Single Registration: Web to Workstation

🚧

Beta Feature

This functionality is subject to change as the feature develops and we make improvements.

HYPR can be configured to only require pairing in one component of the HYPR system, instead of pairing separately with the Device Manager or the HYPR Passwordless client. When paired in one, users will be automatically prompted to complete the pairing on the other, and thereafter that pair will appear universally in all HYPR authentication rosters for that RP Application user.

What the User Sees

Following is the process a user experiences when they receive an invitation email:

1. Open the invitation email on your device.
2. Click the link to open the HYPR Mobile App and initiate pairing. Click Get Started to begin.
3. Complete the device's FIDO authentication when prompted. When completed, HYPR Mobile App displays the pairing on your device.
4. HYPR Mobile App obtains a certificate from the Certificate Enrollment Service, and alerts you when the workstation is ready. Click Continue. HYPR Mobile App displays the pairing on your deviceagain.
5. On the workstation, click Scan QR to Login. A QR code displays.
6. On the HYPR Mobile App, click the pairing label to open the account screen.
7. Click the matching QR icon beneath Tap to Unlock or press and Hold for Options.
8. Grant access to the Camera, if necessary, and scan the QR on the workstation screen.
9. You are passwordlessly logged into the workstation. HYPR Mobile App returns to the pairing roster.

Certificate Services Options

Single Registration can be deployed in one of two ways:

• Certificate Enrollment Service: HYPR Certificate Enrollment Service is designed to manage authentication certificates for end users enrolling with the HYPR Passwordless client and the HYPR Device Manager; when users add a new device to the Device Manager for a workstation authentication, Control Center (CC) will make REST API calls to the Enrollment Service to enroll the certificate on the user's behalf - and then transport this certificate to the user's mobile device; if the user follows the prompt, they will be prompted to renew the key's PIN
• HYPR Certificate Authority (CA) (coming soon): HYPR CA is designed for organizations that don't want to manage a PKI infrastructure, and instead will allow HYPR to manage a Certificate Authority purpose-built for their passwordless authentication

Certificate Enrollment Service

How It Works

• The HYPR Enrollment Service is a service running on a Windows computer (Windows 10 or Windows Server 2008/2012/2016/2019) hosted on-premises at the customer with network connectivity to Active Directory Certificate Services (AD CS)
• The service runs under the SYSTEM account
• The computer on which the service is running will have an Enrollment Agent (Computer) certificate enrolled and stored in the Local Machine certificate store
• A certificate template named HYPR Enrollment User will be defined for enrolling user certificates; that service will utilize the template to enroll user certificates on behalf of a specified user; the policy for this template will be set to require one signature from an Enrollment Agent
• The service will continually poll CC for certificate requests by invoking the api/certificate/requests endpoint with a secure API token; the service will attempt to enroll a user certificate on behalf of the specified user for each request
• The enrollment service uses the CertENROLL (a Microsoft-provided .dll that ships with every MS OS) ActiveX component to enroll user certificates
• When a userID is presented to the HYPR Enrollment Service, it will attempt to find the user in Active Directory; it will first try the lookup by User Principle Name (UPN), then via the mail attribute (email address)

👍

One of Us

The server where the Certificate Enrollment Service is installed must be joined to the domain and have persistent and reliable network connectivity with a domain controller and the Active Directory Certificate Services (AD CS) server.

📘

Private Space

Do not install the Certificate Enrollment Service on the Domain Controller or the AD CS server.
Install the Certificate Enrollment Service on a separate server in the same security tier/level.

What You'll Need

Windows and Active Directory

• Install the Certificate Enrollment Service on a Windows server
• Configure the Active Directory Certificate Services (AD CS) role

Control Center Settings

• You may use your existing RP Applications or create dedicated new ones to deliver the Single Registration experience; HYPR will match affected RP applications to each other to create a single registration for the account
• In the affected Web RP Application's Login Settings, Push Notifications must be enabled; this is required even if push authentication is not going to be used, so the Firebase credentials can be delivered to the HYPR Mobile App
• Generate an API access token (and store it securely) application with at minimum Application Configuration permissions for the Control Center Admin application before proceeding

• On the affected Web RP Application(s) Workstation Settings page, administrators must enter the rpAppId of the Workstation RP Application to be mapped to the Web RP Application

  

Installation

The Enrollment Service is distributed as an MSI installer package. The file name is HyprEnrollmentService_x64.msi. The installer has no user interface – it is intended to be installed by an IT professional on a server, where a GUI may not be available. Installation parameters must be passed on the msiexec command line

🚧

Private Space

Do not install the Enrollment Service on the Domain Controller or the AD CS server, but on a separate server in the same security tier/level.

