Bypassing OAAM multi-factor authentication

Hello
In our project we found an interesting case where it is possible to bypass multi-factor authentication provided by OAM and OAAM. It can also work for a custom multi-factor login application which is integrated with OAM using the Access SDK.
If you integrate OAM and OAAM as officially described in
http://download.oracle.com/docs/cd/E12057_01/doc.1014/e12052/igoam.htm#BABBJACH
you basically have one form authentication scheme which redirects a user to OAAM when trying to access a protected resource. The user enters username/password in OAAM which is send to OAM using the AccessSDK and validated by the authentiction scheme in OAM.
From the point of view of OAM the authentication is completed and OAAM receives the ObSSOCookie. OAAM does not return the cookie to the user but continues with additional authencation steps such as secret questions, fingerprints, etc. If all goes well OAAM returns the ObSSOCooki to the user and he is able to access the protected resource.
The bypass:
OAM has a nice feature (I call it security bug) which allows a user to add authentication credentials as parameters to the URL when accessing a resource. E.g. a user accessing a protected resource such as app.domain.com can simply enter https://app.domain.com?username=xxx&password=xxx and is automatically authenticated provided the username/password parameters and values are correct. By automatically authenticated I mean that there is no redirection to the login form. The authentication credentials are passed by OAM internally to the authentication scheme. There is no post action being sent and intercepted.
Why is this bad? If you are using OAAM as a multi-factor login application passing username/password as URL parameters will not involve OAAM at all. From the point of view of OAM a user is authenticated and there is no need to challenge him with OAAM. No matter what additional authentication factors are configured for OAAM, the authentication process is reduced to one factor (username/passwrod).
Any thoughts on this. I am mostly interested in ideas and approaches to fix this issue.
Regards, Donat

Hello Steve
Bypassing OAAM works with the latest 10g release of OAAM and OAM and the architecture described in the Oracle documentation
http://download.oracle.com/docs/cd/E12057_01/doc.1014/e12052/igoam.htm#BABBJACH
Any toughts on this issue?
Regards,
Donat

Similar Messages

Can you use Multi Factor Authentication server with Central NPS and RD Gateway?

Hi,
Does anyone have any experience getting the Azure Multi-Factor Authentication (MFA) on-premise server, working with a Remote Desktop Gateway server, and a centralised NPS server? I can get a solution whereby a user can get the second token (phone call/sms
etc.) but the connection never gets established. It looks like its looping as it repeats the phone call/text for a second time but again no connection. I can’t figure out why.
All the blogs are very vague as to whether you can combine a new MFA NPS connection policy with an existing username/group membership NPS policy on a centralised NPS server (with RAP/CAP policies).
I need to understand whether we can combine both an MFA Radius policy with a Username/Password plus group membership NPS policy together to achieve two factor authentication.
Do you have the Remote Desktop Gateway Server connect to the Central NPS server and then the NPS server use the MFA server as its proxy server? In effect turning the NPS server into a proxy Radius server?
Or do you configure the Remote Desktop Gateway server to use the MFA server as the proxy Radius server, and configure the MFA server to send on Radius requests to the central NPS server?
Or either of these scenarios not supported and you can only use the MFA server as the only Radius server in the auth. process? (bypassing NPS policies?)
Thanks if someone can assist,
I’ve been using these blogs but to no successful effect:
http://technet.microsoft.com/en-us/library/dn394287.aspx
http://www.rdsgurus.com/uncategorized/step-by-step-using-windows-server-2012-r2-rd-gateway-with-azure-multifactor-authentication/
http://dave.harris.uno/installing-and-configuring-azure-multi-factor-authentication-mfa/

Hi Michael,
Thank you for posting in Windows Server Forum.
After going through your description, I can say that we can use MFA server with central NPS and RD Gateway. Also the link which you have provided points the step to apply. In addition you can refer below article.
Configure Remote Desktop Gateway to use Multi-Factor AuthenticationConfigure Remote Desktop Gateway to use Multi-Factor Authentication
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support

Multi-factor Authentication?

