Can the realm value be passed to the OTP server in the Windows Client

Ge_Lukken · May 29, 2024, 3:00pm

Hello Cornelinux,

Is it possible to pass the realm of the user to the server without the use of the ‘default_realm’ in the registry?

Suppose a Windows server has joined a domain and some domain users should use OTP to logon, but there are also local users on that server that use OTP. So there is a realm for the domain users, and a realm for the local users. Not setting the ‘default_realm’, no-one can logon, and setting the realm allows for only those users to logon…

Regards,
Ge

nilsbehlen · May 29, 2024, 3:17pm

Hi,
i think you want to use the domain-realm mapping as described here:

github.com

privacyidea/privacyidea-credential-provider/blob/master/doc/configuration.rst#realms

.. _configuration:

Configuration
=============

During installation of the privacyIDEA Credential Provider you already
configured all necessary settings, but it can be interesting to change
settings later. Like changing the available credential providers or changing
the verification of the authentication server certificate.

Registry Settings
-----------------

If you want to change the configuration after the installation, you can only do this by editing the registry keys.
You can use administrative templates to deploy the credential provider on many desktops in your network.

The configuration is located at
``Computer\HKEY_LOCAL_MACHINE\SOFTWARE\NetKnights GmbH\PrivacyIDEA-CP\``.

This file has been truncated. show original

For local users, the “domain” would be the computer name.

Ge_Lukken · May 30, 2024, 9:08am

Thanks, the realm-mapping works perfectly!

Regards,
Ge