I have an interesting use case where users need to authenticate to applications running in environments that might not have internet access or even access to an authentication server. Administrators need to be able to grant and revoke access to individual users without direct access to the application. The admins would rather not maintain and operate the solution though. Does any authentication provider or service exist that can do the trick?
I have already explored OCRA services such as Protectimus and Gemalto, and also RSA SecurID, but to verify challenge responses they all seem to require that the application call their servers.
Another possibility is to use an OpenConnect ID provider such that a user logs in via her mobile device, get an id token, and copy it into the application. However, the application still needs to have up-to-date signing keys or the client secret. More critically though, the user might not have a practical way to copy the token into the app in practice, as the token can be long.
If it helps clarify the reason for these requirements:
- The users are support personnel from my company.
- The application runs in its own VM in another company's internal network.
- At this time, the app and VM are "closed". Only my company's support team are allowed to log in to its support account -- not the customer.