Aircraft and Personnel Automated Clearance System (APACS)

1 Aircraft and Personnel Automated Clearance System (APACS) Two-Factor Authentication Guide 25 October 2021 Prepared by: APACS Development Team 1 APACS-DOC-2FA-Authen-Guide-01C04 Revisions Revision Number Date Description R01C00 04/13/2021 Initial version R01C01 05/06/2021 Removed DOS PIV requirements and replaced it with PIV R01C02 05/17/2021 Added YubiKey 5 FIPS in section R01C03 06/08/2021 Edited section to limit compatible YubiKey to FIPS only R01C04 10/25/2021 Added enable CAC/PIV instructions, YubiKey Manager Interfaces configuration, Apple troubleshooting 2 APACS-DOC-2FA-Authen-Guide-01C04 Table of Contents .. Purpose.

2 3 .. DoD CAC or PIV ..3 Register CAC or PIV .. 3 Sign up for a New Account with DoD CAC or PIV .. 5 Sign in with CAC or PIV .. 7 Compatible Operating Systems and Browsers .. 7 Add CAC or PIV from APACS Account .. 8 Remove CAC or PIV from APACS Account .. 8 .. Password and YubiKey ..10 What is YubiKey .. 10 Compatible YubiKey Series .. 10 Compatible Operating Systems and Browsers .. 10 YubiKey Registration .. 10 Active User .. 11 Inactive/Locked or Invalid Password Users .. 15 Sign up for a New Account with YubiKey .. 16 Sign in with YubiKey .. 18 Sign in with Username and Password Only .. 20 Remove Registered YubiKey from APACS Account.

3 20 Login Assistance .. 20 My Account .. 22 Troubleshooting .. 23 YubiKey Operation Timeout .. 23 Reset YubiKey .. 23 Configure YubiKey Interfaces .. 25 Lost YubiKey .. 25 .. Password and Recovery Code ..26 Request Recover Code .. 26 Sign in with Recovery Code .. 27 .. Apple Devices ..29 Apple Computer (Mac OS) .. 29 DoD CAC .. 29 YubiKey .. 29 iOS .. 29 DoD CAC .. 29 YubiKey 5Ci FIPS .. 29 Troubleshooting .. 32 YubiKey Registration .. 32 3 APACS-DOC-2FA-Authen-Guide-01C04 Purpose After the deployment of Release 64, APACS now requires users to login to the application with two-factor authentication. The purpose of this document is to describe to the users how to register their DoD CAC, PIV card or YubiKey to their APACS account.

4 This document also describes the different methods to login to APACS after release 64. Note: the instructions in the guide are for APACS on NIPRNet. YubiKey and password authentication are disabled on SIPRNet. Users on SIPRNet will need a SIPR Token to access APACS. DoD CAC or PIV Users with a DoD CAC or a PIV card who have registered their CAC or PIV with APACS can use their CAC or PIV to sign in to APACS. Users are highly recommended to use this method to login to APACS. Register CAC or PIV If a user already have an active account, go to the APACS login page From the APACS sign in page, click on Set Up Two-Factor Authentication link. Figure 1 Set Up Two-Factor Authentication 4 APACS-DOC-2FA-Authen-Guide-01C04 Follow the instructions on the Two-Factor Authentication Setup page to the register your CAC or PIV card.

5 An active account and username/password are required to proceed. Figure 2 Register Your CAC/PIV If a password have not been created or user s account is inactive or locked, click Login Assistance from the APACS login page, see Figure 3, and follow the direction to create a password or to activate/unlock the account. 5 APACS-DOC-2FA-Authen-Guide-01C04 Figure 3 Login Assistance Sign up for a New Account with DoD CAC or PIV New APACS users can sign up for an account and register his/her CAC or PIV card during the account creation process. 1. From the APACS sign in page, click Account Sign up button. See Figure 4. 6 APACS-DOC-2FA-Authen-Guide-01C04 Figure 4 Account Sign Up 2.

