BIO-key PortalGuard has been a player in the identity management (IDM) space for some time, but things have changed since the last time we tested it. Because PortalGuard has been acquired by BIO-key, the product places an increased focus on biometrics for authentication. In addition to offering on-premises installation, you also have the option of an IDaaS (Identity as a Service) deployment, though there’s still quite a bit of maturing to do before the PortalGuard IDaaS platform is ready to compete with the likes of our Editors’ Choice award winners Okta and VMware Workspace One.
Two things about PortalGuard really stand out. The first is its pricing—you can get all the features PortalGuard offers for a flat rate of $2 to $4 monthly per user depending on your total number of users. The second key selling point is indicated by the company name BIO-key. PortalGuard offers a number of flexible multifactor authentication (MFA) options, but quite a few include a biometric component to them, notably the new mobile app MobileAuth with PalmPositive. The latter supports palm scanning which the company says is up to 400 times more accurate than most device-based biometrics.
Getting Started With PortalGuard
The process to install and set up PortalGuard hasn’t changed much since our 2017 review. The platform still runs on Microsoft Internet Information Services (IIS) and Microsoft SQL Server, which depending on your business and personal preferences could go in either the Pros or Cons column. The PortalGuard Configuration Editor is the go-to utility for configuring how the software runs on your server and connects to your user repositories. If you’ve ever configured an LDAP connection, the process will be familiar—set the server and port details, as well as LDAP paths for key aspects of your directory, and you’re pretty much set. If your configuration needs some fine-tuning, you can configure which LDAP attributes contain common data, as well as apply search filters for users and groups.
If your organization happens to use an LDAP directory other than Microsoft Active Directory, PortalGuard offers support for several other notable LDAP directories as well as SQL Server-based user stores or Microsoft Azure AD.
Configuring Security Policies
Authentication or security policies are a critical component of any IDM, since they determine which authentication requirements are imposed on users attempting to access corporate resources. Users deploying PortalGuard on-premises will again use the PortalGuard Configuration Editor in order to manage security policies. Currently, BIO-key doesn’t seem to offer a way for IDaaS customers to configure security policies on their own; rather, they must leverage PortalGuard’s support team. The company says web-based administrative tools are coming soon.
The PortalGuard Configuration Editor lets you specify to which users a policy applies (for LDAP, this can be in the form of a filter on users or groups or even a particular organizational unit). Policies also control certain actions within the PortalGuard sphere of influence such as accessing the platform’s SSO portal, as well as self-service features such as password change, reset, and recovery and account unlock. Other security policy settings involve things like auditing, notifications for changes to user data, and password rules (complexity, expiration, restricted words, and rules based on regular expressions).
My primary complaint with security policies is that they put some limits on flexibility compared to competing solutions. For example, there’s no way to tie a particular policy to a set of applications, which results in users being prompted for the same set of authentication methods regardless of what sort of resources they’re trying to access. Another limitation is that some of the more advanced components you can find in competing IDM suites like or VMware, are simply not available with PortalGuard without leveraging code against the API. Features like integration with your mobile device management (MDM) or Unified Endpoint Management (UEM) solution, or even risk scores based on the current authentication attempt, aren’t available out of the box.
PortalGuard MobileAuth With PalmPositive
One of BIO-key’s newest offerings, as mentioned, is MobileAuth with PalmPositive. This mobile app uses your smartphone’s camera to analyze the biometric data in your palm print. There are some obvious upsides to this. For example, it lets you include older phones in your user pool since many old phone or budget models lack fingerprint readers but almost all smartphones have cameras. Add BIO-key’s claim that palm biometrics are more reliable than fingerprint biometrics; the fact that enrollment is considerably faster and more convenient; and that the biometric analysis occurs at the server, not on the device, and palm-based biometrics really start to look good.
Unfortunately, I feel the usability aspect of palm reading suffers a little bit when compared to fingerprint ID. For one thing, you essentially have to take a picture of your palm, which requires two hands. Additionally, it’s impossible to be subtle about the process if you happen to be in a meeting or a casual conversation. Finally, you must use the camera flash in order to get a quality scan of your palm, which means logging in in low-light environments such as a theater is not an option.
Pricing and Plans
PortalGuard’s cost is determined by user count. Pricing starts at $4 per user monthly for customers with fewer than 1,000 users and drops to $2 per user monthly for organizations with over 10,000 users. The nice thing about the licensing structure is its simplicity—each license includes all features, with no upgrades needed in order to gain access to advanced functions.
Overall, PortalGuard has definitely improved since the last time we tried it. BIO-key’s addition of palm-based biometrics should appeal to any organization looking for additional protection beyond passwords, and its low price should be appealing as well.
But IT professionals saddled with supporting a large number of users will find that the platform lacks some of the administrative features of its rivals. You’ll need to contact customer support to define security policies using the cloud service version, as well as having to develop your own integrations with device management tools using an API. If that doesn’t bother you, PortalGuard might be a good choice if you’re keen on its biometric functionality. Otherwise, you’re probably better off with a more well-rounded platform such as Okta.
