Identität & Zugang
CareOn MFA
Zugänge um gezielte Prüfung ergänzen.
CareOn MFA sitzt zwischen Anwendungen und LDAP-Verzeichnis. Abhängig von Rolle und Berechtigung ergänzt der Dienst die Anmeldung um eine zusätzliche Verifikation.
Context
At a glance.
Richtlinien
Anforderungen abhängig von Rolle und Berechtigungen prüfen.
Verifikation
Bei Bedarf einen zusätzlichen Prüfschritt über die angebundenen Dienste ausführen.
Nachvollziehbarkeit
Authentifizierungsereignisse für Betrieb und Prüfung protokollieren.
How it works
Follow the workflow.
Anwendung
Anmeldeanfrage
CareOn MFA
Richtlinie prüfen
Verifikation
Bei Bedarf ergänzen
Verzeichnis
Anmeldung weiterleiten
Conceptual diagram · not live data
Insights from the source
In the video.
eMedys Video / PeerTube
CareOn MFA explained
The original product video for the CareOn MFA endpoint.
A connection to eMedys Video / PeerTube is made only when you load the video. Start playback in the player.
Explore the details
The original article.
The original service-desk article is preserved below. The editorial context above explains the service; statements in the source reflect its publication date.
Read original article Content & documentation
CareOnMFA - Multi-Factor Authentication Proxy
CareOnMFA is an LDAP proxy endpoint that provides enhanced security through multi-factor authentication (MFA) for Netcare's authentication infrastructure. The system acts as an intelligent intermediary between client applications and the Netcare LDAP directory, adding an additional layer of security verification when required.
How It Works
CareOnMFA operates as a transparent proxy that:
Receives authentication requests from client applications via standard LDAP protocols (search and bind operations)
Evaluates authentication requirements by checking user attributes and prescription rights in the Oracle database to determine if additional verification is needed
Performs selective MFA verification through integration with Netcare's AES (Authentication & Enhancement System) using the Trust Factory framework
Routes authenticated requests to the downstream LDAP servers once verification is complete
Key Features
- API-Based Verification: Unlike traditional MFA systems that use SMS or authenticator apps, CareOnMFA uses external API-based verification through the AES system
- Selective Authentication: Not all users require MFA - the system intelligently determines requirements based on user roles and prescription capabilities
- Trust Factory Integration: Uses Netcare's trust factory system to identify which users need enhanced authentication
- High Availability: Designed to work seamlessly with LDAP cluster infrastructure (ncdcnsldap01/ncdcnsldap02)
- Comprehensive Logging: All authentication attempts are logged to PostgreSQL for audit and monitoring purposes
- Session Management: Uses Redis for efficient session tracking and caching
Technical Components
- LDAP Proxy Server: Handles standard LDAP search and bind operations
- Oracle Database Integration: Queries employee prescription rights
- PostgreSQL Logging: Comprehensive audit trail of all authentication events
- Redis Cache: Fast session management and state tracking
- AES API Integration: Real-time verification with Netcare's Authentication & Enhancement System
Use Cases
CareOnMFA is primarily used for:
- Healthcare professionals requiring access to prescription systems
- Users with elevated privileges in clinical applications
- Any authentication scenario where additional verification is mandated by security policy