Multi-Factor Authentication (2FA/MFA) for PatARCH

Secure access to PatARCH with Rublon Multi-Factor Authentication (MFA). Depending on how PatARCH is deployed and how users authenticate, the application can be protected using one of two integration approaches:

• Rublon App Shield for browser-based access to the PatARCH web application,
• Rublon Authentication Proxy operating as an LDAP or LDAPS proxy for PatARCH authentication against an external directory, such as Microsoft Active Directory.

Rublon App Shield adds MFA at the web access layer without modifying the PatARCH source code. This option also enables phishing-resistant MFA using FIDO2 security keys and FIDO2 passkeys.

Rublon Authentication Proxy can instead be placed between PatARCH and the external LDAP directory. It verifies the primary credentials against the existing directory and requires an additional Rublon MFA step before returning a successful authentication response.

What Is PatARCH?

PatARCH is a diagnostic laboratory management system designed to control and improve laboratory workflows. It operates as a web application, allowing users to access the system through a browser. The vendor lists Mozilla Firefox, Google Chrome, Opera, Microsoft Edge, and Vivaldi among the supported browsers.

The PatARCH application server runs on Linux, while the system uses a MySQL or MariaDB database. The architecture can support database replication to another server and separation of the application frontend and database backend across different physical or virtual servers.

PatARCH can also authenticate users through an external LDAP server, such as a Microsoft Active Directory domain.

These capabilities provide two potential points at which Rublon MFA can be introduced: the browser-based application access layer and the LDAP authentication layer. In addition, access to the Linux where the PatARCH application server runs can be secured with Rublon MFA for Linux SSH.

Can You Enable MFA and 2FA for PatARCH?

PatARCH can be protected with Rublon MFA using either Rublon App Shield or Rublon Authentication Proxy.

Rublon App Shield is the preferred approach when the objective is to protect all browser-based access to a self-hosted PatARCH deployment. It places a dedicated security layer in front of the application and requires users to complete MFA before they can access the existing PatARCH sign-in flow.

Rublon Authentication Proxy is an alternative when PatARCH authenticates users by sending LDAP or LDAPS requests to an external directory. In this architecture, PatARCH is configured to use the Authentication Proxy as its LDAP server, while the Authentication Proxy forwards primary authentication to the actual directory and adds Rublon MFA.

Option 1: Protect PatARCH with Rublon App Shield

Rublon App Shield protects self-hosted web applications by placing an MFA enforcement layer in front of them. The application continues to provide its existing business functions and sign-in mechanism, while App Shield controls whether the user is allowed to reach it.

Because PatARCH is a browser-based application that can be hosted in the healthcare organization’s infrastructure, its web access can be considered for protection with Rublon App Shield.

This approach does not depend on PatARCH supporting a native Rublon MFA integration, an MFA plugin, or an MFA API.

How Rublon App Shield Protects PatARCH

An example sign-in process works as follows:

1. The user opens the protected PatARCH address in a supported web browser.
2. Traffic to the application passes through the Rublon App Shield security layer.
3. The user is prompted to complete additional authentication with Rublon MFA.
4. The user verifies their identity using an allowed authentication method.
5. After successful verification, the user is granted access to the existing PatARCH application and sign-in flow.

MFA is enforced outside PatARCH itself. This enables the organization to strengthen access security without depending exclusively on authentication functionality implemented inside the laboratory system.

The exact sign-in, sign-out, session, and user identification behavior must be verified in the specific PatARCH deployment.

MFA Without Changes to the PatARCH Source Code

A traditional MFA integration with a web application can require source code modifications, a vendor-provided module, an additional plugin, or an API integration.

Rublon App Shield uses a different approach. A dedicated protection layer is deployed in front of PatARCH, and users must complete MFA before they are allowed to access the application.

This enables the organization to:

• deploy MFA without modifying the PatARCH source code,
• avoid installing an agent or connector inside PatARCH,
• retain the existing PatARCH sign-in mechanism,
• centrally manage authentication methods and access policies,
• protect the application even when no native MFA module is available,
• apply the same protection model to other self-hosted web applications.

Deployment requires configuring Rublon App Shield and directing PatARCH user traffic through the protected access path. The exact configuration depends on how the application frontend is hosted, published, and separated from the database backend.

