Home
Contents
CLOSE
AuthLite Interactive Documentation
Quick Start: Install and protect Domain Admins AuthLite Features Supported Tokens Installation and Upgrading Configuration Token Management How to Log In Troubleshooting
CLOSE

Windows workstations typically permit cached logon when the machine is away from the LAN.  This is what is meant by "Offline", rather than referring to anything about a connection to the Internet (which AuthLite never needs).

A randomly-generated challenge/response secret is associated to each YubiKey, and gets programmed into a YubiKey's second identity slot. This option is called “support offline logins” in the admin UIs, and “AuthLite Challenge/Response” in the Key Programmer app.  The Windows "Enroll in AuthLite" UI automatically sets up keys this way (no option needed).

The HMAC-SHA1 challenge/response is checked before letting the user log in. For normal online logons, this challenge/response secret is retrieved from the domain controller and synchronized to the workstation. It is not necessary for the YubiKey to be plugged in directly to the workstation (it can operate as a remote keyboard e.g. with RDP or virtual machines).

During cached logons, the AuthLite software communicates directly with the plugged-in YubiKey to do the challenge/response procedure. Any (properly programmed) YubiKey that was assigned to the user at the time they last logged in to this workstation on the LAN will also be able to log in with cached mode.

Ramifications for YubiKeys

Programming YubiKeys to support AuthLite offline logons will “use up” both identity slots in the YubiKey, and destroy any other (old) information that was previously loaded onto the key.

  1. The second identity slot will contain a challenge/response secret that gets automatically used by AuthLite when logging in to workstations that are offline from the domain.

---