Product manual

41
The ESA SMS Users group contains all users in your domain that have been enabled for SMS OTPs
ESA Mobile App Users
The ESA Mobile App Users group contains all users that have been enabled for mobile application OTPs.
Group membership is updated in real-time when users are configured in the ADUC. Finding all users that have been enabled for
SMS OTPs (for example), is simple:
1. Launch the ADUC
2. Right-click on your domain node, and select Find
3. Type in "ESA SMS" and hit Enter - the group will be displayed in the Search Result section
4. Double click on the group and select the Members tab to view all users in your domain that have been enabled for SMS OTPs.
11. Advanced VPN Topics
This chapter contains the detail of all the options available when configuring two factor authentication for your VPN.
11.1 VPN Authentication Options
This section contains the detail of the options available when configuring a RADIUS client using the ESA Management Console.
11.1.1 SMS-based OTPs
This scenario occurs if the user is configured to use only SMS-Based OTPs and the RADIUS client is configured to use SMS-based
OTP authentication.
In this configuration, a user logs in with their Active Directory password. The first authentication attempt by the VPN client will
fail to authenticate and the user will be prompted to enter their password again. At the same time, the user will receive an SMS
with their OTP. The user then logs in with the OTP contained in the SMS. The second authentication attempt will grant access if the
OTP is correct.
This sequence is depicted in Figure 1: RADIUS SMS OTP Authentication.
Supported authentication protocols: PAP, MSCHAPv2.