DIGIPASS Plug-In for SBR Product Guide A4 - Vasco
DIGIPASS Plug-In for SBR Product Guide A4 - Vasco
DIGIPASS Plug-In for SBR Product Guide A4 - Vasco
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
Modify these field values (right-click and select Fields) to change text throughout the<br />
document:<br />
NOTE: Diagrams may appear or disappear depending on these field settings – so BE CAREFUL<br />
adding and removing diagrams, as you may be stuffing up <strong>for</strong>matting.<br />
ADDITIONAL NOTE: Be careful adding and removing text, too. Just because you see something<br />
in the document that looks like it shouldn't be there, doesn't mean removing it is a smart idea.<br />
Do a print preview to check if it will show up in the final document be<strong>for</strong>e you do anything.<br />
(the field values are currently just (relatively) rubbish values – modified at times to check that<br />
text conditions are working correctly)<br />
sbr<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong><br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
Steel-Belted RADIUS<br />
<strong>SBR</strong><br />
ODBCAD<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
Steel-Belted RADIUS<br />
<strong>SBR</strong><br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong><br />
ODBCAD<br />
<strong>Product</strong> G uide
Disclaimer of Warranties and Limitations of Liabilities<br />
Disclaimer of Warranties and Limitations of Liabilities<br />
The <strong>Product</strong> is provided on an 'as is' basis, without any other warranties, or conditions, express<br />
or implied, including but not limited to warranties of merchantable quality, merchantability of<br />
fitness <strong>for</strong> a particular purpose, or those arising by law, statute, usage of trade or course of<br />
dealing. The entire risk as to the results and per<strong>for</strong>mance of the product is assumed by you.<br />
Neither we nor our dealers or suppliers shall have any liability to you or any other person or<br />
entity <strong>for</strong> any indirect, incidental, special or consequential damages whatsoever, including but<br />
not limited to loss of revenue or profit, lost or damaged data of other commercial or economic<br />
loss, even if we have been advised of the possibility of such damages or they are <strong>for</strong>eseeable;<br />
or <strong>for</strong> claims by a third party. Our maximum aggregate liability to you, and that of our dealers<br />
and suppliers shall not exceed the amount paid by you <strong>for</strong> the <strong>Product</strong>. The limitations in this<br />
section shall apply whether or not the alleged breach or default is a breach of a fundamental<br />
condition or term, or a fundamental breach. Some states/countries do not allow the exclusion<br />
or limitation or liability <strong>for</strong> consequential or incidental damages so the above limitation may<br />
not apply to you.<br />
RADIUS Documentation Disclaimer<br />
The RADIUS documentation featured in this manual is focused on supplying required<br />
in<strong>for</strong>mation pertaining to the RADIUS server and its operation in the VACMAN Middleware<br />
environment. It is recommended that further in<strong>for</strong>mation be gathered from your NAS/RAS<br />
vendor <strong>for</strong> in<strong>for</strong>mation on the use of RADIUS.<br />
Copyright<br />
© 2006 VASCO Data Security <strong>In</strong>c. All rights reserved.<br />
No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in<br />
any <strong>for</strong>m or by any means, electronic, mechanical, photocopying, recording, or otherwise,<br />
without the prior written permission of VASCO Data Security <strong>In</strong>c.<br />
Trademarks<br />
VACMAN and Digipass are registered trademarks of VASCO Data Security <strong>In</strong>ternational <strong>In</strong>c.<br />
Microsoft and Windows are registered trademarks of Microsoft Corporation.<br />
All other trademarks are the property of their respective holders.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 2
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Table of Contents<br />
Table of Contents<br />
1 Overview............................................................................................................... 9<br />
1.1 What is Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>?..................................................................................9<br />
1.2 What is a Digipass?........................................................................................................ 9<br />
1.3 Types of Digipass........................................................................................................... 9<br />
1.3.1 Hardware Digipass.................................................................................................... 9<br />
1.3.2 Software Digipass................................................................................................... 10<br />
1.3.3 Virtual Digipass....................................................................................................... 11<br />
1.4 Software Components.................................................................................................. 12<br />
1.4.1 Required Components.............................................................................................. 12<br />
1.4.2 Optional Components.............................................................................................. 13<br />
1.4.3 Extra Utilities.......................................................................................................... 14<br />
1.5 Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Data Model............................................................................15<br />
1.5.1 Digipass record....................................................................................................... 15<br />
1.5.2 Digipass User account record.................................................................................... 15<br />
1.5.3 Component record................................................................................................... 15<br />
1.5.4 Policy record........................................................................................................... 16<br />
1.5.5 Domain record........................................................................................................ 16<br />
1.5.6 Organizational Unit record........................................................................................ 16<br />
1.6 Available <strong>Guide</strong>s...........................................................................................................17<br />
2 Authentication Process........................................................................................18<br />
2.1 Logging in with a Digipass........................................................................................... 18<br />
2.2 Authentication Process Overview................................................................................. 19<br />
2.3 Identifying the Policy................................................................................................... 20<br />
2.3.1 RADIUS Client Policy Lookup..................................................................................... 20<br />
2.4 Digipass User Account Lookup and Checks................................................................... 21<br />
2.4.1 User ID and Domain Resolution................................................................................. 21<br />
2.4.1.1 Windows Name Resolution................................................................................................... 21<br />
2.4.1.2 Simple Name Resolution (ODBC/embedded database only)...................................................... 21<br />
2.4.1.3 Default Domain.................................................................................................................. 21<br />
2.4.1.4 Active Directory User Account.............................................................................................. 22<br />
2.4.1.5 Summary: Active Directory.................................................................................................. 23<br />
2.4.1.6 Summary: ODBC or Embedded Database...............................................................................24<br />
2.4.2 Windows Group Check (optional)............................................................................... 25<br />
2.4.2.1 'Pass Back' Mode................................................................................................................ 25<br />
2.4.2.2 'Reject' Mode..................................................................................................................... 25<br />
2.4.2.3 'Back-End' Mode.................................................................................................................26<br />
2.4.3 Digipass User Account Lookup................................................................................... 27<br />
2.4.4 Dynamic User Registration........................................................................................ 27<br />
2.5 Local Authentication.....................................................................................................29<br />
2.5.1 Digipass Lookup...................................................................................................... 29<br />
2.5.1.1 No Digipass User Account.................................................................................................... 29<br />
2.5.1.2 Policy Restrictions...............................................................................................................29<br />
2.5.1.3 Linked User Accounts.......................................................................................................... 30<br />
2.5.2 Authentication with Digipass..................................................................................... 31<br />
2.5.2.1 Server PIN.........................................................................................................................31<br />
2.5.2.2 Grace Period...................................................................................................................... 31<br />
2.5.2.3 Challenge Generation..........................................................................................................32<br />
2.5.2.4 Virtual Digipass OTP Generation........................................................................................... 32<br />
2.5.2.5 Requesting a Virtual Digipass OTP – User Perspective..............................................................33<br />
© 2006 VASCO Data Security <strong>In</strong>c. 3
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Table of Contents<br />
2.5.2.6 Request Method and Keyword.............................................................................................. 34<br />
2.5.2.7 Multiple Digipass or Digipass Applications.............................................................................. 35<br />
2.5.3 Authentication without Digipass................................................................................. 36<br />
2.5.3.1 Static Password Verification................................................................................................. 36<br />
2.5.3.2 Self-Assignment................................................................................................................. 36<br />
2.6 Back-End Authentication.............................................................................................. 38<br />
2.6.1 Stored Static Password............................................................................................ 39<br />
2.6.2 Stored Password Proxy............................................................................................ 39<br />
2.6.3 Password Autolearn................................................................................................. 39<br />
2.7 RADIUS Attributes........................................................................................................39<br />
2.7.1 RADIUS Attribute Settings........................................................................................ 40<br />