Multi-factor authentication will soon be mandatory for
several of my applications. I need to know if CF has any built-in
functionality, either stock or via custom tags, to handle any of
the common multi-factor tools. How are other people handling this?
:-)

Huh, i'm sorry, I found the answer just after the questioning... :)
Known Issues:
* Windows Authentication for Terminal Services is still not supported for
Windows Server 2012 R2From:https://pfweb.phonefactor.net/install/6.3.0.17465/release_notes.txt
www.sccmfaq.ch

With Multi-Factor Authentication ENABLED how can a admin connect remotely to manage Office 365 with PowerShell

With Multi-Factor Authentication ENABLED how can office 365 admin connect remotely to manage Office 365 with Power-Shell ?
When I key-in my credentials, auth fails with invalid username and password ?
Does any know the procedure ?

This question was closed over a year ago. You will need to start a new question. You can post a link back here if you think it helps.
I also recommend asking in the O365 developers forum for how to do bulk license upgrades. You can use the answer here and just remove and then add the new license.
¯\_(ツ)_/¯

How can I implement Multi Factor authentication with IAM products?

Hi I would like to implement multi factor authentication that can be made generic with all IAM produts. Can anyone suggest an MFA factor like that? It shudnt be an add on or plug in. Instead it should be an in built feature. Can anyone suggest any idea?

Opensso has such feature built-in. You can create an authentication chain in which you can add as many authentication mechanisms as you need.
Although it is a built-in feature, there's no full support for all sorts of authentication methods. Some of them exist as plugins, like authentication modules for smart cards and biometrics because they are not sold by Sun Microsystems. However, there's a solution for you requrement even tough you might add some auth modules as plugins like biobex, activcard or auth modules from other vendors.
Regards.

DirSync and Multi-Factor Authentication Server

Can DirSync and Multi-Factor Authentication Server be installed on the same server?
If so would there be any security issues?

Hi,
Thanks for posting here!
There are no known caveats with it but its not a combination we recommend for or against.
That said, our standard guidance is to put different roles on different machines if resources are available.
If you are running into any issues, please let us know.
Hope this helps!
Regards,
Sadiqh
If a post answers your question, please click Mark As Answer on that post and Vote as Helpful.

Multi-Factor Authentication Server and OWA

Hello,
I am trying to implement a two factor authentication solutions for our OWA service using Multi-Factor Authentication server.
What is the best way to accomplish that, Assuming I would like that the only service will be affected by the MultiFactor authentication server is the OWA?
(without affecting the whole IIS service such as ActiveSync etc.?)

At present, the MFA Server user enrollment is completely separate from Azure AD. If you want to use the mobile app with the MFA Server, you need to install the User Portal so that users can generate activation codes and set their MFA method to mobile app.
Also, for users to activate their mobile apps, you have to install the Mobile App Web Service, which communicates with the MFA Server via the Web Service SDK to validate the activation code generated in the User Portal. Here are links for installing the User
Portal and Mobile App Web Service.
https://msdn.microsoft.com/en-us/library/azure/dn394290.aspx
https://msdn.microsoft.com/en-us/library/azure/dn394277.aspx?f=255&MSPPError=-2147217396

Multi-Factor Authentication desktop app?

Is there a desktop app (Win 7/8) for authenticating against Azure Multi-Factor? I've currently got a MFA provider spun up in Azure and the server installed on prem. We are currently testing with it for two factor authentication to an RDS deployment
and it seems to work well. So far I've used both the phone call and text authentication methods and I'm working on getting the mobile app piece to work.
We do have some instances though where users my not have dedicated cell phones. Is there an app that can be installed on the desktop and works with the Azure MFA that will allow them to two factor auth? Perhaps allowing them to use a known pin
to generate a one time passcode?
Thanks

No, there isn't one. There *might* be one coming with windows 10 and universal apps, but then again, being able to just use an app on the PC you are accessing the resource from kinda negates the whole value of the additional auth Factor.
MFA is not limited to mobile phones only, use a regular one if needed. Or even an OATH token. Lastly, you can always fallback to the security questions, since you have the MFA server.

Two-factor / Multi-factor authentication for Sites login

Hi All,
Would like to know if any one have implemented the two-factor authentication for Sites login ( Admin / Contributor Interface ),
It will be really helpful if you could share any ideas on this.
Regards,
Anoop.

