How to restrict access to website to approved computers

Question

I work for a franchise and we want to provide some web applications that host internal & proprietary information & functionality that should only be available to active franchise employees. Each franchise is independently owned and operated. They provide their own desktop computers (we require specs, like Windows OS) that are on their own internal network and not on our domain. Their only reliable* connection to us is through a standard internet connection. *We have attempted to set up VPNs with their required Cisco routers but have had reliability issues with the connection due to some bug.

We have a form of employee username/password authentication in place, but because turnover happens, we want to make sure that that employee can't go home and access these applications on their home computer after their employment status is terminated - we don't believe the franchise managers will be diligent enough to disable the employee account immediately. So we want to add the concept of the web applications only being accessible by certain approved computers. That way it doesn't matter if the employee account is disabled because they can't access it from any other computer.

Three ways have come to mind:

1. Require the website to be launched from an installed desktop application. This application would post some sort of token to authenticate itself with the web app at which point the web app could issue an authentication cookie.

2. Install a windows service on the approved machines that listens for http requests on a port and responds with information about the machine such as the IP & MAC address(es) and a registry key we have created identifying the franchise. The MAC addresses would have to be registered with us in order for them to be authenticated.

3. Make the web apps intranet sites and require a VPN to gain access.

1 is not very user friendly or intuitive and would require app development for tablets and mobile devices. Users couldn't switch freely between browsers. The startup app would have to have browser options to allow anything but the default browser.

2 is more user friendly since it happens automatically in the background of the page and works cross-browser. I currently have a proof of concept of this approach working as a replacement for one site that currently accomplishes it using ActiveX (which limited users to IE). However, the new approach doesn't work in Edge without forcing Edge to allow loopback requests and I'm fearful going forward, other browsers might lock down security to prevent a public website from requesting local resources as well.

3 seems like the most legit way of doing it. But VPN configuration is well outside of my area of expertise and our network admin seems to think its infeasible or impossible based on his VPN configuration experience. As I mentioned above, we have tried connecting the franchise routers to a VPN for other reasons and it has had issues with disconnecting. I believe we have an open ticket about that. I was thinking perhaps franchises could install a pre-configured software VPN client with the credentials either built-in, or we provide credentials that only the franchise manager knows and once entered they'd be saved so that their employees could freely re-connect should they restart the computer, or get disconnected, etc. Is this possible?

Those are my ideas, but my question is just: what are some secure and reliable options for accomplishing this?

Answer 1

Using Computer Certificates would be the preferred way of doing this...

This is how most VPNs would work anyway - so it would make sense to just use a VPN instead of duplicating this functionality. I would suggest trying to get the VPN working.