Authentication Schemes
Thinfinity® Workspace provides a layered authentication framework that allows administrators to build security schemes ranging from simple credential validation to advanced, multi-factor passwordless configurations. Rather than offering isolated options, the platform treats authentication as a set of composable layers — each adding capabilities on top of the previous one.
The Layered Authentication Model
Every authentication scheme in Thinfinity Workspace is built on the same foundation: a Directory Service that owns the user. From there, additional layers can be activated to delegate authentication, streamline the login experience, or strengthen security.
The layers are:
Layer 1 — Directory Service Login (Foundation)
Every user session begins here. The user authenticates against a configured Directory Service — whether that’s Windows Active Directory, a remote domain via the AD Cache (RemoteAD), or Thinfinity’s built-in IdP. This layer establishes who the user is within the platform.
Layer 2 — Single Sign-On with External Identity Providers (Delegation + Experience)
Authentication is delegated to an external Identity Provider (such as Azure AD, Google, or Okta) via OAuth 2.0, SAML, or RADIUS. The external identity is mapped to an existing Directory Service account, preserving centralized authorization. When the user already has an active session with their IdP, the login experience becomes transparent — the Thinfinity Workspace login page can be bypassed entirely. Authentication moves to the IdP; authorization stays in Thinfinity.
Layer 3 — Multi-Factor Authentication (Hardening)
MFA adds a second verification step to any of the previous layers. Thinfinity Workspace supports native TOTP codes, MFA inherited from an External IdP, and RADIUS-based second factors. MFA can coexist with SSO and IdP mapping, adding security without disrupting the user flow.
Layer 4 — Passkeys / WebAuthn (Passwordless)
Passkeys replace traditional passwords entirely with cryptographic credentials tied to the user’s device. Built on FIDO2/WebAuthn standards, they provide phishing-resistant authentication. In Thinfinity Workspace, passkeys can serve as a standalone primary login method or as the authentication credential within a mapping-based identity flow, bridging external FIDO2 identities to internal Windows accounts and permission structures.
Key principle: These layers are additive and combinable. An organization might use only Layer 1 for a simple deployment, combine Layers 1 + 2 for enterprise SSO, or stack all four for a Zero Trust configuration. The depth of the scheme should be determined by the organization’s security and compliance requirements.
Choosing the Right Scheme
The following table provides guidance on which layers to activate based on common deployment scenarios:
| Scenario | Recommended Layers | Description |
|---|---|---|
| Staging / Standalone deployment | Layer 1 (DS Login) | Users log in with local or Thinfinity IdP credentials. Simple setup, no external dependencies. |
| Enterprise with Active Directory | Layer 1 (optionally + Layer 2) | Domain users authenticate against AD (local or via the AD Cache). Add Layer 2 if federated access through an external IdP is needed. |
| Hybrid environment | Layers 1 + 2 | Authentication delegated to an External IdP (Azure AD, Okta, Google). SSO enabled for streamlined access. |
| High-security | Layers 1 + 2 + 3 | Full SSO with mandatory MFA. Meets compliance requirements for multi-factor verification. |
| Zero Trust / passwordless | Layers 1 + 2 + 3 + 4 | Passkeys as primary or mapped identity credential. Phishing-resistant authentication for maximum security posture. |