2.7.2 RADIUS Attributes Process....................................................................................... 42<br />
2.7.3 Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s.............................................................................................. 43<br />
2.8 Supported RADIUS Password Protocols........................................................................45<br />
2.9 Unsupported by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.................................................................... 45<br />
2.9.1 Limitations of RADIUS Password Protocols.................................................................. 45<br />
2.9.2 Unsupported RADIUS Password Protocols................................................................... 46<br />
3 Administration <strong>In</strong>terfaces....................................................................................47<br />
3.1 Administration MMC <strong>In</strong>terface......................................................................................47<br />
3.1.1 Active Directory...................................................................................................... 47<br />
3.1.2 ODBC or Embedded Database................................................................................... 48<br />
3.2 Digipass Extension <strong>for</strong> Active Directory Users & Computers......................................... 49<br />
3.2.1 Context Menu Extensions – Tree Pane........................................................................ 49<br />
3.2.2 Context Menu Extensions – User Records.................................................................... 49<br />
3.2.3 Property Sheet Extensions – User Records.................................................................. 50<br />
3.2.4 Digipass Record Administration................................................................................. 50<br />
3.3 <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration........................................................................................... 51<br />
3.4 Digipass TCL Command-Line Administration................................................................ 51<br />
4 Digipass User Accounts....................................................................................... 53<br />
4.1 Digipass User Account Creation....................................................................................53<br />
4.1.1 Manual Creation...................................................................................................... 53<br />
4.1.2 Dynamic User Registration........................................................................................ 53<br />
4.1.3 User Self-Management Web Site............................................................................... 53<br />
4.2 Changes to Stored Static Password.............................................................................. 53<br />
4.2.1 Password Autolearn................................................................................................. 53<br />
4.2.2 User Self-Management Web Site............................................................................... 54<br />
4.3 Administration Privileges............................................................................................. 54<br />
5 Digipass...............................................................................................................55<br />
5.1 Digipass Record Functions........................................................................................... 55<br />
5.1.1 Reset Application.................................................................................................... 55<br />
5.1.2 Set Event Counter................................................................................................... 55<br />
5.1.3 Reset PIN............................................................................................................... 55<br />
5.1.4 Force PIN Change.................................................................................................... 55<br />
5.1.5 Set PIN.................................................................................................................. 55<br />
5.1.6 Unlock Digipass...................................................................................................... 55<br />
5.1.7 Reset Application Lock............................................................................................. 55<br />
5.1.8 Test a Digipass Application....................................................................................... 56<br />
© 2006 VASCO Data Security <strong>In</strong>c. 4
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Table of Contents<br />
5.2 Digipass Programming................................................................................................. 56<br />
5.2.1 Digipass PIN........................................................................................................... 56<br />
5.2.2 Time/Event-based Digipass Applications..................................................................... 56<br />
5.2.3 OTP Length............................................................................................................ 57<br />
5.2.4 Challenge Length.................................................................................................... 57<br />
5.3 Digipass Record Settings..............................................................................................57<br />
5.3.1 Time/Event-based Settings....................................................................................... 57<br />
5.3.2 Response Length..................................................................................................... 58<br />
5.3.3 Server PIN............................................................................................................. 58<br />
5.3.4 Backup Virtual Digipass............................................................................................ 58<br />
5.4 Assigning Digipass to Users......................................................................................... 60<br />
5.4.1 Self-Assignment...................................................................................................... 60<br />
5.4.2 Auto-Assignment..................................................................................................... 61<br />
5.4.3 Manual Assignment................................................................................................. 62<br />
5.5 Virtual Digipass Implementation Considerations..........................................................63<br />
5.5.1 Digipass Assignment Options.................................................................................... 63<br />
5.5.2 Cost...................................................................................................................... 63<br />
5.5.3 Security................................................................................................................. 63<br />
5.5.4 Convenience........................................................................................................... 63<br />
5.5.5 Gateway and account.............................................................................................. 63<br />
5.5.6 Limiting Usage of Virtual Digipass.............................................................................. 63<br />
5.5.6.1 Backup Virtual Digipass Usage <strong>Guide</strong>lines.............................................................................. 64<br />
5.5.7 Resetting Virtual Digipass Restrictions........................................................................ 65<br />
5.5.8 Virtual Digipass Login options................................................................................... 65<br />
5.5.9 Location of OTP Request Site.................................................................................... 65<br />
6 Components........................................................................................................ 66<br />
6.1 Pre-loaded Components............................................................................................... 66<br />
6.2 Licensing...................................................................................................................... 66<br />
7 Policies................................................................................................................67<br />
7.1 Policy <strong>In</strong>heritance........................................................................................................ 67<br />
7.1.1 Show Effective Settings............................................................................................ 68<br />
7.2 Pre-Loaded Policies...................................................................................................... 69<br />
7.3 Differences from VACMAN Middleware 2.3................................................................... 70<br />
7.3.1 Authenticator Setting............................................................................................... 70<br />
8 Database <strong>In</strong>tegration.......................................................................................... 71<br />
8.1 Active Directory............................................................................................................71<br />
8.1.1 What is Stored in Active Directory?............................................................................ 71<br />
8.1.2 Schema Extensions................................................................................................. 71<br />
8.1.3 Digipass Records..................................................................................................... 71<br />
8.1.3.1 Location of Digipass Records................................................................................................ 71<br />
8.1.3.2 Delegated Administration in Active Directory.......................................................................... 72<br />
8.1.3.3 Typical Digipass Location Models.......................................................................................... 73<br />
8.1.4 Search <strong>for</strong> Digipass Records...................................................................................... 76<br />
8.1.5 Permissions Needed by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>..................................................................... 76<br />
8.1.6 Administrative Permissions....................................................................................... 76<br />
8.1.7 Active Directory Command Line Utility........................................................................ 77<br />
8.2 ODBC or Embedded Database....................................................................................... 78<br />
© 2006 VASCO Data Security <strong>In</strong>c. 5
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Table of Contents<br />
8.2.1 What is Stored in the Data Store?.............................................................................. 78<br />
8.2.2 Domains and Organizational Units............................................................................. 78<br />
8.2.3 Location of Digipass Records..................................................................................... 78<br />
8.2.3.1 Typical Digipass Location Models.......................................................................................... 80<br />
8.2.4 Permissions Needed by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>..................................................................... 82<br />
8.2.5 Database Command Line Utility................................................................................. 83<br />
8.2.6 Additional ODBC Databases...................................................................................... 83<br />
8.2.7 Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s.............................................................................................. 84<br />
8.3 Sensitive Data Encryption............................................................................................ 84<br />
