[et_pb_section bb_built=”1″ _builder_version=”4.16″ custom_padding=”0px||3px|||” global_colors_info=”{}” next_background_color=”#000000″][et_pb_row _builder_version=”4.16″ background_size=”initial” background_position=”top_left” background_repeat=”repeat” custom_padding=”||0px|||” global_colors_info=”{}”][et_pb_column type=”4_4″ _builder_version=”4.16″ custom_padding=”|||” global_colors_info=”{}” custom_padding__hover=”|||”][et_pb_text admin_label=”Text zu NIS-2, MFA & Keycloak” _builder_version=”4.27.4″ text_line_height=”1.8em” vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ z_index_tablet=”0″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” global_colors_info=”{}” background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” text_text_shadow_horizontal_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_vertical_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_blur_strength=”text_text_shadow_style,%91object Object%93″ link_text_shadow_horizontal_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_vertical_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_blur_strength=”link_text_shadow_style,%91object Object%93″ ul_text_shadow_horizontal_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_vertical_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_blur_strength=”ul_text_shadow_style,%91object Object%93″ ol_text_shadow_horizontal_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_vertical_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_blur_strength=”ol_text_shadow_style,%91object Object%93″ quote_text_shadow_horizontal_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_vertical_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_blur_strength=”quote_text_shadow_style,%91object Object%93″ header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ header_2_text_shadow_horizontal_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_vertical_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_blur_strength=”header_2_text_shadow_style,%91object Object%93″ header_3_text_shadow_horizontal_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_vertical_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_blur_strength=”header_3_text_shadow_style,%91object Object%93″ header_4_text_shadow_horizontal_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_vertical_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_blur_strength=”header_4_text_shadow_style,%91object Object%93″ header_5_text_shadow_horizontal_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_vertical_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_blur_strength=”header_5_text_shadow_style,%91object Object%93″ header_6_text_shadow_horizontal_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_vertical_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_blur_strength=”header_6_text_shadow_style,%91object Object%93″]<\/p>\n
Multi-factor authentication (MFA) is nothing new, but the multi-step login method was only intended for privileged accounts until a few years ago. With the requirements of the new cyber security guidelines in NIS-2, multi-factor authentication has suddenly become state of the art. And for all types of users. In addition, the legislator recommends the use of continuous authentication<\/a>, which only a few major players, such as Google, have implemented to date.<\/p>\n But let’s stay with multi-factor authentication methods first. Multi-factor authentication can be implemented app-controlled in various ways:<\/p>\n Historically, analog TAN lists<\/strong> were one of the very first MFA methods. Most users no longer use this option. They are cumbersome to send by post and only offer limited security.<\/p>\n Hardware tokens offer a very good level of security for MFA. These include USB keys or smartcards, such as the ProID smartcard<\/a> from the Czech company Monet+. Smartcards are widely used, including debit cards and health insurance cards.<\/p>\n Which method and which end devices or tools should be used to implement MFA depends entirely on the use case. Is the MFA technology to be implemented for employees or is this secure authentication method also needed for external users, such as partners, suppliers, temporary workers, customers, members, citizens or patients?<\/p>\n It is advisable to analyze in advance which systems and identities the company wants to protect with MFA technology. If there is a hybrid landscape of applications for internal and external purposes, it makes sense to connect Keycloak to directory services such as Active Directory (AD) and LDAP with the help of user federation. At the same time, it is easy to connect http-based applications via Keycloak as a \u201cbroker<\/a>\u201d if these web applications are connected to the Identity Broker via OIDC or SAML.<\/p>\n Initially, it is important to define which system is responsible for the identities. Keycloak can act as the central user administration, but it does not have to. An Active Directory (AD) can therefore continue to be the central identity store. Keycloak is then connected to AD via User Federation in order to centrally manage the authentication of all identities via its single sign-on<\/strong> function.<\/p>\n Conclusion: The use of Keycloak in multi-factor authentication makes it possible to continue using existing services such as Active Directory or Entra ID. With an appropriate app- or hardware-based technology, Keycloak is a valuable tool for implementing MFA in accordance with the NIS-2 directive.