6 Click New CAC/PIV Account on the Account Sign up page and follow the instructions. Figure 5 New CAC/PIV Account 3. Fill out all the registration information. 7 APACS-DOC-2FA-Authen-Guide-01C04 4. Click New CAC/PIV Account . 5. Enter your CAC/PIV PIN when prompt. 6. If successful, the user will be redirected to user s APACS home page. Sign in with CAC or PIV If user has an active account and had registered his/her CAC or PIV with APACS, simply log in by clicking CAC/PIV Sign in from the APACS log in page. See Figure 6. Figure 6 CAC/PIV Sign in Compatible Operating Systems and Browsers The following operating systems and browsers support APACS CAC/PIV operations: Windows 10 o Microsoft Edge o Chrome Mac OS (see Section 5 for detail regarding Apple devices) o Chrome iOS (see Section 5 for detail regarding Apple devices) o Sub Rosa Microsoft Internet Explorer is NOT Supported 8 APACS-DOC-2FA-Authen-Guide-01C04 Add CAC or PIV from APACS Account If users have a YubiKey or Recovery Code registered to their account, users can register their CAC or PIV from their APACS accounts.

7 1. From APACS Login page, click on YubiKey Sign in . 2. Click on My Account . 3. In ACCOUNT DETAILS section, locate the Authentication Details. 4. Click on "Enable CAC/PIV Authentication", under Authentication Options, in the middle of the page. 5. If a smart card dialog box appears, as shown in Figure 7, click the Cancel button. Figure 7 Smart Card Dialog Box 6. Select CAC/PIV certificate from the pop-up window and enter the CAC/PIV pin. 7. The Authentication Details will show CAC/PIV Enabled . 8. Logout of APACS. 9. The user may now sign in with the CAC/PIV by clicking on CAC/PIV Sign in . Remove CAC or PIV from APACS Account If users have a YubiKey or Recovery Code registered to their account, users can de-register their CAC or PIV from their APACS accounts.

8 10. From APACS Login page, click on YubiKey Sign in . 11. Click My Account tab as shown in Figure 32. 12. In ACCOUNT DETAILS section, locate the Authentication Details. 13. Click Disable for CAC/PIV. See Figure 8. 9 APACS-DOC-2FA-Authen-Guide-01C04 Figure 8 Disable CAC/PIV 5. Click OK when prompted: Are you sure you want to disable logging in using your CAC/PIV . 6. A message will be displayed on the page to show that CAC/PIV authentication has been disabled, as shown in Figure 9. Figure 9 CAC/PIV Authentication Disabled Message 10 APACS-DOC-2FA-Authen-Guide-01C04 Password and YubiKey Users who need to use an alternate method besides DoD CAC or PIV to sign in to APACS can do so with their usernames, passwords AND their registered YubiKey.

9 What is YubiKey YubiKey is a hardware authentication device which, together with the username and password, provides users a two-factor authentication mechanism to sign in to APACS. Compatible YubiKey Series The compatible YubiKey are limited to the YubiKey 5 FIPS Series. Follow the link for different types of YubiKey 5 FIPS Series via For the YubiKey FIPS 5 series, depending on your need, here are basic usage of different types of YubiKey: 1. For Windows or Apple operating System and USB-A connector, we recommend YubiKey 5 NFC FIPS. For USB-C connector, we recommend YubiKey 5Ci FIPS, YubiKey 5C NFC FIPS, YubiKey 5C Nano FIPS, or YubiKey 5C FIPS. 2.

10 For iOS operating systems we recommend YubiKey 5Ci FIPS (USB-C, Lightning). Android operating System have not been tested with YubiKey. Purchasing is the user s responsibility and commercially available via Compatible Operating Systems and Browsers The following operating systems and browsers support APACS YubiKey operations: Windows 10 o Microsoft Edge o Chrome Mac OS (see Section 5 for detail regarding Apple devices) o Chrome o Safari iOS (see Section 5 for detail regarding Apple devices) o Safari Microsoft Internet Explorer is NOT Supported YubiKey Registration Due to different behaviors exhibiting from different browsers, operating System and organization policies, we are requesting and providing instructions for users to register YubiKey using Microsoft Edge Browser from Windows 10.