The Windows Authentication Client allows users to enroll additional authentication methods for use when a device has no network connection. After enrolling a method while the device is online, the user can complete multifactor authentication while the device is offline.
Users can enroll in the following offline authentication methods with the RapidIdentity Offline Enrollment Manager:
- One-time password (OTP), which uses a time-based one-time password (TOTP) generated by an authenticator app
- WebAuthn, which uses a FIDO device such as a USB security key
For an OTP method, the device stores an encrypted TOTP secret and validates each generated code locally against the stored secret and the current time.
For a WebAuthn method, the FIDO device stores the private key and the system stores the corresponding public key, which the device uses to verify the device signature.
Note:Users must complete enrollment while the device is in connected mode. The device must have TPM 2.0 enabled, and an administrator must assign the WAC offline policy to the user in RapidIdentity before the user enrolls.