I haven't seen any before for Sites.
But I guess if You use OAM for the access, you could create something like the described in: Integrating the RSA SecurID Authentication Plug-In -
I haven't tried myself, but maybe that integration with RSA SecurID plugin helps you.
Regards,
Guillermo.

DirectAccess with Windows Azure Multi-Factor Authentication Server

Hi,
We're having some troubles implementing OTP-functionality for our DirectAccess-solution. We have DA-server with dual nics (one internal and one external) behind a firewall. We are successfully running it with Windows 7 computers using certificates issued
by our own CA. Everything works fine (e.g. 6to4, Teredo and IP-HTTPS) and computers connect instantaneously.
Then we decided to try to implement OTP-functionality using Azure MFA. We have downloaded the on-premises installation and configured a server with a couple of trial users synced from our Active Directory. It works flawlessly when using the portal and the
built-in tests on the MFA. We receive the text messages promptly and are granted access.
However when we tried to connect it to our DA-server things got weird.
First of all our DA-server refuses to recognize our Issuing CA even though it is domain joined and published in our Active Directory. It worked the first time we went through the wizard, but even since it just keeps saying that "no CA servers can be
detected". We ended up doing it the
powershell way and the Operations status shows no error. When we added the Issuing CA and the Radius Server (our MFA-server) as Infrastructure Servers we got an error message saying that "One or more IP addresses of management server cannot be
added because they are associated with the web probe URL" (which they don't).
We went ahead and started testing the OTP-functionality - assuming this was some strange bug as well. Following the
closest thing to a requirement specification
we could find from MS regarding the certificates required. Both with a Windows 8.1 Ent-client and a couple of Windows 7 Ent-clients but neither are getting any password prompts. We can see with wireshark and in the logs that the DAProbeUser can communicate
between the DA and the MFA. If we try to access the DaOTP-IIS-site we get a certificate error. The IIS-certificate is issued from the same trusted Root CA as the client certificate and all certificates are valid. The CRL:s are accessible both externally and
internally.
We are looking through the local computers OtpCredentialProvider logs but for the Windows 8.1-ones they are only saying Error 10001 (unable to send authentication information to daservername.domain.com error 12175). And for the Windows 7 clients we are getting
Error 10003 (Either private key cannot be generated or user cannot access certificate template on the DC. Which we verified that we can using the infrastructure tunnel only). No other IPv4 traffic seems to be communicated between the two servers according
to Wireshark.
We have also tried using our SafeNet on-prem RADIUS-solution but no traffic seem to get sent to that server neither.
So TL;DR:
- Can anyone provide the precise certificate requirements for setting up DA OTP?
- Are there any good tools for troubleshooting DA OTP-functionality?

Hello Benoit,
Thank you for your reply. If we understood your blog post correctly then we are supposed to be able to access
https://daserver.domain.com/DAOTPvirtualdirectory/DAOTPAuth.dll and not get a 403.7
error-page, even if the back-end Radius isn’t fully functional yet?
The DA server has the OTP signing certificate (confirmed this on the issuing CA and the server’s computer certificate store), it renews this certificate once per day (as per the
guide for the templates on: http://technet.microsoft.com/en-us/library/hh831715.aspx)
We’re not seeing any errors on the AD CS server, no requests, no rejections (for the client certificates), but this could be due to the settings followed for the client template
on the TechNet guide (Do not store certificates and requests in the CA database)?
What do you mean with "IF OTP
signing certificate is not present on client-side, OTP authentication cannot work"? The signing certificate should be on the server side, or are we mistaken?
Also, according to
http://msdn.microsoft.com/en-us/library/hh536654.aspx
it is stated:
“2.The administrator establishes one or more implementation-specific<1>CA servers”
But other guides specifically mention that you can use your current CA environment and that you’re not required to install a dedicated CA for this particular task.

