View source for PrivacyIDEA Credential Provider for Domain User Login with 2FA

[[Main_Page|Home]] > [[PrivacyIDEA Credential Provider for Domain User Login with 2FA]]


= Steps to Install and Configure PrivacyIDEA Credential Provider for Domain User Login with 2FA =

== Prerequisites ==
Before installing the PrivacyIDEA Credential Provider, ensure the following requirements are met:

# The Windows machine must be joined to the Active Directory Domain.
# Network communication between the Windows machine and the PrivacyIDEA server must be allowed.
# Domain users must have a valid token enrolled in PrivacyIDEA (for example, TOTP token).

== Step 1: Download the PrivacyIDEA Credential Provider ==

Download the PrivacyIDEA Credential Provider installer from the following link:

[https://github.com/privacyidea/privacyidea-credential-provider/releases/download/v3.8.0.0/privacyIDEACredentialProviderSetup-v3.8.0.0.msi PrivacyIDEA Credential Provider Download]

== Step 2: Install the PrivacyIDEA Credential Provider ==

# Run the downloaded installer.
# The Installation Wizard will appear. Click '''Next'''.
# In the '''End User License Agreement''' page:
#* Select '''I accept the license agreement'''.
#* Click '''Next'''.

=== Configuration Page 1/6 ===

# In the '''HTTPS''' field, enter the PrivacyIDEA server IP address.
# Enable the following options:
#* Ignore Unknown CA
#* Ignore Invalid Common Name
# Click '''Next'''.

=== Configuration Page 2/6 ===

Enable the following options:

# Prompt for username and password in first step
# Send domain password to PrivacyIDEA
# Show option to reset the authentication
# Create a detailed logfile (for debugging)

Click '''Next'''.

=== Configuration Pages 3/6, 4/6, 5/6, and 6/6 ===

# Keep the default settings.
# Click '''Next''' on each page.

After reaching the final page, click '''Install'''.

Once the installation is completed, click '''Finish'''.

== Step 3: Configure PrivacyIDEA Registry Settings ==

After the installation is complete, configure the required registry values.

# Press '''Win + R'''.
# Type the following command:

<code>
regedit
</code>

# Navigate to the following registry path:

<code>
HKEY_LOCAL_MACHINE\SOFTWARE\NetKnights GmbH\PrivacyIDEA-CP
</code>

=== Allow Local Administrator Login Without TOTP ===

# Locate '''excluded_account'''.
# Set the value to:

<code>
.\Administrator
</code>

This allows the '''local Administrator account''' to log in without requiring TOTP.

=== Test Local Administrator Login with PrivacyIDEA ===

# Log out from the system.
# Log in using the '''local Administrator account'''.
# Confirm that the login works '''without TOTP authentication'''.

;Note:
If the above login works successfully, then only proceed with enabling the filter. Otherwise, you may get locked out of the system.

=== Enable Credential Provider Filtering ===

To remove the default Windows credential provider and enforce PrivacyIDEA authentication:

# Locate the registry key '''enable_filter'''.
# Set the value to:

<code>
1
</code>

This ensures that PrivacyIDEA authentication is enforced as the default system credential provider and disables the Windows credential provider.