchange 2010

oOutlook Web Access - Exchange Client Access Server (CAS)

oExchange Control Panel

• Microsoft Exchange 2013

oOutlook Web App - Exchange Mailbox Server Role (MBX)

oExchange Admin Center

5

• Microsoft Exchange 2016

oOutlook Web App - Exchange Mailbox Server Role (MBX)

oExchange Admin Center

• Microsoft Exchange 2019

oOutlook Web App - Exchange Mailbox Server Role (MBX)

oExchange Admin Center

Where is 2FA applicable

ESAC EA adds 2FA protection only to the web-based interface of Outlook Web Access. Login to Microsoft

Outlook and similar email clients cannot be protected by ESAC EA, due to the nature of their protocol, also

known as RPC over HTTPS. We recommend not to expose such email clients to external access. See how to

control access to Exchange Web Services.

• Microsoft Dynamics CRM 2011

• Microsoft Dynamics CRM 2013

• Microsoft Dynamics CRM 2015

• Microsoft Dynamics CRM 2016

• Microsoft SharePoint 2010

• Microsoft SharePoint 2013

• Microsoft SharePoint 2016

• Microsoft SharePoint 2019

• Microsoft SharePoint Foundation 2010

• Microsoft SharePoint Foundation 2013

• Microsoft Remote Desktop Web Access

• Microsoft Terminal Services Web Access

• Microsoft Remote Web Access

Supported Mobile Phone Operating Systems

The ESET Secure Authentication Cloud Early Access mobile app is compatible with the following mobile phone

operating systems:

• iOS 12 to iOS 16

• Android™ 4.4 to Android 13 - Google Play Services 10.2.6 are required for push notifications.

6

oThe permission to access the camera and flashlight is required to scan the QR code

Installation Requirements

Quick links: Installation access rights, Prerequisites of each component, .NET requirements

Installation requires outbound connectivity to esac.eset.com on TCP port 443.

Another requirement for running the installer is to have .NET Framework Version 4.5 (Full Install). The installer

will automatically attempt to install .NET 4.5 if it is not already installed.

Windows Firewall exceptions essential for the proper function of ESET Secure Authentication Cloud Early Access

will be added automatically as part of the installation. If you are using a different firewall solution, see Firewall

exceptions for information about essential exceptions that you will need to create.

Installation access rights

Active Directory environment:

• Domain administration rights: The installer must be run by a member of the "Domain Administrators"

security group or by a user with administrator privileges.

Standalone deployment:

• Local administrator rights

Table of compatibility of ESA Components and Supported Operating Systems

Prerequisites for each component installation

Identity Provider Connector

• Windows7 or later client OS in the list of Supported Operating Systems, Windows Server 2008 R2 or later

server OS in the list of Supported Operating Systems

• IIS 7 or later with ASP.NET Framework version 4.7.2

RADIUS Server

• Windows7 or later client OS in the list of Supported Operating Systems, Windows Server 2008 or later server

OS in the list of Supported Operating Systems

Web App Plug-in for Microsoft Exchange Server

• Microsoft Exchange Server 2007 or later (64-bit only), with the Client Access role (Outlook Web App /

Outlook Web Access) installed

7

• .NET Framework version 3.5

• Internet Information Services 7 (IIS7) or later

Web App Plug-in for Microsoft SharePoint Server

• Microsoft SharePoint Server 2010, 2013, 2016, 2019 (64-bit only)

• Microsoft SharePoint Server 2010, 2013 Foundation (64-bit only)

• .NET Framework version 4.5

Web App Plug-in for Microsoft Dynamics CRM

• Microsoft Dynamics CRM 2011, 2013, 2015 or 2016

• .NET Framework version 4.5

Web App Plug-in for Microsoft Terminal Services Web Access

• The Terminal Services role with the Terminal Services role service installed on Windows Server 2008 R2

• .NET Framework version 4.5

Web App Plug-in for Microsoft Remote Desktop Services Web Access

• The Remote Desktop Services role with the Remote Desktop Web Access role service installed on Windows

Server 2008 R2 and later server OS in the list of Supported Operating Systems

• .NET Framework version 4.5

Web App Plug-in for Microsoft Remote Web Access

• The Remote Web Access role service installed on Windows SBS 2008 where it is called Remote Web Access,