Signing In to PatARCH with FIDO2 Security Keys and Passkeys

Rublon App Shield enables organizations to use the phishing-resistant FIDO authentication method for protected web applications. The method supports FIDO2 security keys and FIDO2 passkeys.

Access to PatARCH protected by Rublon App Shield can therefore be verified using:

• a hardware FIDO2 security key,
• a Windows Hello passkey,
• a passkey stored in a supported password manager,
• a passkey stored on a mobile phone or another mobile device.

A FIDO2 security key requires physical possession of the device and, depending on its configuration, entering a PIN or completing biometric verification.

FIDO2 passkeys enable authentication using capabilities available on a computer or mobile device. They can use facial recognition, a fingerprint, or the device PIN.

Unlike traditional one-time passcodes, FIDO2 authentication is bound to the legitimate service. This makes it more resistant to phishing websites designed to capture passwords and authentication codes.

Organizations that require phishing-resistant authentication for PatARCH should generally consider Rublon App Shield as the primary integration approach.

Option 2: Protect PatARCH LDAP Authentication with Rublon Authentication Proxy

PatARCH can authenticate users through an external LDAP server, including a Microsoft Active Directory domain. This creates an integration path using Rublon Authentication Proxy as an LDAP or LDAPS proxy.

Rublon Authentication Proxy is an on-premises RADIUS and LDAP proxy server. When operating as an LDAP proxy, it receives authentication requests from the protected application, verifies the user’s primary credentials against the upstream directory, and adds Rublon MFA as the second authentication factor.

In this architecture, the authentication path is:

PatARCH → Rublon Authentication Proxy → Active Directory or another LDAP directory → Rublon MFA

How the LDAP Proxy Integration Works

A typical authentication process works as follows:

1. The user initiates a password-based sign-in to PatARCH.
2. PatARCH sends the LDAP authentication request to Rublon Authentication Proxy instead of directly to Active Directory or another LDAP server.
3. Rublon Authentication Proxy forwards the primary authentication request to the configured upstream directory.
4. If the username and password are valid, Rublon MFA initiates the additional MFA step.
5. After successful MFA, Rublon Authentication Proxy returns a successful LDAP authentication result to PatARCH.
6. PatARCH grants the user access.

Rublon Authentication Proxy does not replace the identity directory and does not store users’ primary credentials. The existing Active Directory, OpenLDAP, or another supported LDAP directory remains the identity source.

LDAP Authentication, Active Directory SSO, and Password Changes

The LDAP Proxy approach must be verified carefully because PatARCH supports several directory-related functions:

• authentication against an external LDAP server,
• Single Sign-On with Active Directory,
• changing an LDAP password from within PatARCH.

PatARCH supports LDAP authentication, Active Directory SSO, and LDAP password changes. Rublon Authentication Proxy is designed to protect the LDAP authentication flow configured in PatARCH.

Active Directory SSO and password change operations are separate authentication workflows. As part of the deployment, these workflows should be reviewed to confirm whether they use the same LDAP connection and to ensure that the expected sign-in and password management experience is preserved.

Before selecting the LDAP Proxy integration, verify:

• how the PatARCH LDAP server address can be changed to the Authentication Proxy address,
• whether PatARCH uses LDAP or LDAPS,
• the username format used in LDAP bind requests,
• whether standard password-based sign-in and Active Directory SSO use the same authentication path.

How to Choose the Right PatARCH Integration

The choice primarily depends on whether MFA should protect access to the web application or the LDAP authentication process.

Rublon App Shield

Rublon App Shield is suitable when MFA should protect all browser-based access to PatARCH. The protection layer is placed in front of the application, so it does not require changes to the PatARCH source code or its existing sign-in mechanism.

This option also supports phishing-resistant FIDO2 security keys and FIDO2 passkeys. After the application interface has been analyzed, the protection can be extended with step-up MFA or rules that block selected sensitive actions.

Rublon Authentication Proxy

Rublon Authentication Proxy is suitable when PatARCH authenticates users against an external LDAP or LDAPS directory, such as Microsoft Active Directory.

