0

I work for a franchise and we want to provide some web applications that host internal & proprietary information & functionality that should only be available to active franchise employees. Each franchise is independently owned and operated. They provide their own desktop computers (we require specs, like Windows OS) that are on their own internal network and not on our domain. Their only reliable* connection to us is through a standard internet connection. *We have attempted to set up VPNs with their required Cisco routers but have had reliability issues with the connection due to some bug.

We have a form of employee username/password authentication in place, but because turnover happens, we want to make sure that that employee can't go home and access these applications on their home computer after their employment status is terminated - we don't believe the franchise managers will be diligent enough to disable the employee account immediately. So we want to add the concept of the web applications only being accessible by certain approved computers. That way it doesn't matter if the employee account is disabled because they can't access it from any other computer.

Three ways have come to mind:

  1. Require the website to be launched from an installed desktop application. This application would post some sort of token to authenticate itself with the web app at which point the web app could issue an authentication cookie.

  2. Install a windows service on the approved machines that listens for http requests on a port and responds with information about the machine such as the IP & MAC address(es) and a registry key we have created identifying the franchise. The MAC addresses would have to be registered with us in order for them to be authenticated.

  3. Make the web apps intranet sites and require a VPN to gain access.

1 is not very user friendly or intuitive and would require app development for tablets and mobile devices. Users couldn't switch freely between browsers. The startup app would have to have browser options to allow anything but the default browser.

2 is more user friendly since it happens automatically in the background of the page and works cross-browser. I currently have a proof of concept of this approach working as a replacement for one site that currently accomplishes it using ActiveX (which limited users to IE). However, the new approach doesn't work in Edge without forcing Edge to allow loopback requests and I'm fearful going forward, other browsers might lock down security to prevent a public website from requesting local resources as well.

3 seems like the most legit way of doing it. But VPN configuration is well outside of my area of expertise and our network admin seems to think its infeasible or impossible based on his VPN configuration experience. As I mentioned above, we have tried connecting the franchise routers to a VPN for other reasons and it has had issues with disconnecting. I believe we have an open ticket about that. I was thinking perhaps franchises could install a pre-configured software VPN client with the credentials either built-in, or we provide credentials that only the franchise manager knows and once entered they'd be saved so that their employees could freely re-connect should they restart the computer, or get disconnected, etc. Is this possible?

Those are my ideas, but my question is just: what are some secure and reliable options for accomplishing this?

  • 3
    This is more of an IT/Networking issue than software - I'd also suggest getting someone better at VPN if they think this is infeasible... – HorusKol Nov 8 '16 at 23:45
  • Well, I am looking for software solutions - ultimately software will have to perform the authentication, right? But I wanted to acknowledge a networking solution might be the best answer while maybe getting a freebie as to whether my VPN idea is possible. Are you implying you don't believe there is a good software solution? Thanks. – xr280xr Nov 9 '16 at 0:40
  • this isn't software engineering question - yet. This is asking for a discussion on various networking/security solutions - some that you may need to implement into software. – HorusKol Nov 9 '16 at 1:05
  • btw - the simplest option is to get the franchises to tell you what their IP address is and whitelist on your server - no fancy software solution needed at their end – HorusKol Nov 9 '16 at 1:08
  • 3
    A network-level solution is the only appropriate approach if you don't want to rely only on username/password auth. The necessary configuration is not trivial, but entirely possible – I've worked with similar stuff before. Step 1: Have a network at HQ that contains the target server, and a LAN at each franchise. Step 2: set up a network bridge between the franchise LAN and HQ network. This connection should be secured with public/private key crypto. Cisco routers can do that. Step 3: Set up DNS on the LAN to direct certain hostnames into the network bridge. Step 4: open site in browser. – amon Nov 9 '16 at 9:12
1

Using Computer Certificates would be the preferred way of doing this...

This is how most VPNs would work anyway - so it would make sense to just use a VPN instead of duplicating this functionality. I would suggest trying to get the VPN working.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.