SAP Token/english - Revision history

Ulrich.Klein at 10:24, 24 October 2017

2017-10-24T10:24:49Z

← Older revision		Revision as of 12:24, 24 October 2017
Line 43:		Line 43:
	The link is made at https://my.scc.kit.edu/token/index_en.php#/new-token		The link is made at https://my.scc.kit.edu/token/index_en.php#/new-token

	After logging in with your personal KIT account, the Link "New token" dialog will be displayed. Please enter the last six digits of the serial number in the Serial Number field. You will find these on the back of the token.		After logging in with your personal KIT account, and selecting English in the top row the Link "New token" dialog will be displayed. Please click "New Token" and then "KIT Token". Please enter the last six digits of the serial number in the Serial Number field. You will find these on the back of the token.

	[[File:Token seriennummer.jpg\|400px]]		[[File:Token seriennummer.jpg\|400px]]

	After clicking on "~~Next~~", the current value of the token is queried in the next dialog. Rotate the token so that the button is to the left of the display		After clicking on "Continue", the current value of the token is queried in the next dialog. Rotate the token so that the button is to the left of the display

	[[File:token_off.jpg\|400px]]		[[File:token_off.jpg\|400px]]
Line 55:		Line 55:
	[[File:token_code.jpg\|400px]]		[[File:token_code.jpg\|400px]]

	Next, enter the valid value displayed (in the example 464230) in the "Current ~~token~~ ~~code~~" field and click on "Confirm ~~token~~". Please note that this value is only valid for one minute. The data entered is then checked and the link is made. You will be forwarded to the "Token overview".		Next, enter the valid value displayed (in the example 464230) in the "Current Token Code" field and click on "Confirm Token". Please note that this value is only valid for one minute. The data entered is then checked and the link is made. You will be forwarded to the Token overview.

	This overview can also be accessed later on at any time via https://my.scc.kit.edu/token		This overview can also be accessed later on at any time via https://my.scc.kit.edu/token.

	At this point you have the possibility to register a ~~service~~ mobile phone in addition to the display token ~~under "new token"~~ or to create and print a backup list. We recommend that you use one of these options to be prepared for cases such as defect or loss of a token.		At this point with the button "New Token" you have the possibility to register a KIT business mobile phone in addition to the display token or to create and print a backup list. We recommend that you use one of these options to be prepared for cases such as defect or loss of a token.

	=== Issue and return of the tokens ===		=== Issue and return of the tokens ===

Ulrich.Klein at 09:40, 24 October 2017

2017-10-24T09:40:18Z

← Older revision		Revision as of 11:40, 24 October 2017
Line 41:		Line 41:
	Once you have registered a first token, token management can no longer be called without tokens.		Once you have registered a first token, token management can no longer be called without tokens.

	The link is made at https://my.scc.kit.edu/token/~~register~~		The link is made at https://my.scc.kit.edu/token/index_en.php#/new-token

	After logging in with your personal KIT account, the "Link ~~new~~ token" dialog will be displayed. Please enter the last six digits of the serial number in the Serial Number field. You will find these on the back of the token.		After logging in with your personal KIT account, the Link "New token" dialog will be displayed. Please enter the last six digits of the serial number in the Serial Number field. You will find these on the back of the token.

	[[File:Token seriennummer.jpg\|400px]]		[[File:Token seriennummer.jpg\|400px]]

Ulrich.Klein at 17:10, 23 October 2017

2017-10-23T17:10:41Z

← Older revision		Revision as of 19:10, 23 October 2017
Line 73:		Line 73:

	Please note: the issue of a hardware token can be combined with certification by the KIT-CA without any problems, thus saving you unnecessary ways.		Please note: the issue of a hardware token can be combined with certification by the KIT-CA without any problems, thus saving you unnecessary ways.

	[[Category: PC FAQ]]

Ulrich.Klein at 12:47, 23 October 2017

2017-10-23T12:47:58Z

← Older revision		Revision as of 14:47, 23 October 2017
Line 67:		Line 67:
	After the introduction of two-factor authentication, new employees receive their hardware tokens at the following locations:		After the introduction of two-factor authentication, new employees receive their hardware tokens at the following locations:

	~~Campus Nord~~ Service Desk of the SCC at Campus ~~Nord~~		Service Desk of the SCC at Campus North
	~~South Campus~~ Service Desk of the SCC at Campus ~~Süd~~		Service Desk of the SCC at Campus South

	The tokens can also be returned there when leaving the KIT. The tokens are then, depending on their condition, reused or disposed of.		The tokens can also be returned there when leaving the KIT. The tokens are then, depending on their condition, reused or disposed of.

