SSO with smartcards (UbiKey) and Sophos UTM

Question

Have configured my Windows domain to use Ubikey for Windows log on authentication. Sophos UTM supports SSO and smartcards (Yubikey) in some cases (but not all cases): 
 
 HTTP-proxy works since the user is authenticated by Windows domain 
 User portal? (Not certain if access to user portal supports SSO?) 
 UTM supports OTP for some services, ie SSL VPN, where OTP can be delivered by Ubikey. But the user must also use a password, which is in my case is the users domain password 
 L2TP/IPSec cannot be used with Ubikey since L2TP/IPSec VPN using smartcards is not supported by UTM (which is very sad) 
 
 This is my findings. The conclusion is that I cannot switch from passwords to smartcards for user authentication (user must use smartcard for logging in) since Sophos UTM does not support smartscards for all services. The purpose of using smartcards is that the users shall not use any password, but that is currently not possible. 
 Comments? Am I right?

DouglasFoster · Answer

You might or might not be correct. 
 The core problem is that Microsoft has not provided a coherent way to support 2-factor authentication, so system managers have to bolt a third-party solution onto it. Different solutions fit different use-cases, so you may need to have multiple solutions (which users will hate) or incompatible solutions (which is your current complaint.) Microsoft is still living in a world where everyone uses a desktop PC, at work, in an employees-only area, so their concept of two-factor authentication is (a) your desk is in a trusted area and you are a trusted person in that area, so (b) all you need to be authenticated is a username and password. They are the problem. 
 However, not every 2-factor solution works for every use-case. Ask your vendor for his recommendations about remote access. A single-vendor solution is always easier to support than a multi-vendor solution. Smartcard-required solutions have limitations as a remote-access solution because they require the user to be at a device that supports that smartcard technology. A restriction of that type is enforceable in some environments, but is not acceptable in many others. Your vendor probably has a way to implement the smartcard solution for some contexts, and disable it for other contexts. UTM might be fully compatible with the smartcard simply by creating an appropriate exception. 
 We use smartcards as a password substitute for internal use by users who move between devices frequently. They login with card and password initially, but can reconnect with just the smartcard for a time period that is defined by company policy. As such, it is really a form of one-factor solution, not two. Then, we use the UTM OTP feature for 2-factor authentication when they are remote. I don't know if this is close to what you want or not, but it suggests how different technologies can be made compatible. 
 UTM supports OTP (free) and DUO (third party product, monthly subscription fee if more than 10 people). DUO provides a very sophisticated solution for remote access, but I don't think anyone would use it for internal access.