9 Licensing............................................................................................................. 85<br />
9.1 Overview...................................................................................................................... 85<br />
9.2 Obtaining and Loading a License Key........................................................................... 85<br />
10 Auditing and Tracing........................................................................................... 86<br />
10.1Audit System................................................................................................................ 86<br />
10.1.1 Configure Auditing Output........................................................................................ 86<br />
10.1.2 Audit Viewer........................................................................................................... 87<br />
10.1.3 Audit message types............................................................................................... 88<br />
10.1.4 Active Directory Auditing.......................................................................................... 88<br />
10.2Tracing......................................................................................................................... 88<br />
11 User Self Management Web Site..........................................................................89<br />
11.1What is the User Self Management Web Site?.............................................................. 89<br />
11.2Customizing the User Self Management Web Site.........................................................90<br />
12 OTP Request Site.................................................................................................91<br />
12.1What is the OTP Request Site?..................................................................................... 91<br />
12.1.1 Customizing the OTP Request Site............................................................................. 91<br />
13 Message Delivery Component..............................................................................92<br />
13.1What is the Message Delivery Component?.................................................................. 92<br />
13.2Configuration............................................................................................................... 92<br />
Alphabetical <strong>In</strong>dex.............................................................................................. 93<br />
© 2006 VASCO Data Security <strong>In</strong>c. 6
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Table of Contents<br />
Illustration <strong>In</strong>dex<br />
Image 1: GO 1......................................................................................................................... 10<br />
Image 2: GO 3......................................................................................................................... 10<br />
Image 3: DP 300....................................................................................................................... 10<br />
Image 4: DP 585....................................................................................................................... 10<br />
Image 5: DP 260....................................................................................................................... 10<br />
Image 6: GO 2......................................................................................................................... 10<br />
Image 7: DP 800....................................................................................................................... 10<br />
Image 8: Digipass <strong>for</strong> Pocket PC.................................................................................................. 11<br />
Image 9: Digipass <strong>for</strong> SIM.......................................................................................................... 11<br />
Image 10: Digipass <strong>for</strong> Palm....................................................................................................... 11<br />
Image 11: Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Components........................................................................... 12<br />
Image 11: Login Method Processes.............................................................................................. 18<br />
Image 12: Authentication Process................................................................................................ 19<br />
Image 13: RADIUS Client Policy Lookup....................................................................................... 20<br />
Image 14: Name Resolution – Active Directory.............................................................................. 23<br />
Image 15: Name Resolution – ODBC/Embedded Database.............................................................. 24<br />
Image 16: Dynamic User Registration Process............................................................................... 28<br />
Image 17: User Account Link...................................................................................................... 30<br />
Image 18: Virtual Digipass login.................................................................................................. 33<br />
Image 19: Multiple Digipass Assignment....................................................................................... 35<br />
Image 20: RADIUS Attribute Settings in <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration.................................................. 40<br />
Image 21: RADIUS Attribute Settings in Digipass User Properties..................................................... 41<br />
Image 22: Set RADIUS Attributes Process..................................................................................... 42<br />
Image 23: Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s Using Same User Attributes.......................................................... 43<br />
Image 24: Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s Using Different User Attributes...................................................... 44<br />
Image 25: Administration MMC <strong>In</strong>terface...................................................................................... 47<br />
Image 26: Digipass Extension <strong>for</strong> Active Directory Users and Computers........................................... 50<br />
Image 27: Self-Assignment Process............................................................................................. 60<br />
Image 28: Auto-Assignment Process............................................................................................ 61<br />
Image 29: Manual Assignment Process......................................................................................... 62<br />
Image 30: Component Overview................................................................................................. 66<br />
Image 31: Policy <strong>In</strong>heritance...................................................................................................... 67<br />
Image 32: Digipass Record Locations - Digipass Pool...................................................................... 73<br />
Image 33: Digipass Record Locations - Parent Organizational Unit.................................................... 74<br />
Image 34: Digipass Record Locations - <strong>In</strong>dividual Organizational Units.............................................. 75<br />
Image 35: Digipass Search window.............................................................................................. 76<br />
© 2006 VASCO Data Security <strong>In</strong>c. 7
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Table of Contents<br />
Image 36: Domain and Organizational Unit Overview..................................................................... 78<br />
Image 37: Digipass Record Locations – Domain Root...................................................................... 80<br />
Image 38: Digipass Record Locations - Parent Organizational Unit.................................................... 81<br />
Image 39: Digipass Record Locations - <strong>In</strong>dividual Organizational Units.............................................. 82<br />
Image 40: Additional ODBC databases......................................................................................... 83<br />
Image 41: Multiple <strong>Plug</strong>-<strong>In</strong>s Using Single Database........................................................................ 84<br />
Image 42: OTP Request Site....................................................................................................... 91<br />
© 2006 VASCO Data Security <strong>In</strong>c. 8
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
1 Overview<br />
1.1 What is Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>?<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> is a suite of components that work together to add Digipass twofactor<br />
authentication to Steel-Belted RADIUS.<br />
1.2 What is a Digipass?<br />
A Digipass is a device <strong>for</strong> providing a One Time Password to a User. A Digipass is provided to<br />
each person whom a company wishes to be able to log into their system using One Time<br />
Passwords. The User obtains a One Time Password (OTP) from the Digipass to use instead of,<br />
or as well as, a static password when logging in.<br />
Virtual Digipass is a mechanism where an OTP is generated by the server and sent by text<br />
message to the User's mobile phone. <strong>In</strong> this case, a physical Digipass device is not needed.<br />
1.3 Types of Digipass<br />
Each Digipass is programmed with at least one Digipass Application, and a unique algorithm.<br />
The Digipass uses this unique algorithm when generating One Time Passwords.<br />
Each type of Digipass Application generates One Time Passwords from different data, and in<br />
slightly different ways:<br />
Response Only<br />
Creates a One Time Password based on the date and time, or on the number of uses (events).<br />
Challenge/Response<br />
Creates a One Time Password (also referred to as a 'Response' in this context) based on a<br />
numerical challenge given on a login page. This may be either a challenge custom-created <strong>for</strong><br />
the specific Digipass, or a randomly created challenge. The One Time Password may also be<br />
based on the date and time.<br />
Digital Signature<br />
Digital Signature Digipass Applications are typically used in online banking. The Digipass<br />
generates a unique code - referred to as a 'Digital Signature' - based on a number of factors<br />
entered, plus (optionally) the date and time, or number of uses (events). <strong>In</strong> an online banking<br />
environment, the factors used to generate the Digital Signature during a funds transfer might<br />
be the debit account number, the destination account number and the amount of money being<br />
transferred.<br />
Digital Signatures are not currently in use with the Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.<br />
1.3.1 Hardware Digipass<br />
Hardware Digipass are devices specifically designed <strong>for</strong> creation of One Time Passwords.<br />
Depending on the model supplied, they may be used <strong>for</strong> Response Only, Challenge/Response<br />
and Digital Signature methods.<br />
The three basic types of hardware Digipass are:<br />
© 2006 VASCO Data Security <strong>In</strong>c. 9
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
Digipass without keypads<br />
These are the simplest type of Digipass. They have a triggering mechanism - typically a button<br />
or action, such as pulling the Digipass open – which causes a One Time Password to be<br />
generated. They have only one Application, which is Response Only.<br />
Digipass with keypads<br />
Image 1: GO 1 Image 2: GO 3<br />
These are typically capable of supporting more than one Application, and can be programmed<br />
so that a PIN must be entered be<strong>for</strong>e a One Time Password may be accessed.<br />
Image 3: DP 300 Image 4: DP 585 Image 5: DP 260<br />