In this configuration, PatARCH authentication requests are routed through Rublon Authentication Proxy to the existing directory. The directory remains the primary identity source, while Rublon MFA adds a second authentication step to the LDAP flow.

As part of deployment planning, the Active Directory SSO and LDAP password change workflows used in the specific environment should also be reviewed.

One MFA Solution for PatARCH and the Entire Infrastructure

Protecting access to PatARCH is only one part of securing a diagnostic laboratory or healthcare organization.

Personnel may also use Windows workstations, Remote Desktop Services, VPN connections, Linux servers, administrative panels, laboratory devices, and other on-premises or cloud applications.

Instead of deploying a separate two-factor authentication solution for every system, the organization can use Rublon MFA to centrally protect multiple access points.

Depending on the integrations used, Rublon MFA can protect:

• browser-based access to PatARCH,
• LDAP authentication used by PatARCH and other applications,
• Windows sign-ins,
• RDP connections and Remote Desktop Services,
• VPN access,
• Linux servers,
• applications using RADIUS, LDAP, SAML, and OpenID Connect,
• other self-hosted web applications,
• administrative tools and internal systems.

Administrators can manage users, authentication methods, access policies, and authentication logs as part of one centralized MFA platform.

Learn more about Rublon MFA for Healthcare.

Why Should You Protect PatARCH with MFA?

PatARCH supports diagnostic laboratory workflows and provides access to information used to manage examinations, samples, results, laboratory processes, and user activity.

If a user account is compromised, an unauthorized person may gain access to sensitive patient or diagnostic information, modify laboratory data, perform unauthorized operations, or disrupt daily laboratory work.

A password alone does not provide sufficient protection if it is phished, guessed, reused in another system, or captured by malicious software.

Multi-factor authentication (MFA) requires an additional identity verification step. Even if an attacker obtains the user’s password, they must still complete the second authentication factor.

Deploying Rublon MFA can help a healthcare organization:

• reduce the risk of unauthorized access to PatARCH,
• protect laboratory, medical, administrative, and technical accounts,
• mitigate the impact of password theft and phishing,
• enable phishing-resistant authentication through Rublon App Shield,
• apply MFA to LDAP authentication through Rublon Authentication Proxy,
• standardize access protection across PatARCH and supporting infrastructure,
• record authentication events for monitoring and auditing,
• support organizational and regulatory access control requirements.

Additional Protection for Sensitive Actions

Rublon App Shield can extend protection beyond the initial PatARCH sign-in screen. After analyzing the application interface and workflows, the organization can consider implementing additional security rules.

Depending on the technical capabilities of the environment, these rules can:

• require step-up MFA before a high-risk action is performed,
• block access to selected pages or application elements,
• prevent unauthorized users from performing specific operations.

Potential use cases could include additional protection before access to administrative functions, user management, configuration areas, data exports, or other sensitive operations.

Applying such rules to PatARCH requires prior verification of the application interface and preparation of suitable selectors or protection rules. Rublon App Shield supports step-up MFA and blocking selected actions in protected web applications.

How to Start the Deployment

To determine the best method for protecting a specific PatARCH environment, contact Rublon Support.

The following information is useful during the initial assessment:

• the PatARCH version and modules in use,
• how the PatARCH web application is hosted and published,
• the addresses users open to access the application,
• the sign-in and sign-out flows,
• whether users sign in with local accounts, LDAP credentials, or Active Directory SSO,
• the LDAP or LDAPS server currently configured in PatARCH,
• the username and directory attribute formats used by the application,
• whether users change LDAP passwords through PatARCH,
• the required Rublon MFA authentication methods,
• whether phishing-resistant FIDO2 authentication is required,
• high-availability requirements,
• whether a pilot test can be performed.

After the environment and authentication flows have been verified, the appropriate App Shield or Authentication Proxy configuration and a detailed deployment guide can be prepared.

Frequently Asked Questions

Related Posts

• Agentless MFA for Self-Hosted Web Applications Without Code Changes With Rublon App Shield
• Rublon Authentication Proxy
• MFA for Generic LDAP Applications
• MFA for LDAP
• Multi-Factor Authentication for Healthcare
• Secure Hospital Information Systems with Rublon MFA