Auth Bastion
GuardianKey Auth Bastion brings multi-factor authentication to systems that cannot be changed, because they are legacy, belong to a third party, or have no source code available. It has two modules. Which one to use depends on the client the user accesses the system with.
| Bastion Web | Bastion Pass | |
|---|---|---|
| Target systems | Systems accessed through a browser | Systems whose client is not a browser: RDP through RD Gateway, desktop clients, legacy Java applications |
| How the second factor is requested | A reverse proxy intercepts the login and asks for the code before letting the user into the application | The user unlocks access in a web portal, and the system checks that unlock on every connection |
| What gets installed | The bastion, in front of the application | The portal and an integration module next to the protected system |
| Second factor | TOTP, code by e-mail or SMS, GovBR login (OAuth2/OIDC) | TOTP |
What both modules share
Both modules are managed in the same panel, inside the GDN platform, and use the same foundation:
- Auth Groups, which define the rules for each protected system;
- user and TOTP authenticator enrollment;
- user and IP policies, to exempt or block users and networks;
- risk analysis with Auth Security and protection against automation with GKTinc.
An organization can use both at the same time. For example, Bastion Web protects the intranet and Bastion Pass protects remote access through RD Gateway.
Where to go next
- Bastion Web: protection of web systems through a reverse proxy.
- Bastion Pass: protection of systems whose client is not a browser.