SurePassID ServicePass User Guide

SurePassID Authentication Server

SurePassID, Corp.

Introduction

This technical guide shows how users can manage their SurePassID security tokens that are compatible with SurePassID Authentication Server.

SurePassID Authentication Server increases the security of online identities and significantly improves an organization’s resistance to identity theft attacks such as phishing. It addresses the real-world demand of strong authentication, making it easier to use while helping to reduce deployment and management costs.

Prerequisites

Before you start

Complete the following steps before configuring SurePassID ServicePass to work with SurePassID Authentication Server:

• You will need an Android or iOS capable device such as a mobile phone or tablet.

• Open and configure a SurePassID Authentication Server account. If you have not already done so, open an account at www.SurePassID.com.

• Your system admin needs to install ServicePass.

What is SurePassID ServicePass?

SurePassId ServicePass is a web portal for managing OTPs, push authenticators, and FIDO2 tokens. Available as both customizable installable image and an open-source solution, ServicePass enables users to manage authentication tokens independently, reducing help desk costs.

Supported Tokens

ServicePass supports all the security tokens that SurePassID Server supports.

Soft Tokens:

• SurePassID Mobile Authenticator (OATH OTP and push authentication)

• SurePassID Desktop Authenticator

• Mobile OTP

• SurePassID Google Authenticator

• SurePassID FIDO2 Tokens

Hard Tokens:

• SurePassID TapID

• SurePassID Display Card

• SurePassID TapID Treo

• SurePassID OTP Key FOB

• OATH compatible tokens

• SurePassID FIDO2 Tokens

Capabilities

ServicePass offers all the functionality users need to manage their mobile and hardware tokens. The system provides the following capabilities:

• Token Registration and Activation

• Token Synchronization

• Lost Token Disablement and Re-Issuance

• Automated Notifications

• Password Change & Reset

• SurePassID API Advanced features

• Integration into 3^rd Party applications

Depending on the system configuration by your system administrator, all of these capabilities may or may not be present for you when you log into ServicePass.

SurePassID ServicePass Login

Enter the SurePassID URL into your browser and you will be presented with the following login form:

ServicePass Login

Enter your Username and Password and press the Login button. If your credentials are accepted you will be presented with the following two-factor form:

NOTE: Depending on how the system is configured you might not be required to use the two-factor form to log in. You will see the home page instead.

You will need to securely login to your account using a two-factor authentication method. One such method is to use a One-Time Passcode (OTP). You can also login with a FIDO2 token if it is already registered to SurePassID and you are using a FIDO2 certified web browser such as Chrome or Firefox.

If you have already registered a FIDO2 key for this site, then the system will automatically look for the FIDO2 token and make it blink. You just need to press the button on the FIDO2 token and you will be logged in (if you have the correct token of course!).

Just insert your FIDO2 token, wait for the token to blink, and then press the button on the token. If the token is valid for your account the SurePassID Home form will be displayed. If the login fails, you can click the Verify FIDO button to re-attempt FIDO authentication.

If the Forgot Password link is available (depending on system administrator configuration), it can be used for password recovery. The recovery process consists of two steps: first, a password recovery email containing a recovery link will be sent; then, by clicking the provided link, users will be able to change their password.

After successfully logging into the system, you will see the ServicePass home screen as shown below.

SurePassID ServicePass Home Page

ServicePass forms follow a consistent structure with clearly defined sections for straightforward navigation. The home page is organized into these sections:

• Information Section (gray background) – For the home page, this is comprised of the following sub-sections:

  • Page Information – Information that describes the purpose of the page and the available options for the user. Most ServicePass pages only have one Page Information sub-section.

  • Token List – List of tokens (by serial number) assigned to the user. The currently selected token is highlighted. This is a feature of the home page only.

  • Token Action Bar – Actions that can be performed on the currently selected token. This is a feature of the home page only.

• Action Bar – Actions the user can take on the currently selected token. All ServicePass pages have an Action Bar.

• Token Information – Detailed information about the currently selected token such as token type, token status, etc. All ServicePass pages have a Token Information section.

The sections are depicted on the page shown below.

Adding a Mobile Token

If your administrator has allowed you to add a mobile token to your account, you can press the Add Mobile Token button to add a new mobile token to your account as shown below:

Once a mobile token is added, it appears in the token list and is highlighted as the currently selected token. Selecting the Activate Token button in the action bar initiates the activation process for the mobile token, enabling access to systems such as VPN, Windows Login, Linux Login, and various websites.

To activate mobile tokens, users need to install a mobile authenticator app on their device, such as SurePassID Authenticator, Google Authenticator, or any other OATH OTP-compliant app. ServicePass provides step-by-step instructions for this process in the Activating Mobile Tokens section.

Note: The mobile token type that is added (SurePassID Authenticator, Google Authenticator, etc.) is determined by your system administrator that configured ServicePass.

Adding a FIDO2 Token

If your administrator has allowed you to add a U2F token to your account, you can press the Add U2F Token button to add a new U2F token as shown below.

