User authentication at access control server using mobile device

A method comprising:

• receiving, by a directory server from an access device, an authentication request message comprising a credential or a token;
• determining, by the directory server, an access control server using the credential or the token in the authentication request message;
• transmitting, by the directory server to the access control server, the authentication request message, wherein the access control server is programmed to transmit a challenge message to a user device associated with a user, wherein the challenge message comprises an out-of-band authentication request which requests the user to log into a local application on the user device by inputting a username, and a secret or biometric into the local application, which then grants the user access to the local application, and then generates and transmits a challenge response message including an indication that the user successfully logged into the local application to the access control server;
• receiving, by the directory server from the access control server, an authentication response message comprising an authentication indicator in response to receipt by the access control server of the indication that the user successfully logged into the local application;
• and
• transmitting, by the directory server, the authentication response message comprising the authentication indicator to the access device.

A directory server comprising:

• a processor;
• and
• a non-transitory computer readable medium comprising code, executable by the processor for performing operations comprising:
• receiving, from an access device, a first authentication request message comprising a credential or a token;
• determining an access control server using the credential or the token in the first authentication request message;
• transmitting, to the access control server, the first authentication request message, wherein the access control server is programmed to transmit a one-time password to a user device associated with a user;
• receiving, from the access device, a second authentication request message comprising the credential or the token, and the one-time password;
• determining the access control server using the credential or the token in the second authentication request message;
• transmitting, to the access control server, the second authentication request message, wherein the access control server is further programmed to validate the one-time password and generate an authentication response message comprising an authentication indicator in response to validating the one-time password;
• receiving, from the access control server, the authentication response message comprising the authentication indicator;
• and
• transmitting, to the access device, the authentication response message comprising the authentication indicator.