Smartcard reader Digipass<br />
These provide two-factor authentication based on smartcard technology.<br />
1.3.2 Software Digipass<br />
Image 6: GO 2 Image 7: DP 800<br />
Software Digipass may be installed on a PDA or other mobile device. The User then accesses a<br />
Digipass program to obtain a One Time Password. They typically support Response Only,<br />
Challenge/Response and Digital Signature (not supported by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>)<br />
methods.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 10
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
Image 8: Digipass <strong>for</strong><br />
Pocket PC<br />
Digipass <strong>for</strong> Pocket PC<br />
Image 9: Digipass <strong>for</strong><br />
SIM<br />
Image 10: Digipass <strong>for</strong><br />
Palm<br />
Digipass <strong>for</strong> Pocket PC turns Pocket PCs and smart phones into a personal hardware security<br />
device to provide One Time Passwords and Digital Signatures.<br />
Digipass <strong>for</strong> Palm<br />
Like Digipass <strong>for</strong> Pocket PC, Digipass <strong>for</strong> Palm allows generation of One Time Passwords and<br />
Digital Signatures from Palm Pilots and other devices utilising the Palm technology.<br />
Digipass <strong>for</strong> SIM<br />
Digipass <strong>for</strong> SIM allows a GSM mobile phone SIM card to be used to generate One Time<br />
Passwords.<br />
Digipass <strong>for</strong> Windows<br />
Digipass <strong>for</strong> Windows can be installed directly onto a PC. One Time Passwords and Digital<br />
Signatures can be generated on your computer and pasted into the required login window.<br />
1.3.3 Virtual Digipass<br />
Virtual Digipass can be used instead of hardware Digipass tokens, or as a backup mechanism<br />
when a User has mislaid their hardware Digipass. Using Virtual Digipass means that a User<br />
may receive a One Time Password on their mobile phone via text message.<br />
There are two <strong>for</strong>ms of Virtual Digipass available:<br />
Primary Virtual Digipass are treated by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> almost identically to<br />
hardware and software Digipass – a record of each Primary Virtual Digipass must be imported<br />
into the data store, and may then be assigned to a User automatically or manually. The User<br />
will typically log in with their User ID and static password, have a text message sent to their<br />
mobile phone, and then enter the One Time Password from the text message in the second<br />
stage of their login.<br />
The Backup Virtual Digipass feature allows a User to request a One Time Password sent to<br />
their mobile phone if they do not have their usual Digipass at hand. It may be limited by<br />
number of uses or days of use – eg. a User may be limited to 2 days' usage, after which they<br />
will again need to use their usual Digipass to log in.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 11
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
1.4 Software Components<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> consists of various components, some necessary and some optional.<br />
The diagram below shows an overview of the components, and how they interact.<br />
Image 11: Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Components<br />
1.4.1 Required Components<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
This is a <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> that per<strong>for</strong>ms the authentication processing. It can receive<br />
authentication requests from <strong>SBR</strong> and return an Access-Accept (with attributes if available) or<br />
Access-Reject.<br />
Data Store<br />
All in<strong>for</strong>mation required by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> is stored in Active Directory or an ODBC-<br />
© 2006 VASCO Data Security <strong>In</strong>c. 12
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
compliant database. An embedded PostgreSQL database option is provided with Digipass <strong>Plug</strong>-<br />
<strong>In</strong> <strong>for</strong> <strong>SBR</strong>. The data store to be used is selected during installation.<br />
Administration MMC <strong>In</strong>terface<br />
This interface is used in slightly different ways, depending on the data store used by Digipass<br />
<strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.<br />
Active Directory<br />
If Active Directory is used as the data store, the Administration MMC <strong>In</strong>terface will be used <strong>for</strong><br />
administration of Policy, Component and Back-End Server records.<br />
ODBC Database (including embedded database)<br />
If an ODBC database is used as the data store, the Administration MMC <strong>In</strong>terface will be used<br />
<strong>for</strong> administration of all VASCO data.<br />
Regardless of the data store used, administration is carried out by direct connection to the<br />
data store.<br />
Active Directory Users and Computers Extension<br />
A VASCO Extension to the Active Directory Users and Computers interface allows<br />
administration of additional User settings and Digipass records integrated with standard Active<br />
Directory User administration. This is only available when Active Directory is used as the data<br />
store <strong>for</strong> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.<br />
Audit System<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> provides a comprehensive audit trail of significant processing events such as<br />
successful and failed authentication attempts. The audit messages can be written to text files,<br />
the Windows Event Log and/or an ODBC-compliant database.<br />
1.4.2 Optional Components<br />
Audit Viewer<br />
The Audit Viewer is a Windows application that can display and filter audit messages from the<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. It can read the data from text files and ODBC databases, or receive a live feed<br />
from the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
Virtual Digipass<br />
The VASCO components used <strong>for</strong> Virtual Digipass are:<br />
Message Delivery Component<br />
This is a Service that is responsible <strong>for</strong> delivering One Time Passwords through a text message<br />
HTTP gateway to a User’s mobile phone.<br />
OTP Request Site<br />
This is a miniature web site that allows a User to request a Virtual Digipass OTP to be sent to<br />
their mobile phone.<br />
User Self Management Web Site<br />
This is a miniature web site that allows Users to make appropriate changes to their own<br />
Digipass settings, such as PIN changes. This is used in a RADIUS environment, when the<br />
normal authentication requests are made using a CHAP-based protocol and there<strong>for</strong>e PIN<br />
© 2006 VASCO Data Security <strong>In</strong>c. 13
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
changes and other 'self-management' features are not possible.<br />
Digipass TCL Command-Line Administration<br />
Administration may also be carried out using Digipass TCL Command-Line Administration<br />
Utility, which allows interactive command-line and scripted administration of Digipass <strong>Plug</strong>-<strong>In</strong><br />
<strong>for</strong> <strong>SBR</strong> data.<br />
1.4.3 Extra Utilities<br />
These extra utilities may be used with Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>, but require separate<br />
installations.<br />
Data Migration Tool<br />
The VASCO Data Migration Tool is a general-purpose utility that allows you to migrate your<br />
data from one VASCO product to another.<br />
RADIUS Client Simulator<br />
The RADIUS Client Simulator is a program that simulates RADIUS Authentication and<br />
Accounting processing in a similar fashion to 'real' RADIUS clients. The RADIUS Client<br />
Simulator can be used to test Digipass authentication or to estimate per<strong>for</strong>mance.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 14
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
1.5 Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Data Model<br />
The following kinds of record are stored in the Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> data store:<br />
1.5.1 Digipass record<br />
A Digipass record must exist in the data store <strong>for</strong> each Digipass in use. This record contains:<br />
<strong>In</strong><strong>for</strong>mation about the Digipass (eg. serial number and model)<br />
The names and programming parameters of Applications in the Digipass<br />
The status of various options (eg. Digipass lock)<br />
Some of the in<strong>for</strong>mation in this record is encrypted together in what is called the 'Digipass<br />
blob'. There is one 'blob' per Application.<br />
See 5 Digipass <strong>for</strong> more in<strong>for</strong>mation.<br />
1.5.2 Digipass User account record<br />
Each User who will be logging in using Digipass authentication will require a Digipass User<br />
account. The Digipass User account record contains extra in<strong>for</strong>mation needed by Digipass <strong>Plug</strong>-<br />
<strong>In</strong> <strong>for</strong> <strong>SBR</strong>, such as authentication settings. A Digipass must be assigned to a Digipass User<br />
account be<strong>for</strong>e it can be used <strong>for</strong> authentication.<br />
Using Active Directory, a Digipass User account is attached to an Active Directory user account<br />
(as an 'auxiliary class'). It is not possible to create a Digipass User account without an Active<br />
Directory user account. A Digipass User account is not required <strong>for</strong> administration, as<br />
administrative work is carried out using native Active Directory permissions.<br />
Using a database, Digipass User accounts are stored in a standard database table. They are<br />
not linked to any external user accounts. Administrative privileges are assigned to Digipass<br />
User accounts and there<strong>for</strong>e a Digipass User account is needed <strong>for</strong> each administrator.<br />
See 4 Digipass User Accounts <strong>for</strong> more in<strong>for</strong>mation.<br />
1.5.3 Component record<br />
Component records are created to represent:<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s<br />
Authentication client components – RADIUS Clients, IIS Modules (not required <strong>for</strong><br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>)<br />
Administration client components (not required <strong>for</strong> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>)<br />
They are used <strong>for</strong> the following main purposes:<br />
For authentication clients, to indicate that it is permitted to process an authentication<br />
request from that client, and to specify an authentication Policy (see below) to be used<br />
For RADIUS Clients, to hold the Shared Secret<br />
To holding a license key <strong>for</strong> <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s and IIS Modules<br />
See 6 Components <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 15
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
1.5.4 Policy record<br />
Policies specify various settings that affect the User authentication process. Each<br />
authentication request is handled according to a Policy that is identified by the applicable<br />
Component record.<br />
There are many Policy settings including the following examples:<br />
Whether Windows or RADIUS authentication should be used<br />
Whether various automatic management features should be used<br />
The Digipass Application types required<br />
Backup Virtual Digipass settings<br />
See 7 Policies <strong>for</strong> more in<strong>for</strong>mation.<br />
1.5.5 Domain record<br />
Domains are handled differently by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> depending on the data store<br />
used:<br />
Active Directory<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> operates within the pre-existing Active Directory domain and<br />
Organizational Unit structure. Each Digipass User and Digipass must belong to a domain in<br />
Active Directory.<br />
User IDs must be unique within a domain, but may be repeated between domains.<br />
