User-facing flows of Monofor Identity Client for Windows 2.4.22. Installation and settings: Windows Identity Client. Problems: Windows Identity Client Troubleshooting.
Tiles on the logon and lock screen
Tile | Title | What it does |
|---|---|---|
QR | Passwordless Login | Shows a QR code. Scan and approve in the Monofor Identity app. Sign-in options opens Send Push Notification and Use Offline Login. |
Push | Monosign Push | Sends an approval request to the phone of the user of the tile. Needs a certificate on this computer: sign in with QR once first. |
MFA | Monosign MFA Credential Provider | Password first, then Monosign MFA. See the MFA documentation. |
Self Service Portal | Self Service Portal | Password reset and account unlock. |
The tiles are shown on the console. In a remote desktop session the QR and Push tiles are not offered.
Sign in with a QR code
Select the Passwordless Login tile. A QR code appears.
Open the Monofor Identity app, scan the code and approve.
The computer signs in. On the first logon of this user on this computer it first enrolls the user's certificate (see below), which takes a few seconds.
The QR code is valid for about 2 minutes and is replaced automatically. Refresh replaces it at once.
The same tile unlocks a locked computer.
After the approval the computer is registered as a device of the user in Monosign (shown under the user's devices). This also enables offline sign-in for the user on this computer.
Sign in with a push notification
Select the Monosign Push tile of your account (or on the QR tile: Sign-in options > Send Push Notification).
Approve the notification on your phone. Resend Push Notification sends it again.
The computer signs in with the certificate already on it.
The push goes to the authenticator set in
DefaultAuthenticator: the Monofor Identity app (Mobile, default) or the API Service Authenticator (Service). If the user has no such authenticator, the Monofor Identity app is used.Push never enrolls a certificate. Without one the tile says Please use QR authentication first.
On a lock screen, Send Push Notification on the QR tile sends the request to the locked user.
First logon: certificate enrollment
The first QR logon of a user on a computer, and any QR logon that finds no usable certificate, enrolls one:
The client requests a certificate for the user from AD CS, on behalf of the user, through the certificate enrollment account configured in Monosign (templates
MonoforIdentityEnrollmentandMonoforIdentityClient).The key is created on the TPM virtual smart card of the computer.
The logon continues with the new certificate.
Conditions: the user comes from an Active Directory user source, the computer reaches the domain controller and the CA (corporate network or VPN before logon), and the certificate enrollment account is set in Monosign. If enrollment fails the logon stops with Unable to enroll. Please try again. and the audit log records Smart Card Enrollment Failed.
Renewal
Certificate state at logon | What happens |
|---|---|
Valid, more than 10 days left | Nothing. The expiry is checked at most once per 24 hours. |
Valid, 10 days or less left | Renewed in the background of the logon, at most one attempt per 24 hours. If renewal fails, the user signs in with the current certificate. |
Expired | Renewed before the logon. If the last attempt was less than 24 hours ago, or there is no Monosign session, the logon stops with Unable to enroll; sign in with QR again later or contact support. |
Present but unusable (key cannot be opened, untrusted) | One new enrollment is tried. If that does not help, the logon stops and asks to re-enroll. |
After a successful enrollment older Monofor certificates of the user on this computer are removed.
Sign in offline
When Monosign cannot be reached (three failed checks in a row) the tiles switch to offline mode. The user can also choose Use Offline Login.
Open the Monofor Identity app and read the Device PIN for this computer, or use one of the recovery codes.
Enter it on the tile (Device PIN / Recovery Code).
Offline sign-in works only for a user who signed in online on this computer before, and only when offline sign-in is allowed for the user in Monosign.
A recovery code works once.
After 10 wrong codes (
OfflineLimit) offline sign-in is locked for the user until the next online QR or push logon.Offline logons are audited when the computer is online again.
Message | Meaning |
|---|---|
Invalid Device PIN. Please try again. You have N attempts left. | Wrong code. |
Offline Authentication limit exceeded. Please log in using QR / Push Notifications to proceed. | Too many wrong codes. Audited as Offline Authentication Locked. |
Offline sign-in is not set up for this user. | The user never signed in online on this computer, or offline sign-in is not allowed. |
Offline authentication is unavailable. Please try again or sign in online. | The offline check on the computer could not run. |
Remote lock and unlock
Lock: when the device is locked from Monosign or the mobile app, the Monofor Identity - Service locks the user's Windows session within a few seconds.
Unlock: while the session is locked this way, an unlock from the mobile app unlocks it without a QR scan.
The service reports the session state (active, locked) to Monosign.
Session management
With the Session Management feature, when Monosign ends the user's session (expired, ended by an administrator) the Windows session is locked (LOCK, default) or logged off (LOGOFF). Signing out of Windows ends the Monosign session.
Messages
Message on the tile | Meaning | What to do |
|---|---|---|
Unable to enroll. Please try again. | The certificate could not be enrolled or renewed. | Check the network to the domain and CA; see Smart Card Enrollment Failed in the audit log and the troubleshooting page. |
User Enrollment Required. Please connect your corporate network and try it again. | The user's UPN could not be found in Active Directory. | Connect to the corporate network or VPN and try again. |
User session is invalid. Please try again. | No Monosign session to authorise enrollment. | Sign in with QR again. |
Device is not registered. Please try again. | The computer could not be registered for the user. | Try again; if it repeats, check the application key permissions. |
Please use QR authentication first. | Push logon without a certificate on this computer. | Sign in with QR once. |
Push notification is not set up for your account. Please use another sign-in method or contact your administrator. | The user has no push authenticator. | Register the Monofor Identity app. |
Waited a little while for your approval but didn't get any answer. Do you want to try again? | The push was not approved in time. | Send it again. |
Your Authentication Request is Declined. You can click and retry your request. | The request was declined on the phone. | Retry. |
Unable to determine the locked user. Please try again. | Send Push could not tell which user to notify. | Use the QR code or the Push tile. |
Received an error from the server. Please check your internet connection and try again. | Monosign answered with an error or could not be reached. | Check the network; see the troubleshooting page. |
This desktop is not shared with Monosign. Please contact your administrator. | Monosign does not allow this sign-in on this computer. | Administrator checks the user's access to the computer. |
You are offline. Enter your Device PIN or Recovery Code. | Offline mode. | Use the Device PIN from the app. |
The account is disabled. / The password of this user has been expired. | Windows refused the logon after the approval. | Fix the account in Active Directory. |
Next release: when Monosign refuses a QR sign-in the tile explains why and shows a new code: Your account is not allowed to sign in on this computer., Your access to this computer has expired. or This sign-in was not allowed. Scan the new QR code.
All tile texts can be changed per language: Language Text Customization.