OnBase Authentication Security Issue

[Eric_Morris]

We have recently determined that allowing OnBase authentication is too much of a security risk for even our system administrator to have and need feedback for best practices to address this issue. Our sys admin can use OnBase authentication to login as a user and it appears the audit trail does not distinguish between NT authentication and OnBase authentication. Therefore, it allows the sys admin to perform tasks as the individual. So, I need help answering the following questions:

(1) Can we turn off OnBase authentication? If so, what admin functionality will be lost if we do?

(2) If we cannot turn off OnBase authentication or choose not to, does the audit trail differentiate between NT and OnBase activity?

Thanks in advance.

[AdamShaneHyland]

In addition, SCR: #204441 was created to add logging to the Security log detailing which authentication method was used to allow a user access to the system.

[Joe_Pineda]

I'm glad Shane found an SCR for this, it would be a nice feature... but Eric, I'm curious, is the issue that your OnBase sys admin is "posing" as someone to do something? If you force network security, what would stop him from getting a LAN pasword and doing the same, i.e., logging in as someone else? If that's the case, your bigger issue is not the OnBase authentication method.

[Eric_Morris]

Thank you for all the responses.

Jose, this is completely about the ability the sys admin has and not what he has or hasn't done. But yes, this question stemmed from the discovery that he COULD login as someone else, perform a task as that person, and we have no ability to audit or prove that it was the sys admin that performed the task.

We have considered having our security team change the passwords to something only they knew, but it is our understanding that the sys admin could change it back to whatever he wants without an audit record showing the change, which complete negates the effort by the security team.

I am curious if anyone feels this level of access by the sys admin is a risk or common practice.

[John_Anderson4]

Eric, I'm quite sure the act of changing a user's password is logged in the database.

[Joe_Pineda]

It is. You can query the transaction logs through the client or report services... or sql of course. It will tell you who, when and what user's pw was changed.

 The original question has to do with, as I understand it now, best security practices. And that can be a long discussion.