While Digipass User account and Digipass records can belong to any domain, a single domain<br />
is identified during installation as the Digipass Configuration Domain. This domain is used<br />
to store the Component, Policy and Back-End Server records. It is also used as a default<br />
domain <strong>for</strong> user lookup, when no domain is specified.<br />
ODBC or Embedded Database<br />
Domains are included to:<br />
mirror the data structure used in Active Directory (approximately)<br />
allocate unassigned Digipass records to different Domains, <strong>for</strong> example to mirror the<br />
geographic location of the devices<br />
Domains are created manually using the Administration MMC <strong>In</strong>terface.<br />
Each Digipass User and Digipass must belong to a domain. One domain is identified as the<br />
Master Domain – this will be the default domain when none is specified. <strong>In</strong> addition,<br />
administrators in the Master Domain can be given rights to access data in all domains, where<br />
other administrators are limited to data in their own domain.<br />
User IDs must be unique within a domain, but may be repeated between domains. Digipass<br />
serial numbers must be unique in the database.<br />
1.5.6 Organizational Unit record<br />
Organizational Units are also handled differently by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> depending on the<br />
data store used:<br />
© 2006 VASCO Data Security <strong>In</strong>c. 16
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Overview<br />
Active Directory<br />
Digipass User accounts and Digipass records are normally stored in Organizational Units or the<br />
Users container. A special container called Digipass-Pool is created during installation to hold<br />
unassigned Digipass, although they can be located in Organizational Units instead.<br />
Administration duties may be assigned to administrators per Organizational Unit, in the same<br />
way that regular user administration is delegated at that level.<br />
ODBC or Embedded Database<br />
Organizational Units are included to:<br />
mirror the data structure used in Active Directory (approximately)<br />
allocate unassigned Digipass records to different Organizational Units, <strong>for</strong> example to<br />
mirror the geographic location of the devices<br />
Digipass User accounts and Digipass records may belong to an Organizational Unit, but this is<br />
not mandatory.<br />
1.6 Available <strong>Guide</strong>s<br />
The following guides are available:<br />
<strong>Product</strong> <strong>Guide</strong><br />
The <strong>Product</strong> <strong>Guide</strong> will introduce you to the features and concepts of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong><br />
and the various options you have <strong>for</strong> using it.<br />
<strong>In</strong>stallation <strong>Guide</strong><br />
Use this guide when planning and working through an installation of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.<br />
Getting Started<br />
To get you up and running quickly with a simple installation and setup of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong><br />
<strong>SBR</strong>.<br />
Administrator Reference<br />
<strong>In</strong>-depth in<strong>for</strong>mation required <strong>for</strong> administration of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>. This includes<br />
references such as data attribute lists, backup and recovery and utility commands.<br />
Data Migration Tool <strong>Guide</strong><br />
Takes you through a data migration from one VASCO product to another, using the VASCO<br />
Data Migration Tool.<br />
Help Files<br />
Context-sensitive help accompanies the administration interfaces.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 17
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2 Authentication Process<br />
2.1 Logging in with a Digipass<br />
The diagram below shows a typical login process <strong>for</strong> the three basic login methods supported<br />
by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.<br />
Image 11: Login Method Processes<br />
© 2006 VASCO Data Security <strong>In</strong>c. 18
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.2 Authentication Process Overview<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> authenticates logins in two basic ways:<br />
Using in<strong>for</strong>mation from its data store ('local' authentication)<br />
Asking a RADIUS server or Windows <strong>for</strong> verification of in<strong>for</strong>mation ('back-end'<br />
authentication)<br />
The diagram below shows the basic process followed by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> when authenticating a<br />
Digipass User login.<br />
Image 12: Authentication Process<br />
© 2006 VASCO Data Security <strong>In</strong>c. 19
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.3 Identifying the Policy<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> identifies the Policy that will direct the remainder of the authentication<br />
process directly after the component check. It also checks that the Policy is valid.<br />
Normally, the Component record identified in the component check is used to select the Policy.<br />
However, this is not always the case.<br />
2.3.1 RADIUS Client Policy Lookup<br />
A RADIUS Client may be a RADIUS server that proxies requests from other sources. If so, you<br />
may wish to specify different Policies according to the original sources. This can be done by<br />
creating additional RADIUS Client Component records, using the NAS-IP-Address values<br />
corresponding to the original sources. For a source that does not include the NAS-IP-Address,<br />
the NAS-Identifier value should be used instead. There is no need to set a Shared Secret in<br />
these RADIUS Client Component records, as they are there simply to select a Policy and not to<br />
authorize requests that come directly from that location.<br />
The lookup process to identify the Policy <strong>for</strong> a RADIUS authentication request is shown below.<br />
Image 13: RADIUS Client Policy Lookup<br />
© 2006 VASCO Data Security <strong>In</strong>c. 20
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.4 Digipass User Account Lookup and Checks<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> per<strong>for</strong>ms a number of checks be<strong>for</strong>e proceeding to local authentication.<br />
2.4.1 User ID and Domain Resolution<br />
<strong>In</strong> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>, Digipass User accounts are identified using a User ID and a<br />
Domain, not just a User ID. There are a few ways to do this:<br />
2.4.1.1 Windows Name Resolution<br />
<strong>In</strong> Windows environments, there are a few ways to provide these details when logging in:<br />
Using NT4-style domain qualification in front of the User ID: DOMAIN\userid<br />
Using the User-Principal-Name as the User ID: user@suffix (note that this is only usable<br />
in Active Directory, not NT4 Domains)<br />
With separate User ID and Domain fields (this is not possible using RADIUS)<br />
When Digipass User accounts correspond to Windows user accounts, the Windows Name<br />
Resolution feature can be used to support these three login <strong>for</strong>mats. If Active Directory is the<br />
data store, this is done automatically. With ODBC or an embedded database, it is optional<br />
whether to user Windows Name Resolution or not. However, if the Windows Name Resolution<br />
process is enabled and fails, the login is rejected. There<strong>for</strong>e, a login with a User ID that does<br />
not correspond to a Windows user account will be rejected.<br />
With this feature enabled, Windows is used to resolve the NT4-style and User-Principal-Name<br />
User ID <strong>for</strong>mats. <strong>In</strong> addition, if an Active Directory Domain name is passed as a separate<br />
parameter in short <strong>for</strong>m (eg. VASCO instead of vasco.com), Windows is used to resolve to the<br />
Fully Qualified Domain Name (eg. vasco.com). Otherwise, Windows resolution does not occur.<br />
For ODBC/embedded database, Windows Name Resolution is enabled using the<br />
Authentication Server Configuration program. Click the Configure Advanced Settings<br />
button on the ODBC Connection tab to get the Advanced Settings dialog; check the Use<br />
Windows User Name Resolution checkbox.<br />
2.4.1.2 Simple Name Resolution (ODBC/embedded database only)<br />
When Windows Name Resolution is not used, the following <strong>for</strong>mats are available:<br />
Using a similar <strong>for</strong>mat to User-Principal-Name: user@domain<br />
With separate User ID and Domain fields (this is not possible using RADIUS)<br />
If the user@domain <strong>for</strong>mat is used <strong>for</strong> the User ID, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will look <strong>for</strong> a Domain<br />
record with the name given after the @. If the Domain is found, the @domain part will be<br />
stripped from the User ID be<strong>for</strong>e the authentication process continues. If it is not found, the<br />
User ID will be left as user@domain, and no Domain will be identified. <strong>In</strong> that case, the<br />
Default Domain processing will be used, as described next.<br />
2.4.1.3 Default Domain<br />
Using either Windows or Simple Name Resolution, if none of the above <strong>for</strong>mats are used, only<br />
the User ID is given, with no Domain qualification. It is still necessary to identify the Domain in<br />
order to look up the Digipass User account.<br />
The Default Domain can be configured in the following ways:<br />
© 2006 VASCO Data Security <strong>In</strong>c. 21
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
<strong>In</strong> the Policy record, the Default Domain field can be set. If this is set, it will be used<br />
when no Domain has been identified by the Windows or Simple Name Resolution.<br />
Using Active Directory as the data store, when the Policy has no Default Domain set, the<br />
Digipass Configuration Domain will be used.<br />
Using an ODBC or embedded database as the data store, when the Policy has no Default<br />
Domain set, the Master Domain will be used.<br />
2.4.1.4 Active Directory User Account<br />
When Active Directory is used as the data store, Digipass User accounts are always attached to<br />
Active Directory User accounts. There<strong>for</strong>e, if an authentication request is received <strong>for</strong> a User<br />
who does not have an account in Active Directory, the request is rejected.<br />
This is not mandatory <strong>for</strong> an ODBC or embedded database.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 22
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.4.1.5 Summary: Active Directory<br />
The full process of User ID and Domain name resolution is illustrated in the following diagram,<br />
<strong>for</strong> the case where Active Directory is the data store:<br />
Image 14: Name Resolution – Active Directory<br />
© 2006 VASCO Data Security <strong>In</strong>c. 23
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.4.1.6 Summary: ODBC or Embedded Database<br />
The full process of User ID and Domain name resolution is illustrated in the following diagram,<br />
<strong>for</strong> the case where an ODBC or embedded database is the data store:<br />
Image 15: Name Resolution – ODBC/Embedded Database<br />
© 2006 VASCO Data Security <strong>In</strong>c. 24
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.4.2 Windows Group Check (optional)<br />
Specific Windows Groups can be selected <strong>for</strong> authentication by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. This<br />
Windows Group Check feature might be used when:<br />
Deploying Digipass in stages. Users are not required to log in using a Digipass until they<br />
are put into a Windows group. They can be put into the group in manageable stages.<br />
Two-factor authentication is needed only <strong>for</strong> access to sensitive data, which has been<br />
granted to certain Users (<strong>for</strong> example, administrators). Only this group of people will<br />
require Digipass, and will be authenticated by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. Other Users will be<br />