Ulrich.Klein: Created page with " == Two-factor authentication (2FA) at KIT == Various services at the KIT have increased requirements for IT security, which go beyond a simple login with user name and passw..."

2017-10-23T12:45:14Z

Created page with " == Two-factor authentication (2FA) at KIT == Various services at the KIT have increased requirements for IT security, which go beyond a simple login with user name and passw..."

New page

== Two-factor authentication (2FA) at KIT ==

Various services at the KIT have increased requirements for IT security, which go beyond a simple login with user name and password. This includes in particular the SAP system and various VPN accesses.

==== What is a two-factor authentication? ====

A two-factor authentication is intended to improve IT security by adding a further factor to the login and password. Against the background of successful phishing incidents, applications with special protection requirements are to be additionally secured.

Possible second factors are e. g. a TAN list, an SMS-TAN or a TAN generator. It makes sense to create this second factor on a separate device, as it is protected against unauthorized access and cannot be copied.

==== Current status at the KIT ====

The KIT Presidium has decided to introduce a two-factor authentication for the SAP web portals. This is due to current security considerations of the SAP environment, which no longer consider the logon with a simple password to be secure. For this purpose, hardware tokens were purchased for use as a "second factor" and can now be issued to the employees. The introduction of two-factor authentication for SAP Web portals is planned for November 13,2017.

==== Technical implementation ====

At KIT, two-factor authentication is integrated into the central single sign-on service (Shibboleth). This browser-based approach allows all operating systems to be supported without the need for software installation on the end devices.

Two-factor authentication can also be extended to other services at a later date, provided that a security assessment requires this in the specific case.

== The tokens used at KIT ==

==== KIT token with display for employees ====

For employees, tokens with a display were purchased that show a 6-digit registration code that is valid for only one minute at the push of a button. These devices offer maximum flexibility and can be used with all operating systems and devices. The KIT tokens are in blue and carry the KIT logo.

==== Printed backup list ====

Every two-factor authentication user has the possibility to print a backup list of TANs that can be used if necessary (loss, defect,... of the regular token). It is recommended that such a list be set up provided the list is kept in a safe place (e. g. in a wallet or in a roll container) and protected from unauthorized access.

=== Token management ===

Every employee at the KIT receives an unpersonalized KIT token with a display that indicates a temporarily valid value at the push of a button, which is used in the context of two-factor authentication.

This token must first be linked to the personal KIT account.

Once you have registered a first token, token management can no longer be called without tokens.

The link is made at https://my.scc.kit.edu/token/register

After logging in with your personal KIT account, the "Link new token" dialog will be displayed. Please enter the last six digits of the serial number in the Serial Number field. You will find these on the back of the token.

[[File:Token seriennummer.jpg|400px]]

After clicking on "Next", the current value of the token is queried in the next dialog. Rotate the token so that the button is to the left of the display

[[File:token_off.jpg|400px]]

and press the button.

[[File:token_code.jpg|400px]]

Next, enter the valid value displayed (in the example 464230) in the "Current token code" field and click on "Confirm token". Please note that this value is only valid for one minute. The data entered is then checked and the link is made. You will be forwarded to the "Token overview".

This overview can also be accessed later on at any time via https://my.scc.kit.edu/token

At this point you have the possibility to register a service mobile phone in addition to the display token under "new token" or to create and print a backup list. We recommend that you use one of these options to be prepared for cases such as defect or loss of a token.

=== Issue and return of the tokens ===

In the introductory phase, the SCC organizes the distribution of the hardware tokens and distributes them to employees with the support of the organizational units.

After the introduction of two-factor authentication, new employees receive their hardware tokens at the following locations:

Campus Nord Service Desk of the SCC at Campus Nord
South Campus Service Desk of the SCC at Campus Süd

The tokens can also be returned there when leaving the KIT. The tokens are then, depending on their condition, reused or disposed of.

Please note: the issue of a hardware token can be combined with certification by the KIT-CA without any problems, thus saving you unnecessary ways.

[[Category: PC FAQ]]