Administrator Tasks for Multifactor Authentication

Using the Proper Filter

The Multifactor Authentication feature requires the CTE VMLFS driver. This driver must be running in order for Multifactor Authentication to work.

• All new installations of 7.3.0.x contain this driver. Type fltmc to verify. A table displays listing all current drivers.

  Filter Name	Num	Instances	Altitude	Frame
  WdFilter		4	328010	0
  storqosflt		0	244000	0
  wcifs		0	189900	0
  vmlfs		4	142900	0
  FileCrypt		0	141100	0
  luafv		1	135000	0
  npsvctrig		1	46000	0
  Wof		1	40700	0

• Agents upgraded from 7.2.0, and previous versions, may be using the vmfiltr driver. If the agent ran vmfiltr driver, then when you upgrade to 7.3.0, it will start the vmfiltr driver. If the previous agent ran the vmlfs driver, then when you upgrade to 7.3.0, it will start the vmlfs driver. Type the following to switch to the vmlfs driver:

  voradmin config enable vmlfs
  

User Authentication

Authentication is provided for the entire client and is enforced the first time a user opens a file. After the initial file opening, the user can perform read/writes to the file.

To authenticate, a user can login to MFA from the Windows system tray:

1. Click on the CTE icon in the System Tray.

2. Select Multi-Factor Authentication > Authenticate.

   

3. Login in to access the STA OIDC template.

   

   After you log in, a message displays confirming your authentication and your access to the GuardPoint.

4. Close the Window to continue.

If you logout, you disable your access to the GuardPoint.

Voradmin Commands

The MFA command group contains the following commands:

Syntax

voradmin mfa [status | config | check-connection | update-ports | set-auth-expiry]

voradmin mfa status

Displays the MFA information for a user.

Syntax

voradmin mfa status

Example

C:\Windows\system32>voradmin mfa status

Response

User \dram is allowed access.
MFA enabled guardpath(s) (Number of paths: 2):
C:\cm\gp2
C:\cm\gp1

voradmin mfa config

Displays configuration information.

Syntax

voradmin mfa config

Response

HostMfaEnable is set.
MFA enabled guardpath(s) (Number of paths: 2):
C:\cm\gp2
C:\cm\gp1
MFA access allowed users(s) (Number of users: 2):
    Users\dram
    NT AUTHORITY\SYSTEM
MFA Exempt-List: (Number of entries: 1)
    user: "system", group: "", domain(s): "NT AUTHORITY"
OIDC configuration:
      login-port : 5560
    notification-port : 5562
       client-id : 6653gd25-e1c7-4257-6034-46c77ffc8cb6
             url : https://idp.eu.safenetid.com/auth/realms/1UWUA52A8A-STA

voradmin mfa check-connection

Allows the admin user to check the connection to the OIDC provider.

Syntax

voradmin mfa check-connection <name_of_OIDC-configuration-url>

Example

C:\Windows\system32>voradmin mfa check-connection https://idp.eu.safenetid.com/auth/realms/1UWUA6OA8A-STA/.well-known/openid-configuration

Response 1: Success

Connection ok to https://idp.eu.safenetid.com/auth/realms/1UWUA6OA8A-STA/.well-known/openid-configuration

Response 2: Failure

Connection failed to https://idp.eu.safenetid.com/auth/realms/1UWUA6OA8A-STA/.well-known/openid-configuration-bad

voradmin mfa update-ports

Allows the administrator to update the OIDC ports.

• Updating the ports restarts the CipherTrust Transparent Encryption Multifactor Authentication application. Users must login to Multifactor Authentication again after the ports are updated.

If the OIDC-login-port is changed, then the redirect-URI for the OIDC application at the Multifactor Authentication provider must also be changed. It is specified in the format: http://127.0.0.1:<oidc-login-port>/auth/callback. If redirect-URI is not changed, CipherTrust Transparent Encryption may fail to connect to the provider.

Syntax

voradmin mfa update-ports <oidc-login-port> <oidc-notification-port>

Example

C:\Windows\system32> voradmin mfa update-ports 8000 8075

Response

Updated OIDC ports

voradmin mfa set-auth-expiry

Allows the admin to set an authentication expiry time.

Changing authentication expiry clears all existing MFA logins. Users must login again.

Syntax

voradmin mfa set-auth-expiry <time interval in minutes (specify 0 to disable expiry time)>

Example

C:\Windows\system32> voradmin mfa set-auth-expiry 5

Response

Authentication will expire every 5 minute(s).
Re-authenticate for new settings.