authenticated by another authentication method.<br />
Most Users will have Digipass and be permitted to log in to the system, but some Users<br />
should not be authenticated under any circumstances.<br />
Authentication is needed <strong>for</strong> the live Audit Viewer connection to the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>, when<br />
using Active Directory as the data store. The Group Check can be used to limit which<br />
users are allowed to connect, <strong>for</strong> example to the Domain Admins group.<br />
When the Group Check is active, Users who are in one of the defined groups go through the<br />
full authentication process. However, there are a few Group Check Modes that control the<br />
outcome <strong>for</strong> Users who are not in one of the groups. The Group Check Mode is defined in the<br />
Policy.<br />
One or more Windows Group names must be defined in a Group List in the Policy. Group<br />
membership is checked within the User's own domain only, there<strong>for</strong>e these Groups must exist<br />
in each domain where there are Users who need to be included in a Group.<br />
Note<br />
It is important to note that when the Group Check is used, if the Group Check<br />
fails, the login will fail. This will occur <strong>for</strong> a user who is unknown to Windows.<br />
The following Group Check Modes are available:<br />
2.4.2.1 'Pass Back' Mode<br />
The full name in the Policy property sheet <strong>for</strong> this mode is:<br />
Pass requests <strong>for</strong> users not in listed groups back to host system<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> does not handle authentication <strong>for</strong> Users who are not in one of the defined<br />
groups. These Users are handled by Steel-Belted RADIUS. <strong>In</strong> effect, this means that they do<br />
not need to have Digipass User accounts and they do not need to use a Digipass to log on. As<br />
soon as the Group Check indicates that the User is not to be handled, authentication<br />
processing stops and the 'not handled' result is returned.<br />
This mode is suitable <strong>for</strong> staged deployment of Digipass and <strong>for</strong> the case where only certain<br />
Users need strong (Digipass) authentication.<br />
2.4.2.2 'Reject' Mode<br />
The full name in the Policy property sheet <strong>for</strong> this mode is:<br />
Reject requests <strong>for</strong> users not in listed groups<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> rejects authentication immediately <strong>for</strong> Users who are not in one of the defined<br />
groups.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 25
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
This mode is suitable <strong>for</strong> restricting which Users are permitted to log in.<br />
2.4.2.3 'Back-End' Mode<br />
The full name in the Policy property sheet <strong>for</strong> this mode is:<br />
Use only Back-End Authentication <strong>for</strong> users not in listed groups<br />
This mode can be used when Back-End Authentication is set up (see 2.6 Back-End<br />
Authentication). The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will just use Back-End Authentication <strong>for</strong> Users who are not<br />
in one of the defined groups.<br />
Back-End Authentication will be used <strong>for</strong> the out-of-group Users even if the Policy setting <strong>for</strong><br />
Back-End Authentication is set to None. <strong>In</strong> that case, the in-group Users would be<br />
authenticated only by Local Authentication, while the out-of-group Users would be<br />
authenticated only by Back-End Authentication. However, it is necessary to define the Back-<br />
End Protocol Policy setting.<br />
This mode is suitable <strong>for</strong> staged deployment of Digipass and <strong>for</strong> the case where only certain<br />
Users need strong (Digipass) authentication.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 26
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.4.3 Digipass User Account Lookup<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> checks that the User attempting to log in has a Digipass User account in the<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> data store. The User ID and Domain Resolution per<strong>for</strong>med earlier<br />
determines the search criteria to look up the Digipass User account.<br />
If a Digipass User account is found, the Disabled and Locked indicators are checked. If either<br />
is set to Yes, the authentication request is rejected immediately.<br />
If no Digipass User account is found, then Policy settings will determine whether the <strong>SBR</strong> <strong>Plug</strong>-<br />
<strong>In</strong> continues processing or rejects the authentication request:<br />
If Local Authentication is required, a Digipass User account must exist. It is only<br />
possible to proceed if the Dynamic User Registration feature is enabled. This is<br />
explained further below.<br />
If Local Authentication is not required, authentication processing can proceed without<br />
a Digipass User account.<br />
If the Local Authentication Policy setting is None, no Local Authentication is required. If it is<br />
set to Digipass/Password or Digipass Only, Local Authentication is required.<br />
2.4.4 Dynamic User Registration<br />
Dynamic User Registration (DUR) allows Digipass User accounts to be created automatically<br />
when their credentials are validated by Back-End Authentication (ie. by Windows or a<br />
RADIUS server). The correct static password will be sufficient to permit a Digipass User<br />
account to be created. DUR saves the administrative work of manually creating or importing<br />
Digipass User accounts.<br />
It is typically used in conjunction with:<br />
the Digipass Auto-Assignment feature, which will assign the next available Digipass to<br />
the new Digipass User account as it is created, or<br />
the Digipass Self-Assignment feature, which will allow the new User to assign a<br />
Digipass to their account as part of their login process<br />
For more details on these Digipass assigment features, see 5 Digipass.<br />
<strong>In</strong> order to control the creation of new accounts, DUR can be used with:<br />
the Windows Name Resolution feature (this is mandatory <strong>for</strong> Active Directory); this<br />
will prevent more than one Digipass User account being created <strong>for</strong> the same Windows<br />
User account, when they use different User ID <strong>for</strong>mats to log in<br />
the Windows Group Check feature, so that a staged creation of Digipass User accounts<br />
and assignment of Digipass is achieved<br />
A typical DUR process using Auto-Assignment and the Windows Group Check is illustrated<br />
below.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 27
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
Image 16: Dynamic User Registration Process<br />
© 2006 VASCO Data Security <strong>In</strong>c. 28
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.5 Local Authentication<br />
Local Authentication is a term used to describe the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> authenticating a User based<br />
on in<strong>for</strong>mation in its data store. Typically the Digipass One Time Password is required, but in<br />
other cases a static password may be sufficient.<br />
The Local Authentication Policy setting indicates whether to per<strong>for</strong>m Local Authentication,<br />
and if so, whether a static password is permitted. This setting is overridden by the same<br />
setting in the Digipass User account, unless that has the value Default. However, this setting in<br />
the Digipass User account would typically be used only <strong>for</strong> rare special case Users.<br />
Using the Windows Group Check in Back-End Mode, this setting can be overridden. If a User<br />
is not in the list of groups, no Local Authentication will be per<strong>for</strong>med.<br />
The possible values <strong>for</strong> the Local Authentication setting are as follows:<br />
None<br />
No Local Authentication will take place.<br />
Digipass/Password<br />
A Digipass One Time Password or static password may be verified. As a general rule, until a<br />
User starts to use a Digipass, they may continue to authenticate with their static password.<br />
Digipass Only<br />
A Digipass One Time Password must be verified. Users without Digipass will not be able to log<br />
in. However, Self-Assignment is still possible, as an OTP is used as part of the process.<br />
2.5.1 Digipass Lookup<br />
The first step of Local Authentication is to search <strong>for</strong> Digipass records applicable to the login.<br />
Normally, this is a simple search <strong>for</strong> all Digipass assigned to the Digipass User account.<br />
However, there are exceptions:<br />
2.5.1.1 No Digipass User Account<br />
If there is no Digipass User account, no search will be done. This can occur if Dynamic User<br />
Registration is enabled.<br />
2.5.1.2 Policy Restrictions<br />
The Policy can specify restrictions on which types of Digipass and/or Digipass Applications may<br />
be used. Any combination of the following restrictions can be defined:<br />
Application Names – a list of named Applications. Only Digipass that have one or more<br />
of the named Applications will be usable.<br />
Application Type – either Response Only or Challenge/Response (Signatures are not<br />
currently supported in Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>). Only Digipass with that Application<br />
Type will be usable.<br />
Digipass Type – a list of models such as DPGO3, DP260. Only Digipass from the listed<br />
models will be usable.<br />
There<strong>for</strong>e, it is possible that a Digipass User account that has a Digipass assigned is not able<br />
to use that Digipass to log in, when a certain Policy applies. They will be regarded as a User<br />
© 2006 VASCO Data Security <strong>In</strong>c. 29
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
without a Digipass in that case. <strong>In</strong> a different kind of login, a different Policy may apply, with<br />
no restrictions. Then they would be treated as a User with a Digipass.<br />
For example, a company has Go 3 Digipass (DPGO3) and Primary Virtual Digipass (DPVTL).<br />
The Outlook Web Access login permits both, so its Policy does not restrict Digipass Types.<br />
However the RADIUS VPN login requires the Go 3, so its Policy specifies Digipass Type =<br />
DPGO3.<br />
2.5.1.3 Linked User Accounts<br />
If a person has two Digipass User accounts, <strong>for</strong> example an administrative account and a<br />
'normal user' account, the two accounts can be linked together. This provides the ability <strong>for</strong><br />
the two accounts to share a Digipass. The Digipass is assigned to one of the accounts, then the<br />
other account is linked to it.<br />
Image 17: User Account Link<br />
When an authenticating Digipass user account is linked to another, the search <strong>for</strong> Digipass will<br />
be done <strong>for</strong> the other account. <strong>In</strong> the example above, Digipass User account 2 is linked to<br />
Digipass User account 1. The Digipass is assigned to Digipass User account 1. When Digipass<br />
User account 1 logs in, the Digipass search is <strong>for</strong> that account. When Digipass User account 2<br />
logs in however, the Digipass search is <strong>for</strong> Digipass User account 1.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 30
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.5.2 Authentication with Digipass<br />
When the Digipass lookup returns at least one Digipass record, authentication processing<br />
requires a valid One Time Password to succeed, unless:<br />
All Digipass found are within a Grace Period. This feature is described below.<br />
The User successfully requests a Challenge <strong>for</strong> Challenge/Response (see below).<br />
The User successfully requests a Virtual Digipass One Time Password (see below).<br />
2.5.2.1 Server PIN<br />
A Server PIN may be required in addition to the One Time Password. The Server PIN is<br />