<\/p>\n That was: NIS-2: Implementing multi-factor authentication with Keycloak<\/em><\/p>\n [\/et_pb_text][et_pb_image admin_label=”in-Trennlinie” src=”https:\/\/login-master.com\/wp-content\/uploads\/2021\/07\/trennlinie-in-login-master-transparent-70-1500×100-opt-1.png” _builder_version=”4.27.4″ vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ custom_padding=”||0px||false|false” z_index_tablet=”0″ box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” global_colors_info=”{}” background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” \/][et_pb_text admin_label=”Quellenangaben” _builder_version=”4.27.4″ text_line_height=”1.8em” vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ min_height=”604.2px” z_index_tablet=”0″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” global_colors_info=”{}” background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” text_text_shadow_horizontal_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_vertical_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_blur_strength=”text_text_shadow_style,%91object Object%93″ link_text_shadow_horizontal_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_vertical_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_blur_strength=”link_text_shadow_style,%91object Object%93″ ul_text_shadow_horizontal_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_vertical_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_blur_strength=”ul_text_shadow_style,%91object Object%93″ ol_text_shadow_horizontal_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_vertical_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_blur_strength=”ol_text_shadow_style,%91object Object%93″ quote_text_shadow_horizontal_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_vertical_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_blur_strength=”quote_text_shadow_style,%91object Object%93″ header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ header_2_text_shadow_horizontal_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_vertical_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_blur_strength=”header_2_text_shadow_style,%91object Object%93″ header_3_text_shadow_horizontal_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_vertical_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_blur_strength=”header_3_text_shadow_style,%91object Object%93″ header_4_text_shadow_horizontal_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_vertical_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_blur_strength=”header_4_text_shadow_style,%91object Object%93″ header_5_text_shadow_horizontal_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_vertical_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_blur_strength=”header_5_text_shadow_style,%91object Object%93″ header_6_text_shadow_horizontal_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_vertical_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_blur_strength=”header_6_text_shadow_style,%91object Object%93″]<\/p>\n Adaptive authentication Google’s security mechanisms for the login Microsoft already confirmed in 2020 that almost 100% of all compromised accounts did not use MFA. RWTH Aachen University, Blog on MFA securityKeycloak supports MFA out-of-the-box<\/h3>\n
\n
\nAnyone who has a Google account or uses online banking is certainly familiar with this method. You receive a push notification on your cell phone and approve this request using a PIN code or a biometric procedure. Keycloak can act as an MFA enabler here in conjunction with third-party providers such as the Microsoft Authenticator app. However, the danger here can be MFA spamming, which you can read about in more detail on intension’s IAM blog:
\nhttps:\/\/www.intension.de\/infoblog\/was-ist-mfa-fatigue\/<\/a><\/li>\n<\/ul>\n\n
\nWith one-time password generators (OTP), such as FreeOTP or Google Authenticator, Keycloak can be configured as a reliable MFA tool in no time at all. You can find out more here: One Time Password (OTP) policies<\/a><\/li>\n<\/ul>\n\n
\nThis is a less secure method of requesting the second factor. The German Federal Office for Information Security (BSI) advises against this method of confirmation. You can read more about this on the RWTH Aachen University blog<\/a> or from the BSI<\/a> itself.<\/li>\n<\/ul>\n\n
\nPasskeys are a new, more secure and user-friendly method of authentication. These make passwords superfluous. Users no longer have to remember a complex password. This is because passwords are susceptible to phishing and other attacks. Passkeys, on the other hand, use cryptographic keys that they store securely on the user’s device. These keys are unique and bound to the device, which makes them extremely secure. Login to other devices is supported via QR codes.
\nYou can find out more about passkeys from the German Federal Office for Information Security<\/a>.<\/li>\n<\/ul>\nSecure MFA procedures with hardware tokens<\/h3>\n
Various MFA technologies for internal or external users<\/h3>\n
Keycloak and AD are not mutually exclusive<\/h3>\n
Sources:<\/h3>\n
https:\/\/patents.google.com\/patent\/US10630693B1\/en<\/a><\/p>\n
https:\/\/cloud.google.com\/blog\/products\/identity-security\/best-practices-for-a-more-secure-login-in-google-cloud?hl=en<\/a><\/p>\n
https:\/\/cloud.google.com\/blog\/products\/identity-security\/best-practices-for-a-more-secure-login-in-google-cloud?hl=en<\/a><\/p>\n
https:\/\/blog.rwth-aachen.de\/itc\/2024\/01\/03\/sicherheitsmechanismen-kurz-erklaert-mfa\/<\/a><\/p>\n