Login Assistant software
Login Assistant is composed of:
The secure kiosk account SKA, working with client software (
runurl)Credential Provider extensions for Windows 8 and newer
Methods of secure kiosk account implementation
There are two main methods that you can use to implement a secure kiosk account (SKA):
Domain-level account
A domain-level secure kiosk account is a network login account defined in an Active Directory domain. It typically has a help login ID. A security policy is applied to the help account that restricts access to the operating system and network resources when using the SKA.
Workstation-level account
A help account is defined on a user’s workstation instead of in a network operating system directory such as a Windows domain. The account is added to the Log on Locally user rights assignment policy. Users can then log into their workstations with the local ID help . Logging into the account launches the SKA.
Credential Provider for Windows
Working with the help account, the Bravura Pass Credential Provider software provides a Change my password tile on the Windows login screen.
Clicking the tile logs into the help account, which launches the SKA and allows users to change their passwords and unlock their accounts using Bravura Pass . The Credential Provider extension works with both the local and domain-level help account.
If a user is locked out of their account because the password has expired, or an incorrect password has been entered too many times, they may want to change their password using Bravura Security Fabric . The user can click Switch User or Other Credentials to access the Change my password tile.
When the user clicks on the tile or logs in with the help account, Login Assistant starts a web browser with the help account’s limited permissions and security profile.
Remote access
The Login Assistant client allows locked-out users to connect to the Internet over a WiFi hotspot or using an AirCard. Locked-out users can also establish a temporary Internet connection using their home Internet connection or a hotel Internet service.
When the Login Assistant is run, it can do an immediate check to see if it is connected to the Internet using the external URL and expected data as specified during installation . If connected, then it immediately works the same as a regular Login Assistant.
If it cannot connect to the Internet, a prompt asks users to select how to connect, with these options:
Wired attempt another direct connection
WiFi allow the user to select a WiFi network to connect through
AirCard use a wireless stick if configured.
If WiFi is selected, the Login Assistant displays a list of detected networks, allowing the user to select one and potentially enter a network key.
A Hidden Network... button allows the user to specify an SSID and password for a hidden wifi connection.
If AirCard is selected, the Login Assistant will display the third party application. Once the user has connected the application will disappear.