(ARCHIVED) Advanced Authentication. No password, Single Sign On, MFA and beyond?

Jason He Updated by Jason He

Security is always a hot topic. DeskDirector has some great authentication solutions implemented - that are always improving!

Passwordless using one-use tokens sent to the mailbox

We have had passwordless logins for many years. It is our most popular method of authentication into the Portal.

This is where we send a one-time use token to the users mailbox. The user doesn't have to remember a password and access remains as secure as the users mailbox.

The concept of passwordless came out around 2010 or maybe even earlier. It is adopted by many applications, such as Slack, Microsoft, Medium, Twitter and WhatsApp. It is operated by sending SMS or email to given user which contains a short lived token used for login.

For more detail on passwordless, you can read Auth0 product page or Auth0 blog page.

For DeskDirector passwordless feature, we have default settings on the token and they are listed below:

  • The token is numeric
  • The token length is 6 chars
  • Token expiry is 10 minutes
  • Within this time, the token won't be removed on use
  • The token is invalidated after 10 failed tries

In general, the configuration we have now is secure because it is nearly impossible to guess 6 digit numeric combination in 10 tries.

These Passwordless features are currently only configurable by our consulting team for Dynamic clients only. We will be bringing self service into the Admin Console in the near future for everybody.

Passwordless tokens can be activated on a company by company basis.

Read more about it here: Logging in with Passwordless

Single Sign on using Active Directory

If our Windows client is running in a Microsoft Active Directory Domain, we can silently log the user using the Domain credentials. This is the most streamlined way to authenticate a login.

Read more about it here: Logging in with Active Directory

2FA and MFA

The reason we call that as 2FA is similar to OAuth. As long as your email provider provide 2FA then passwordless is 2FA. Since you need access to email before you can login, thus, 2FA is checked during user access to their email account.

DeskDirector has held off implementing an SMS variation while we see how the debate on SMS security as a 2FA option plays out. There are ways to compromise an SMS token and we are reviewing this regularly.

On a purely practical data level, we find that almost every contact has an email address but many don't have a mobile number. Lastly, mobile numbers are also entered in many variations and formats.

Office 365 login

This is the solution of the future for customers that need more. If you want industry-strength Multi-Factor Authentication and/or conditional (i.e. times/places) authentication, Office 365 Auth is for you. Office 365 accounts are AzureAD accounts and AzureAD delivers all these capabilities exceptionally well. There's a whole universe of security options available.

The best security implementation is clean and simple. With Office 365, we get Microsoft's AzureAD to do all the hard security work. When the user tries to login to us, we send them to Microsoft to get an authentication sorted out. Microsoft then reports either the login is successful or not. This is the future for all authentication.

Read more about it here: Enabling OAuth (Microsoft Login) for DeskDirector Portal

Other DeskDirector authentication options

If you want to go back to the 1960s and use passwords to login instead of all these advanced authentication methods that we implemented - we still got you covered. Read more about it here: Setting/Resetting a Contact's Password

You can also login to DeskDirector using a URL. Read more about it here: Global Magic Token: Logging in via URL

How did we do?

Contact