👍

Administrator

Local Administrator or Domain Administrator privileges are required to install the HYPR Certificate Enrollment Service.

Installation Parameters

Verify the values in the download package's hypr.json file are correct for your environment.

The parameters are detailed here:

Many of these properties are also used in HYPR Passwordless client installation. See HYPR Passwordless client Installation Parameters for more details.

Install the Certificate Enrollment Service

Run the following batch file from a command prompt to install the service:

@echo off  
setlocal

if "%1%"=="" goto USAGE  
if not exist "%1%" goto USAGE

set RP="https\://<YOUR CONTROL CENTER URL>/rp"  
set APITOKEN="<YOUR WEB RP APP ACCESS TOKEN>"  
set HASH="\<SSL/TLS PUBLIC KEY PINNING HASH>"  
set TEMPLATE="<CERTIFICATE TEMPLATE NAME>"

msiexec /i %1 /qn /norestart /L\*V install.log HYPRRP=%RP% HYPRHASH=%HASH% HYPRTEMPLATE=%TEMPLATE% HYPRAPITOKEN=%APITOKEN% HYPRLOGLEVEL="5"

exit /b 0

:USAGE  
echo Usage: install "<path-to-msi>"  
exit /b 1

Configure AD CS

📘

Just One Example

Screenshots below were taken using Active Directory 2008. Your AD may have a different user interface if you're on a newer version.

To enroll certificates on behalf of another user, an Enrollment Agent certificate must be present on the Windows server where the HYPR Certificate Enrollment Service is running. In addition, a user template must be defined to allow user certificates to be issued.

The following instructions occur in the Microsoft Management Console Certificate Templates snap-in.

👍

Domain Administrator

DA privileges are required to create, configure, and deploy certificate templates.

Create the HYPR Enrollment Agent Template

1. Right-click the Enrollment Agent (Computer) template and choose the All Tasks → Duplicate Template menu option.

2. Name the new template HYPR Enrollment Agent.

3. Select the Security tab to display the current access control list for the template.

4. To tighten the access controls on the template, click Add… and add an entry for the computer where the HYPR Enrollment Service will be running.

5. Check the Allow column's box next to Enroll, then click Apply to save the template.

Create the HYPR Enrollment User Template

1. Duplicate an existing template (see Creating a Custom Certificate Template) and name it HYPR Enrollment User. This is the template that will be used to issue user certificates.

2. Select the Issuance Requirements tab.
3. Check This number of authorized signatures and give it a value of 1.
4. Set the Application Policy to Certificate Request Agent.
5. Click Apply to save the template.

Grant System Account Permissions

1. Right-click the server name and choose Properties.
2. On the Server Properties dialog, select the Security tab.
3. Select the server's computer account. Under the Allow column, check the box for Issue and Manage Certificates, then click OK.

4. On the Server Properties dialog, select the Certificate Managers tab. In the Certificate Managers pane, select the computer account you added in the previous step.
5. In the Certificate Templates pane, click Add... and choose the HYPR Enrollment User template. Click OK.

Enable the Templates

1. Right-click and select the New → Certificate Template to Issue menu option.
2. Select the HYPR Enrollment Agent and HYPR Enrollment User templates from the list.
3. Click OK to publish the certificate templates for use.

Deploy the HYPR Enrollment Agent Template

1. On the Windows server where the HYPR Enrollment Service is running, deploy the Enrollment Agent certificate to the Local Machine certificate store. Run certlm.msc.
2. Right-click Personal and choose Certificates.
3. Right-click Certificates and choose All Tasks → Request New Certificate.

4. Continue to click Next until the following dialog is displayed.

5. Choose the HYPR Enrollment Template and click Enroll to deploy the Enrollment Agent certificate to the Windows server.

Configuring Active Directory (AD) Users

Before a user can start the web registration flow, their AD user account must be configured as follows:.

1. In the management console, click Start.
2. Navigate to Active Directory Users and Computers.
3. In the top menu, click View -> Advanced Features.
4. Select the user that you will invite to register.
5. Under the General tab, enter the user's email address into the E-mail field.
6. Click the Attribute Editor.
7. Scroll down, click the mail attribute, and enter the user’s email address.