Multi-Factor Authentication with Azure, need to know limitations

Hello,
This forum was recommended as a place to ask MFA questions.
The manager desires all the domain admins accounts to use MFA, when used for any purpose, but especially for when these accounts are used for managing the domain, either via workstation/server login or elevation.
Is these possible? What are the limitations?
Please let me know.
Thank you,
-Bob

On Mon, 9 Feb 2015 19:04:41 +0000, Littlebob wrote:
This forum was recommended as a place to ask MFA questions.
If you're asking specifically about Azure as per your subject then no, this
isn't actually the correct forum. Post here:
http://azure.microsoft.com/en-us/support/forums/
This is for on-prem Windows Server. You might want to let whomever directed
you here know that there are specific support forums for Azure.
Paul Adare - FIM CM MVP
"I've tried to convince many vegetarian friends that chicken are just
fast-moving vegetables." -- Simon Cozens

How to deploy connection (Mac OS X Yosemite to Windows RDS) through the RD Gateway with Two Factor authentication (Safenet OTP) on Session host?

Good day!
Could you please help me? How to deploy connection (Mac OS X Yosemite to Windows RDS) through the RD Gateway with Two Factor authentication on Session host? How to open an authentication dialog that is the same as in Windows when logging on to network resources
in Windows (Windows Security)?
Our test environment: We have one RDS 2012 R2 server (all roles in one) and one session host in collection. On the session host installed Safenet Network Logon and it under GPO which disable all authentication, only OTP.

Hi Sir,
It seems that you are going to integrate 3rd party product into AD for authentication .
I would suggest you to contact the vendor of Safenet for this deployment scenario :
http://www.safenet-inc.com/multi-factor-authentication/authentication-management/safenet-authentication-manager-express-samx/
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

HT201363 multi factor verification code sent to Google Voice number

I'm trying to set up multi factor authentication for my AppleID. I have the verification code sent to my Google Voice number but I never receive the text with the verification code. What's the problem? (I got the code to my other non-GV number.)

I installed Mavericks, set up the iCloud keychain step by step. I was asked to link a phone number to it, and so I gave my Google Voice number. I know some systems don't allow for these kinds of numbers to work, but usually it's a two step verification - You put in your number, they send you a message with a code to verify this is indeed your number and you put in the correct phone number and voila it's linked.
A) It automatically accepted my phone number as is without verifying it
B) I'm not unable to verify my icloud Keychain account on other devices
Now the next step, for some reason I kept having pop-ups from keychain that asked me to put in passwords that over and over again. I couldn't find a solution so I re-installed Maveriks and did a time-machine reinstal. Which means now I can't verify access to iCloud keychain through any device at all. How can I reset everything and put in my real phone number?
I know my itunes/icloud user name and password and the 4 digit lock code for iCloud Keychain.
Appreciate the help!

Two-factor Authentication

Is it possible to implement Azure Multi-factor Authentication in a LightSwitch HTML App? (hosted on Azure)
I couldn't find any articles for the HTML Client, what I'd like to do is send a PIN to the user's phone, and use it as an additional verification method, as described here:
http://azure.microsoft.com/en-us/documentation/services/multi-factor-authentication/
Regards.
Nicolás Lope de Barrios
If you found this post helpful, please "Vote as Helpful". If it actually answered your question, please remember to
"Mark as Answer". This will help other people find answers to their problems more quickly.

Hey Josh,
I'm sure it can't be done with a CBA, etc. etc. but this is not the case.
Thanks anyway, I appreciate your help.
Nicolás Lope de Barrios
If you found this post helpful, please "Vote as Helpful". If it actually answered your question, please remember to
"Mark as Answer". This will help other people find answers to their problems more quickly.

Two Factor authentication support for VMWare View

Happy to inform you that ArrayShield IDAS Two factor authentication solution has added support to VMWare View. As other product vendors, the integration happens out of the box using RADIUS. Secure and almost nil downtime to add 2FA support to your VMWare View.
ArrayShield IDAS 2FA solution is a patented, multi-award winning product that stands out from the other Two factor authentication product for its innovative solution on using a simple plastic card and pattern combination to derive One Time Secret Code. This gets rid of various dependencies like Hardware token, Smart Card or Mobile networks. Kindly go through our product demo video to understand the product better.
http://www.arrayshield.com/products/howitworks

Finally, this is what I looking. Thanks for giving the link.

Bypassing OAAM multi-factor authentication

Similar Messages

Maybe you are looking for