entered during login with the OTP – instead of a Digipass PIN, which is entered into the<br />
Digipass device. <strong>In</strong> some cases a new Server PIN may need to be set. This gives the following<br />
permutations:<br />
OTP – the normal login where a Server PIN is not required.<br />
PINOTP – the normal login where a Server PIN is required.<br />
PINOTPnewpinnewpin – to change the Server PIN, the new PIN is put twice after the<br />
OTP.<br />
OTPnewpinnewpin – to set the Server PIN on first use, when no initial PIN was<br />
programmed, the new PIN is put twice after the OTP. This is also necessary after an<br />
administrative PIN reset.<br />
2.5.2.2 Grace Period<br />
Each Digipass may be given a Grace Period when it is assigned to a Digipass User account.<br />
The Grace Period is there to allow some time be<strong>for</strong>e the User receives the Digipass and learns<br />
how to use it. The first time that the User logs in successfully with their Digipass, the Grace<br />
Period is ended. After that, they have to continue to use the Digipass. The Grace Period is time<br />
limited, so that the User is not able to delay too long be<strong>for</strong>e they start to use the Digipass.<br />
The Grace Period can be set during manual administrative assignment of Digipass as well as<br />
during Auto-Assignment. However, it is not applicable to Self-Assignment, because the<br />
User must use the Digipass to complete the Self-Assignment process.<br />
The Grace Period cannot apply when the Local Authentication setting is Digipass Only.<br />
During the Grace Period, if OTP validation fails, the static password is checked. If the static<br />
password is valid, Local Authentication succeeds (but note that Back-End Authentication, if<br />
used, can subsequently still cause the overall login to fail).<br />
The password is compared against the Digipass User account's password value. However, if the<br />
Digipass User account does not have a password set, the password has to be verified with<br />
Back-End Authentication. If there is no Back-End Authentication and no password in the<br />
Digipass User account, Grace Period password logins will not work.<br />
If the passwords do not match and Back-End Authentication is enabled, the password will be<br />
verified with Back-End Authentication.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 31
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.5.2.3 Challenge Generation<br />
There are two modes of Challenge generation <strong>for</strong> Challenge/Response:<br />
2-Step Challenge/Response<br />
This is the only mode possible <strong>for</strong> RADIUS but it can also be used <strong>for</strong> Web authentication,<br />
where Challenge/Response is supported (IIS6 <strong>for</strong>m-based authentication). <strong>In</strong> this mode, the<br />
authentication process takes place in two steps.<br />
First, the User requests a Challenge to be generated <strong>for</strong> them. The Policy defines how this<br />
request should be made, with the Request Method and Request Keyword settings (see<br />
below <strong>for</strong> more details on Request Methods). The Challenge is generated specifically <strong>for</strong> their<br />
Digipass, according to its programming.<br />
Assuming that the request <strong>for</strong> the Challenge is accepted and a Challenge is returned, the User<br />
submits a second step login with the Response to the Challenge as their OTP. This second step<br />
goes through the whole authentication process again to verify the Response.<br />
1-Step Challenge/Response<br />
This mode is possible <strong>for</strong> Web authentication, where Challenge/Response is supported (IIS6<br />
<strong>for</strong>m-based authentication). <strong>In</strong> this mode, the User sees only one logon step. This mode is<br />
suitable <strong>for</strong> time-based Challenge/Response, but is less secure <strong>for</strong> non-time based<br />
Challenge/Response. If an attacker manages to capture some valid Responses, they can<br />
repeatedly request new Challenges until one they know comes up again.<br />
A random Challenge is requested automatically by the IIS Module and presented to the User<br />
on the login page. A general-purpose Challenge is generated, without reference to any<br />
particular Digipass' programming. The User logs in with their Response to the Challenge as<br />
their OTP.<br />
2.5.2.4 Virtual Digipass OTP Generation<br />
Using Virtual Digipass, the authentication process takes place in two steps.<br />
First, the User requests an OTP to be generated and delivered to them. The Policy defines how<br />
this request should be made, with the Request Method and Request Keyword settings (see<br />
below <strong>for</strong> more details on Request Methods). The OTP is generated specifically <strong>for</strong> their<br />
Digipass, according to its programming. It is sent to their mobile phone number, as recorded<br />
in the Digpass User account.<br />
Backup Virtual Digipass has additional restrictions on usage, to keep the cost of text<br />
messages down. These are verified be<strong>for</strong>e an OTP will be generated. These restrictions are<br />
described in 5 Digipass.<br />
Assuming that the request <strong>for</strong> the OTP is accepted and an OTP is generated and delivered<br />
successfully, the User submits a second step login with the OTP. This second step goes through<br />
the whole authentication process again to verify the OTP.<br />
This process is illustrated below:<br />
© 2006 VASCO Data Security <strong>In</strong>c. 32
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
Image 18: Virtual Digipass login<br />
2.5.2.5 Requesting a Virtual Digipass OTP – User Perspective<br />
There are three ways a User might request a One Time Password to be delivered with either a<br />
Primary or Backup Virtual Digipass:<br />
2-step Login<br />
Two login prompts are used to provide an easy-to-use login interface <strong>for</strong> Users with Virtual<br />
Digipass. The first prompt is used to request an OTP, the second to enter the received OTP.<br />
This can be used with applications which support 2-step logins eg. Citrix Web <strong>In</strong>terface,<br />
RADIUS with support <strong>for</strong> Challenge/Response.<br />
Two 1-step Logins<br />
The User must attempt two logins, the first of which will fail but will initiate the sending of an<br />
OTP to the User’s mobile. This is used when the 2-step login process is not supported – eg.<br />
RADIUS without support <strong>for</strong> Challenge/Response, Web HTTP Basic Authentication.<br />
OTP Request Site<br />
Alternatively – especially if a more user-friendly option than the previous is needed - Users can<br />
go to the OTP Request site when they need an OTP sent to their mobile phone, then login<br />
normally at the usual login screen.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 33
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.5.2.6 Request Method and Keyword<br />
For 2-Step Challenge/Response and Virtual Digipass, the method of requesting a<br />
Challenge or OTP respectively can be defined in the Policy. The methods <strong>for</strong> Primary Virtual<br />
Digipass and Backup Virtual Digipass are defined separately. The request methods are:<br />
Password – the static password.<br />
Keyword – a fixed keyword, which can be blank.<br />
PasswordKeyword – the static password followed by a fixed keyword, with no whitespace<br />
or separating characters inbetween.<br />
KeywordPassword – a fixed keyword followed by the static password, with no whitespace<br />
or separating characters inbetween.<br />
None – no method, the feature is disabled.<br />
The static password in the request method is compared against the Digipass User account's<br />
password value. However, if the Digipass User account does not have a password set, the<br />
password has to be verified with Back-End Authentication. If there is no Back-End<br />
Authentication and no password in the Digipass User account, the request methods that use a<br />
password will not work.<br />
If the passwords do not match and Back-End Authentication is enabled, the password will be<br />
verified with Back-End Authentication.<br />
The methods of requesting these three login processes can be the same. When it recognizes a<br />
request, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will verify that there is a Digipass capable of that login process. If<br />
there is not, it will ignore the request.<br />
For example, say that the request methods <strong>for</strong> Primary and Backup Virtual Digipass are both<br />
defined as keyword “otp”. A User has a Go 3 with Backup Virtual Digipass enabled. When they<br />
login with the keyword “otp”, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will produce a Backup Virtual Digipass OTP,<br />
because the User does not have a Primary Virtual Digipass.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 34
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.5.2.7 Multiple Digipass or Digipass Applications<br />
A Digipass User may have multiple Digipass assigned to their User account, and/or multiple<br />
Applications enabled <strong>for</strong> a Digipass. If so, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will need to know which Digipass<br />
and Digipass Application will be used <strong>for</strong> a particular login <strong>for</strong> the User.<br />
Image 19: Multiple Digipass Assignment<br />
Once the Policy restrictions on Applications and Digipass Types are taken into account, there<br />
may still be more than one Digipass Application that could be used. <strong>In</strong> that case, the <strong>SBR</strong> <strong>Plug</strong>-<br />
<strong>In</strong> will check the OTP with each one. Any one of them can validate the OTP.<br />
A Grace Period may be applied to each Digipass assigned to a Digipass User. Because an<br />
applied Policy might restrict which Digipass can be used during a login, the Grace Period on<br />
each Digipass is independent of other Digipass. This means that if a User is assigned two<br />
Digipass, each with a Grace Period of seven days, the User may log in using one Digipass<br />
within the seven-day period (ending the Grace Period <strong>for</strong> that Digipass) without affecting the<br />
Grace Period <strong>for</strong> the other Digipass.<br />
Example<br />
The company has set up Policies which require a Response Only login via the local area<br />
network, and a Challenge/Response login via the internet – limited to certain employees.<br />
John has two Digipass assigned to him – a DP300 with the Challenge/Response application<br />
enabled, and a Go 3 with a Response Only application. The Digipass are both assigned on<br />
Tuesday.<br />
John receives his Go 3 on Friday, and immediately uses an OTP to login. His grace period <strong>for</strong><br />
the Go 3 ends at that time – in future he must use the Go 3 when logging into the intranet<br />
from the LAN.<br />
Over the weekend, John needs to access the company intranet from home. Because a<br />
Challenge/Response login is required via the internet and he does not yet have his DP300,<br />
he uses only his User ID and static password to log in. As he is still within the grace period<br />
<strong>for</strong> the DP300, the login is valid.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 35
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.5.3 Authentication without Digipass<br />
When the Digipass lookup does not return a Digipass record, authentication processing<br />
requires a static password check to succeed. <strong>In</strong> addition, Self-Assignment is possible when<br />
the Digipass lookup does not return any Digipass.<br />
2.5.3.1 Static Password Verification<br />
The password is compared against the Digipass User account's password value. If the static<br />
password is valid, Local Authentication succeeds (but note that Back-End Authentication, if<br />
used, can subsequently still cause the overall login to fail).<br />
However, if the Digipass User account does not have a password set, the password has to be<br />
verified with Back-End Authentication. If there is no Back-End Authentication and no password<br />
in the Digipass User account, authentication without Digipass cannot work. Similarly, during<br />