Windows SBS 2011, Windows Server 2012 Essentials, Windows Server 2012 Essentials R2 and Windows Server

2016 Essentials

• .NET Framework version 4.5

Remote Desktop Protection

• Windows Server 2008 R2 or later server OS in the list of Supported Operating Systems

• Microsoft Windows 7 or later client OS in the list of Supported Operating Systems

• Only 64-bit operating systems are supported

Windows login protection

• Windows Server 2008 R2 or later server OS in the list of Supported Operating Systems

• Windows 7 or later client OS in the list of Supported Operating Systems

8

AD FS protection

• Windows Server 2012 R2 or later server OS in the list of Supported Operating Systems

.NET Requirements

• All components: .NET 4.5 Full Install

• RADIUS Server: .NET 4.5 Full Install

• Web App Plugin: .NET 4.5, however, IIS Filters require .NET version 3.5

• FIDO: .NET Framework version 4.7.2

• Identity Provider Connector: .NET Framework version 4.6.2

ESA components and OS compatibility

The following table displays the supported Windows operating systems for each ESET Secure Authentication

Cloud Early Access component.

See installation requirements for further details.

Server operating systems

Windows

Server 2008

Windows

Server 2008

R2

Windows

Server 2012

Windows

Server 2012

R2

Windows

SBS 2008

Windows

SBS 2011

Windows

Server 2012

Essentials

Windows

Server 2012

R2

Essentials

Windows

Server 2016

Windows

Server 2016

Essentials

Windows

Server 2019

Windows

Server 2019

Essentials

Windows

Server 2022

RADIUS

Server ✔✔✔✔✔✔✔✔✔✔✔✔✔

Web App

Plug-in for

MS

Exchange

Server

✔* ✔✔✔✔✔✔✔✔✔✔✔✔

Web App

Plug-in for

MS

SharePoint

Server

✔✔ ✔✔✔✔✔✔✔✔

Web App

Plug-in for

MS

Dynamics

CRM

✔✔ ✔✔✔✔✔✔✔✔

Web App

Plug-in for

MS

Remote

Desktop

Services

Web

Access

✔** ✔✔✔ ✔✔✔✔✔✔✔✔

Web App

Plug-in for

MS

Remote

Web

Access

✔✔✔✔ ✔

Remote

Desktop

Protection

✔✔✔ ✔✔✔✔✔✔✔✔

9

Windows

Server 2008

Windows

Server 2008

R2

Windows

Server 2012

Windows

Server 2012

R2

Windows

SBS 2008

Windows

SBS 2011

Windows

Server 2012

Essentials

Windows

Server 2012

R2

Essentials

Windows

Server 2016

Windows

Server 2016

Essentials

Windows

Server 2019

Windows

Server 2019

Essentials

Windows

Server 2022

Windows

login

protection

✔✔✔ ✔✔✔✔✔✔✔✔

AD FS ✔ ✔✔✔✔✔✔✔

Identity

Provider

Connector

✔✔✔ ✔✔✔✔✔✔✔✔

* 64-bit version of the operating system is required

** MS Terminal Services on Windows Server 2008

Client operating systems

Windows 7 Windows 8 Windows

8.1

Windows

10

Windows

11

RADIUS Server ✔✔✔✔✔

Web App Plug-in for MS Exchange Server *

Web App Plug-in for MS SharePoint Server *

Web App Plug-in for MS Dynamics CRM

Web App Plug-in for MS Terminal Services

Web Access

Web App Plug-in for MS Remote Desktop

Services Web Access

Web App Plug-in for MS Remote Web Access

Remote Desktop Protection* ✔✔✔✔✔

Windows login protection ✔✔✔✔✔

AD FS

Identity Provider Connector ✔✔✔✔✔

* 64-bit version of the operating system is required

Firewall exceptions

Ensure the computers where ESA Components are installed can reach https://esac.eset.com (port 443). To use

RADIUS Service, add the exceptions below to your firewall.

