As you probably have been reading in my previous posts, I’ve been talking about FIDO2 keys, and how it can be used as a secondary authentication when signing in AzureAD.
Today, I want to talk about OATH hardware Tokens, known as Time-based One Time Password Tokens as well.
As you are aware, some authentication methods can be used as the primary factor when you sign in to an application or device, such as using a FIDO2 security key or a password. Other authentication methods are only available as a secondary factor when you use Azure AD Multi-Factor Authentication or SSPR.
The following table outlines when an authentication method can be used during a sign-in event:
But, OATH TOTP is an open standard that specifies how one-time password (OTP) codes are generated. OATH TOTP can be implemented using either software or hardware to generate the codes. OATH TOTP hardware tokens typically come with a secret key, or seed, pre-programmed in the token.
In this post, I will show you how the OTP C200 token from Feitian can be configured in Azure AD and how it works.
First of all, what you have to do is to register the key in Azure AD, in order to do this, you will need the Serial Number from the Key, and the secret key provided by the manufacturer, and then you need to create a CSV file with all the information:
Once you have done this, these keys must be input into Azure AD: Multifactor authentication – Microsoft Azure
Upload the file, and activate the key in the portal, once it is have been done, it will show you a screen like the following:
If you have any error during the upload, it will be shown in the portal itself:
You must consider that you can activate a maximum of 200 OATH tokens every 5 minutes.
Also, as you probably figure out, users may have a combination or OATH Hardware tokens, Authenticator App, FiDO Keys, etc…
Be aware that users con configure their default sign in method in the security info web: My Sign-Ins | Security Info | Microsoft.com
So, once the key has been configured for the user, which is the flow to access to the account?
I have compared the Authentication flow with the Fido2 Key Flow, the difference that you can appreciate is with FiDO2 Keys is not necessary to include my password
Finally, check out the following table from Microsoft, where you can see different persona cases and which passwordless technology can be used for each one of them
IMHO, FiDO Keys are great, but thinking as an end user they have problem: the first setup: We must rely on end user about how they configure the key and associate it with azure AD (remember the previous table). FiDO keys has the advantage to be able to be used to sign in instead of using a password in the computer.
In the other hand, OAUTH keys are great, because you as an administrator, can configure the keys in the AAD Portal, and once have been activated provide them to end users, without necessity to do any other action from the end user perspective, and the most important part, are very easy to use
Thanks to Feitian for providing such amazing tokens
Albandrod's Memory 