Biometric Fingerprint for Windows Credential Provider
Contents
Overview
With Biometric Fingerprint for WCP you can enrol the user's fingerprint, use it as 2FA or just to identify the username.
Prerequisites
AuthControl Sentry v4.0.5 onwards
AuthControl Credential Provider v5.4.2 onwards
Windows 10
Nitgen biometric reader or Laptop supporting biometric authentication (Windows Hello) with integrated fingerprint reader (Models tested so far are below)
Nitgen Reader vs Laptop Reader
There are some relevant differences with both types of readers that need to be considered.
1) Enrolment
- Nitgen Reader: enrolment is done during the first login
- Laptop Reader: the user cannot be enrolled during login, so enrolment is done inside AuthControl Credential Provider Configuration
2) Authentication in multiple devices
- Nitgen Reader: allows to authenticate in several devices with only one enrolment
- Laptop Reader: enrolment in each one of the devices is necessary
Configuration for Nitgen Biometric Reader
Configure Credential Provider
Select in Authentication -> Method the option "Fingerprint".
Select in Authentication -> Biometric Reader the option "Nitgen".
Enrol the user
When the user is not enrolled, the user is requested, after login with username and password, to enrol the fingerprint.
1) Select the finger to enrol
2) Place the finger on the sensor the necessary times untill the enrolment is successfull
Authenticating
After authenticationg with username and password, when requested, place the finger on the sensor
Configuration for Laptop Biometric Reader
Supported models
Most HP, Dell and Lenovo models should work.
The following have been tested successfully:
Dell Vostro 15 5000 Series Lenovo Thinkpad 13 Gen 2
Configure Third Party Authentication
In AuthControl Sentry Management Console, add the following Third Party to Server > Third Party Authentication
Identifier: WinBioFingerprint Class: com.swiveltechnologies.pinsafe.server.thirdparty.FingerprintNitgen Enabled: yes
Disable Windows Hello
Windows Hello Biometric usage must be disabled in Local Group Policy:
- Access the Windows Local Group Policy Editor.
- Go to: Computer Configuration > Administrative Templates > Windows Components > Biometrics and disable the setting "Allow users to log on user biometrics".
Install Credential Provider with Fingerprint Enrolment
Configure Credential Provider
Select in Authentication -> Method the option "Fingerprint".
Select in Authentication -> Biometric Reader the option "Native".
Enrol the user
After selecting "Native", Click in the button “New Enroll” to open the "BioEnrol" executable.
Select option 1 to start a new enrol to current user and follow the steps presented.
Authenticating
With all configurations done, go to the Windows login page and access using your registered fingerprint when prompted.
Biometric Identification
It's possible to use Biometric Identification instead of entering the username. First enable "Biometric Identification" under "Authentication" inside the Configuration.
When authenticating, select option "Read Fingerprint" and place your finger on the sensor when requested. If the fingerprint is enrolled, the username is automatically filled.
Removing user fingerprint
To remove a user fingerprint from the appliance, the administrator can go to User Administration, Select View -> Attributes, click the user and select "Remove fingerprint".
Troubleshoot
If you have issues with enrolment on the Integrated Laptop Reader, you might need to stop "Windows Biometric Service" under your Windows Services