Exception Name: ESET Secure Authentication Cloud Early Access RADIUS Service

• Scope: Any

• Protocol: UDP

• Local Port: 1812

• Remote Ports: All

10

Exception Name: ESET Secure Authentication Cloud Early Access RADIUS Service (Alternative

Port)

• Scope: Any

• Protocol: UDP

• Local Port: 1645

• Remote Ports: All

Handling cloned computers

Suppose you want to have cloned computers in your network where ESET Secure Authentication Cloud Early

Access (ESAC EA) will be used. In that case, the attributes below must be unique for each computer to be

protected by ESAC EA.

• For correct registration of ESA components (Windows Login plugin, Remote Desktop plugin):

▪Computer name

• For correct registration of realms for local users:

▪Computer name

▪Computer SID

Use Microsoft's SysPrep tool to ensure unique attributes are applied to cloned computers.

1. In the SysPrep, use the Generalize option to create a generalized Windows image to be cloned later. Each

image is configured during its first boot.

2. If the cloned computers are used in a domain:

a.On the cloned machine, run the SysPrep tool.

b.Reboot the computer.

c.Connect the computer to the domain.

3. Install ESA (Windows Login plugin, Remote Desktop plugin) to each cloned computer either manually or

through ESET PROTECT.

IP addresses used by ESET Secure Authentication Cloud

Early Access

ESET Secure Authentication Cloud Early Access connects automatically to the IP addresses listed below.

• 93.184.220.29 - Certificate revocation check based on publicly available Certificate Revocation Lists

11

• 23.42.27.27 - Certificate revocation check regarding EXE/DLL signatures

Installation

ESET Secure Authentication Cloud Early Access provides two installer types:

• Live installer—a pre-configured installer containing invitation details and specific ESA components to

install. The user launches the installer, and the installation completes without their interaction if the

installation requirements are met.

• Installer—Generic .EXE installer (also known as bootstrapper). During installation the user can select the

components to install and define the invitation details.

Generic .EXE installer - deployment type and components

When using the generic .EXE installer, select Standalone deployment type.

Do not select the Authentication Server or Reporting Engine (Elasticsearch) components.

To configure a live installer:

1. Create an invitation.

2. Navigate to Settings > Installers.

3. Select an invitation.

4. Select the desired ESA components to install.

5. Click Live Installer.

Invitations

An invitation is like a business card. It contains the connection details of the Authentication Server (your instance

of ESET Secure Authentication Cloud Early Access account) so that ESA components can connect to it. It also

contains a unique code identifying the invitation. Each invitation is limited by time and usage count.

Generate an invitation

1. In the ESAC EA Web Console, click Components > Invitations.

2. If prompted, select a company.

3. Click Create invitation.

4. Enter an invitation name, expiration time and usage count. Click Create.

12

5. The invitation details display. To save the details to a text file or to copy elsewhere, click Copy data to

clipboard.

6. Click Close, and the list of invitations will display. Alternatively, click Create installer to proceed with the

creation of a live installer.

13

Click the name of an invitation to open the invitation details again.

Expiration of invitations

The maximum available expiration time for an invitation is four weeks.

Live installer

The live installer is a pre-configured installer containing invitation details and specific ESA components to install.

The user launches the installer, and the installation completes without their interaction if the installation

requirements are met.

To create a live installer:

1. Log in to ESET Secure Authentication Cloud Early Access Web Console.

2. Navigate to Settings > Installers.

3. Select an invitation and the desired ESA components.

If the machine to protect by 2FA is behind a proxy server, select the Custom proxy check box and fill in the

required details. Otherwise, the ESA component will not connect to the Authentication Server.

4. Click Live installer.

14

When you launch the installer, it will list the ESA components to install.

15

Install the Windows Login plugin

Windows Login protection is available for local user accounts and Active Directory user accounts only.

1. To install the ESA Windows Login plug-in on the applicable machine, either use the live installer or run the

generic installer (.EXE file). If not detected, the .NET Framework version 4.5 is installed automatically.

Generic .EXE installer - deployment type and components

When using the generic .EXE installer, select Standalone deployment type.

Do not select the Authentication Server or Reporting Engine (Elasticsearch) components.

2. When prompted, click Select components, select the check box next to Windows Login, and click Next.

Page is loading ...

ESET Secure Authentication Cloud (Early Access) Owner's manual

ESET Secure Authentication Cloud (Early Access) Owner's manual

Related papers

Other documents