Configuration and usage notes

When the SKA is launched using the Change Password button, it automatically closes after two minutes if no activity takes place on the web page, which is default Windows behavior. The page can also be configured to close after a pre-determined amount of time regardless of activity using the Timeout option.In this case, the user is notified 30 seconds before the session is terminated.

Once countdown hits 0 it will wait for 2 minutes before it closes automatically. Clicking OK on the countdown prompt after it reaches 0 closes the SKA page immediately. Clicking OK when the countdown is still running closes the Login Assistant page after the remaining amount of time.

The Credential Provider add-on uses the help account to login and execute runurl to launch the SKA. When the Credential Provider is installed, it is recommended that you configure the help account with a random password and that you do not advertise the help account to users. In this setup, the help account should only be used by the Credential Provider add-on, and users should access Bravura Pass through the Credential Provider.

When using a VPN to connect to the instance, runurl will search for one of three HTML tags used to uniquely identify the Bravura Pass login page. The tags expected by runurl are:

If runurl cannot identify any of these values, it will default to attempting a reconnection through other means.

When VPN connection credentials is changed, you can use skautil to update the encrypted VPN credential, the help account, and their cached password values kept in registry. This utility does not change the actual underlying password.

See skautil usage information .

When the SKA remote connection fails, debugging information is provided in the SKA progress window which displays on the right bottom corner on the locked-down SKA page. By enabling a registry key called debugska, the debugging information also can be captured in a log file which is generated by using logutil. The following example demonstrates how to capture dubugging information:

See logutil usage information.

The Local Reset Extension updates locally cached passwords on the end-user’s PC by re-authenticating to the domain using the new password. The Bravura Pass server will typically reset the user’s password on one domain controller ("DC1"), while the user’s PC will attempt to authenticate to another domain controller ("DC2"). This creates a risk that the new password has not yet propagated from DC1 to DC2, or to other "upstream" DCs such as the PDC Emulator , before the user’s PC attempts re-authentication.

While Bravura Pass always issues password resets to Active Directory before attempting the cache-refresh authentication, it is still possible for network congestion or other factors to result in the subsequent authentication attempt failing.

To mitigate the risk of timing-induced failures, Bravura Security recommends using Bravura Pass ’s sub-host plugin feature to dynamically control which domain controllers receive password resets. If this is not practical, other mitigation strategies may also be considered:

Enterprises should consider whether remote, end-user password reset scenarios should be part of disaster recovery (DR) planning. If required for DR, then multiple VPN end points should be used, in at least two different regions or physical locations. Furthermore, enterprise Active Directory architects should be consulted on suitable Active Directory site layout changes needed to leverage those end points.