Enterprise Biometric Authentication

Touch once.
Access everything.

Enterprise fingerprint authentication for Windows and Linux environments. Centralized biometric login across physical workstations, VDI thin clients, and virtual machines.

<1s Authentication
1:N Matching
AES-256 Encryption
Identity Verified

Powered by industry-leading technology

Enterprise-grade authentication,
beautifully simple.

Replace passwords with biometric security. Users touch their finger once and get instant access to everything they need.

Walk-up SSO

Touch the reader โ†’ automatically logged in. No passwords to type, no usernames to remember. Just walk up and start working.

๐Ÿ‘† Touch
โ†’
๐Ÿ” Match
โ†’
โœ“ Access

Windows Integration

Native Credential Provider appears on the Windows login and lock screen. Works with domain-joined and Azure AD machines.

Password Vault

Securely stores encrypted AD credentials. After biometric match, the system logs you in with your actual passwordโ€”enabling full Kerberos SSO.

Centralized Server

Single server handles all matching. Templates stored securely, not on endpoints. Central audit logging and policy control.

VDI Ready

Full VMware Horizon integration. Touch reader on thin client โ†’ VM launches and logs in automatically. Virtual channel for in-session auth.

Self-Service Enrollment

Web portal for users to enroll their own fingerprints. Companion app bridges browser to reader. Admin approval workflows available.

Authentication in milliseconds.

From fingerprint capture to Windows loginโ€”here's what happens when you touch the reader.

01

Capture

User touches the HID EikonTouch reader. High-quality fingerprint image (FID) captured in ISO 19794-4 format.

02

Transmit

Fingerprint image sent to Bassma Server over TLS 1.3 encrypted connection. Never stored on endpoints.

03

Match

Server extracts template (FMD) and performs 1:N matching against all enrolled users. DigitalPersona algorithm ensures accuracy.

04

Decrypt

User identified. Server decrypts their AD password from the AES-256-GCM encrypted vault.

05

Login

Credentials returned to client. Windows completes authentication. User receives Kerberos TGT for full SSO to network resources.

Enterprise security.
Zero compromises.

Built for environments where security is non-negotiable. Every layer is designed to protect user credentials and biometric data.

AES-256-GCM Encryption

All passwords encrypted at rest with per-user IV and authenticated additional data.

TLS 1.3 Transport

All client-server communication encrypted with the latest TLS standard.

Rate Limiting & Lockout

Configurable failed attempt thresholds prevent brute force attacks.

Complete Audit Trail

Every authentication attempt logged with machine ID, timestamp, and result.

256-bit Encryption
ISO 19794-4
Zero Stored Images

Built for real-world environments.

From healthcare to manufacturing, Bassma.ID secures authentication where passwords create friction.

Healthcare

Clinicians move between workstations constantly. Bassma.ID enables instant access to patient records without typing credentials each time.

  • Shared workstation support
  • HIPAA-compliant audit logs
  • Reduced login fatigue

Manufacturing

Shop floor workers wear gloves, have dirty hands, or can't use smart cards. Biometric auth works regardless.

  • No cards to lose or share
  • Works with work gloves*
  • MES/SCADA access control

VDI / Thin Clients

Touch reader on thin client โ†’ VM launches automatically and logs you in. No manual Horizon/Citrix login required.

  • VMware Horizon integration
  • Pre-session authentication
  • Virtual channel for in-session unlock

Kiosk / Shared PCs

Public-facing or shared computers where password entry is impractical or risks shoulder-surfing.

  • No password exposure
  • Fast user switching
  • Automatic session lock

Designed for enterprise scale.

Centralized matching, distributed capture. Templates never leave the server. Full Active Directory integration with no schema changes required.

โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
โ”‚                        CLIENT MACHINES                           โ”‚
โ”‚                                                                  โ”‚
โ”‚  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”  โ”‚
โ”‚  โ”‚  WINDOWS         โ”‚  โ”‚  WINDOWS VM      โ”‚  โ”‚  THIN CLIENT โ”‚  โ”‚
โ”‚  โ”‚  Credential      โ”‚  โ”‚  (VDI)           โ”‚  โ”‚  Agent       โ”‚  โ”‚
โ”‚  โ”‚  Provider        โ”‚  โ”‚  + V. Channel    โ”‚  โ”‚              โ”‚  โ”‚
โ”‚  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”ฌโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜  โ”‚
โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
            โ”‚                     โ”‚                   โ”‚
            โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”ผโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
                                  โ”‚ TLS 1.3
                                  โ–ผ
โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”
โ”‚                       BASSMA SERVER                              โ”‚
โ”‚  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”    โ”‚
โ”‚  โ”‚  Matching Engine โ€ข Password Vault โ€ข Audit Logging      โ”‚    โ”‚
โ”‚  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜    โ”‚
โ”‚                                                                  โ”‚
โ”‚  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”  โ”Œโ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”          โ”‚
โ”‚  โ”‚  PostgreSQL  โ”‚  โ”‚  AES-256     โ”‚  โ”‚  Active      โ”‚          โ”‚
โ”‚  โ”‚  (Templates) โ”‚  โ”‚  Vault       โ”‚  โ”‚  Directory   โ”‚          โ”‚
โ”‚  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜  โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜          โ”‚
โ””โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”€โ”˜
          

Ready to eliminate passwords?

Let's discuss how Bassma.ID can transform authentication in your organization. Get a demo, architecture consultation, or deployment support.

Or reach out directly:

contact@bassma.id