After adding a FIDO2 token to your account, you can add a FIDO2 key to your FIDO2 token list allowing you to use your FIDO2 token to login to the ServicePass site as well as other SurePassID protected FIDO2 sites and apps.

The Adding FIDO2 Key section will provide you with the instructions you need to add a FIDO2 key to your FIDO2 token list.

Note: The FIDO2 token type that is added (such as SurePassID TapID Treo FIDO2 token) is determined by your system administrator that configured ServicePass.

Adding FIDO2 Key

A FIDO2 key is a binding between an origin URL, such as https://servicepass.surepassid.com, and your user account at that URL. After adding a key for a particular origin to your FIDO2 token list, you can then use that FIDO2 token to login to that URL.

Removing FIDO Key

To remove a FIDO2 key from your FIDO2 token list, press the Delete FIDO Key button as shown below.

When the token is successfully removed, you will see the following form below.

This token can no longer be used for this URL.

Activating Mobile Tokens

Activating a mobile token is the process of taking a mobile token that is assigned to your account and adding that mobile token to a mobile token app on your mobile device where the token can generate passcodes for only your account.

SurePassID ServicePass can activate SurePassID mobile tokens the following ways:

• Instant Activation – Click an instant activation link on your mobile device (SMS or mobile email) and the token will be instantly activated on your mobile device without user interaction.

• Scan QR Code – Use the mobile token app on your mobile device to scan a QR code for a mobile token.

Besides activating a token while you are logged into ServicePass, your system administrator can send you an activation message via email or SMS. The activation message will contain a link for Instant Activation or QR Code Activation and may not require you to login to ServicePass.

What is Instant Activation?

Instant Activation is a method of installing SurePassID Authentication tokens using over-the-air provisioning. This means the user can just click on a token activation link and the following steps will happen:

1. SurePassID ServicePass will automatically launch on the mobile device

2. The token will be pulled down from the server, installed into SurePassID ServicePass and locked from further activations.

Instant Activation requires that the link must be clicked on the user’s mobile device. The link can be displayed on a mobile browser web page, embedded in an email, or in an SMS text message. SurePassID provides you many different and efficient methods to implement for very large organizations.

The instant activation link will be in the format of:

>

For example:

https://sandbox.surepassid.com/oath-ota-provision/pLxP0-NOkz1-dxgo1

HINT: This is the easiest and most secure way to add a SurePassID mobile token to the mobile token app.

NOTE: If you are using SurePassID Server installed in your datacenter, (not in the cloud) then you will need to use the SurePassID Mobile Connector or ServicePass to allow users to activate their tokens.

Activating

To start the activation process, press the Activate Token button from the home page as shown below:

Then you will see the following form:

If you need to download the SurePassID Authenticator press the appropriate download link for your mobile operating system and then install the SurePassID Authenticator mobile app.

Note: If the mobile token to be activated is a Google Authenticator token, then the download links will change to the Google Authenticator download.

Note: Your system administrator might have sent you an email or SMS notification that takes you straight to this page. For example: https://servicepassurl/activate.aspx?tokenid=<tokenid> where tokenid is the mobile tokenID.

Press the Activate button and the following form will be displayed:

This system was configured to allow you to activate the mobile token via Instant Activation, QR Code Activation and Manual Activation. Here are the steps to follow for each method:

NOTE: Not all activation methods may be available to you depending on system administrator choices.

Instant Activation

1. Click the icon to the left of the Instant Activation link URL. This will send the Instant Activation link URL to your mobile device via SMS.

2. Once you receive the SMS message, click on the link. The SurePassID Authenticator mobile app will start and download the mobile token and start generating codes.

Scan QR Code

1. Start the SurePassID Authenticator app on the target mobile device. In this example, we will use the Android version

2. The current SurePassID Authenticator has a (+) button in the lower right to add a new token. Press the (+) button and a menu will be displayed.

3. Select Scan QR Code for Account from the menu. The SurePassID Authenticator is now waiting for a bar code to scan. Use a bar code scanning app on the mobile phone or download a bar code scanning app from your app store.

Manual Entry

1. Start the SurePassID Authenticator app on the target mobile device. In this example, we will use the Android version.

2. The current SurePassID Authenticator has a (+) button in the lower right to add a new token. Press the (+) button and a menu will be displayed. On an iOS device, the button will be top right.

3. Select Download From Cloud and enter the Token ID.

To verify and finalize activation of your mobile token, select the token in the SurePassID Authenticator App (or Google Authenticator), enter the displayed code for the account you just downloaded into the Code From Mobile App To Verify field and press the Verify Code button as shown below. If your token is configured correctly, you will see the following form:

You are all set!!

Press the icon to return to the home page.

Installing the SurePassID Authenticator App

To install the SurePassID Authenticator mobile application, follow these steps.

Download the SurePassID Authenticator app from the Play Store (Android) or iTunes (iOS) and follow the instructions to install on your mobile device. You can find the SurePassID Authenticator app by searching for SurePassID Authenticator as shown below.

Select the SurePassID Authenticator and you will see the form below.

Click Install.