Dynamic User Registration, where there is no Digipass User account yet, the password has<br />
to be verified with Back-End Authentication.<br />
If the passwords do not match and Back-End Authentication is enabled, the password will be<br />
verified with Back-End Authentication.<br />
If the Local Authentication setting is Digipass Only, static password verification on its own is<br />
not permitted. An OTP must be used during login. This is possible using Self-Assignment.<br />
2.5.3.2 Self-Assignment<br />
A User is able to assign a Digipass to their Digipass User account using the Self-Assignment<br />
mechanism, when permitted by the Policy settings. The Assignment Mode setting must be<br />
Self-Assignment.<br />
<strong>In</strong> order <strong>for</strong> Self-Assignment to succeed, the User needs to provide the following:<br />
A static password, validated by Back-End Authentication.<br />
The Serial Number of an available Digipass record.<br />
A valid OTP <strong>for</strong> the Digipass.<br />
A new Server PIN, if required.<br />
The Self-Assignment process is possible during Dynamic User Registration. It is also possible<br />
when the Local Authentication setting is Digipass Only.<br />
Response Only<br />
For a Digipass that supports Response Only, the User needs to enter the following in the<br />
password login field, depending on whether a Server PIN is needed or not:<br />
SERIALNUMBERpasswordOTP – where a Server PIN is not required.<br />
SERIALNUMBERpasswordPINOTP – where a Server PIN is required.<br />
SERIALNUMBERpasswordOTPnewpinnewpin – where a Server PIN is required and no<br />
initial PIN was set.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 36
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
Challenge/Response<br />
For a Digipass that supports only Challenge/Response, this process requires two steps. <strong>In</strong><br />
the first step, the static password and Serial Number are given. This results in a Challenge<br />
being returned. If the correct Response is given to the Challenge, the Self-Assignment is<br />
successful.<br />
Step 1: SERIALNUMBERpassword<br />
Step 2: OTP<br />
Serial Number Format<br />
The SERIALNUMBER may be entered in one of two <strong>for</strong>mats, depending on the Serial No.<br />
Separator Policy setting.<br />
No separator specified – the full 10 digit Serial Number must be entered, with no dashes<br />
(-) or spaces, <strong>for</strong> example 0097123456.<br />
Separator value specified – the Serial Number can be entered as written on the back of<br />
the Digipass, <strong>for</strong> example 9-712345-6.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 37
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.6 Back-End Authentication<br />
Back-End Authentication is a term used to describe the process of checking User credentials<br />
with another system – in this case, Windows. It is used <strong>for</strong> various purposes, including:<br />
Password Replacement – allowing the User to log in with just a One Time Password, in<br />
an environment where the Windows password is required<br />
Enabling automatic management features such as Dynamic User Registration and<br />
Self-Assignment<br />
Static password verification <strong>for</strong> Users who do not have a Digipass and <strong>for</strong> Virtual Digipass<br />
The Back-End Authentication Policy setting indicates whether to per<strong>for</strong>m Back-End<br />
Authentication, and if so, when to do it. This setting is overridden by the same setting in the<br />
Digipass User account, unless that has the value Default. However, this setting in the Digipass<br />
User account would typically be used only <strong>for</strong> rare special case Users.<br />
Using the Windows Group Check in Back-End Mode, this setting can be overridden. If a User<br />
is not in the list of groups, Back-End Authentication will be per<strong>for</strong>med whether it is enabled or<br />
not.<br />
The Back-End Protocol setting indicates whether Back-End Authentication uses Windows or<br />
RADIUS (not supported in Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>).<br />
The possible values <strong>for</strong> the Back-End Authentication setting are as follows:<br />
None<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will not utilize Back-End Authentication.<br />
Always<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will use Back-End Authentication <strong>for</strong> every authentication request. This is<br />
necessary if you require RADIUS attributes <strong>for</strong> each login.<br />
If Needed<br />
Back-End Authentication will only be used in situations where Local Authentication is not<br />
sufficient and to support certain features:<br />
Dynamic User Registration<br />
Self-Assignment<br />
Password Autolearn (see below)<br />
Requesting a Challenge or Virtual Digipass OTP, when the Request Method includes a<br />
Password<br />
Static password authentication, when verifying a Virtual Digipass password-OTP<br />
combination or during the Grace Period<br />
© 2006 VASCO Data Security <strong>In</strong>c. 38
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.6.1 Stored Static Password<br />
The Digipass User account has a Stored Static Password field. When Back-End<br />
Authentication is used, this field can be used:<br />
To store the static password required <strong>for</strong> Back-End Authentication. This means that the<br />
User does not need to type in the static password at each login, they only need enter the<br />
OTP. The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can retrieve the Stored Static Password from the Digipass User<br />
account and use it <strong>for</strong> Back-End Authentication.<br />
To support Password Replacement. Back-End Authentication is used to learn the static<br />
password so that it can be replayed to the host system (eg. Outlook Web Access) when a<br />
successful OTP is given.<br />
Two product features are used to support this usage of the Stored Static Password: Stored<br />
Password Proxy and Password Autolearn.<br />
2.6.2 Stored Password Proxy<br />
When the Stored Password Proxy setting is enabled in the Policy, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will<br />
retrieve the Stored Static Password from the Digipass User account. If Back-End Authentication<br />
is required <strong>for</strong> a login, the Stored Static Password will be used. If there is a host system (eg.<br />
Outlook Web Access), the Stored Static Password will be returned to it, <strong>for</strong> it to complete its<br />
login process.<br />
However, if the User enters a static password in front of their OTP, the static password they<br />
enter will take precedence over Stored Static Password. <strong>In</strong> that case, the Stored Static<br />
Password will not be used at all <strong>for</strong> that login.<br />
When the Stored Password Proxy setting is not enabled in the Policy, the Stored Static<br />
Password will not be used <strong>for</strong> Back-End Authentication. If Back-End Authentication is required<br />
<strong>for</strong> a login, the User will have to enter the static password. This is done in front of the OTP if<br />
an OTP is also used. Similarly, if there is a host system that requires a static password to be<br />
returned, the User will have to enter the static password.<br />
2.6.3 Password Autolearn<br />
When the Password Autolearn feature is enabled in the Policy, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will<br />
automatically store the static password when it is verified by Back-End Authentication. This can<br />
happen at any time from Dynamic User Registration onwards.<br />
If the User's static password has changed in the Back-End Authentication system (Windows or<br />
the RADIUS server), they need to provide the new static password during their next login. This<br />
is done in front of the OTP if an OTP is used. When the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> sees that the User has<br />
entered a static password, if it does not match the Stored Static Password already, Back-End<br />
Authentication will occur to verify the new password. If it is verified, the Stored Static<br />
Password will be updated.<br />
2.7 RADIUS Attributes<br />
If RADIUS attributes are required <strong>for</strong> User logins, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can support this in two<br />
ways:<br />
RADIUS Profile<br />
An <strong>SBR</strong> RADIUS Profile can be set <strong>for</strong> default usage (all Policies), or <strong>for</strong> individual User<br />
© 2006 VASCO Data Security <strong>In</strong>c. 39
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
accounts. The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will return the name of the required RADIUS Profile to <strong>SBR</strong> during<br />
the authentication. This is the most common method of supporting RADIUS attributes with the<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
If the configured RADIUS Profile is not found in <strong>SBR</strong>, the authentication request will fail.<br />
User Attributes<br />
<strong>In</strong>dividual User attributes may be set <strong>for</strong> a Digipass User account. This may be in place of, or<br />
in addition to, setting a RADIUS profile. The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will return to <strong>SBR</strong> the name and value<br />
of any attributes set <strong>for</strong> a Digipass User during authentication.<br />
These conditions must be met:<br />
The attribute(s) set <strong>for</strong> the Digipass User account must exist in the loaded dictionaries in<br />
<strong>SBR</strong><br />
The value set <strong>for</strong> each attribute must be a valid (eg. must match required data type)<br />
If these conditions are not met, <strong>SBR</strong> will fail the login.<br />
2.7.1 RADIUS Attribute Settings<br />
Image 20: RADIUS Attribute Settings in <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration<br />
Attribute Group<br />
An Attribute Group is specified in the configuration of a <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. When multiple <strong>SBR</strong> <strong>Plug</strong>-<br />
<strong>In</strong>s are in use, the specified Attribute Group ensures that only attributes required by the<br />
specific <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> are used.<br />
Default Profile<br />
The Default Profile is the name of an existing <strong>SBR</strong> Profile. It is used where specific user<br />
attributes or a Profile have not been set <strong>for</strong> the User being authenticated.<br />
Profile Attribute Name<br />
A Profile Attribute Name is specified in the configuration of a <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. When multiple <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong>s are in use, the specified Profile Attribute Name ensures that only Profiles required by<br />
the specific <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> are used.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 40
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
Image 21: RADIUS Attribute Settings in Digipass User Properties<br />
Usage<br />
Three options are available <strong>for</strong> attribute Usage:<br />
Value<br />
A Check attribute is used to ensure that an attribute supplied by <strong>SBR</strong> contains the<br />
expected value.<br />
A Return attribute is passed back to <strong>SBR</strong> when the result of an authentication is<br />
returned by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
Profile indicates that the value entered is the name of a Profile existing in <strong>SBR</strong>.<br />
The Value set <strong>for</strong> an attribute will be the required value of the named attribute. For a Profile,<br />
the Value will be the name of the Profile in <strong>SBR</strong>.<br />
Example<br />
<strong>In</strong> the two screenshots above, where the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is configured to use the Attribute<br />
Group RADIUS and the Profile Attribute Name <strong>SBR</strong>1, the following user attributes would be<br />
used because they were created in the RADIUS Attribute Group:<br />
Callback-Number<br />
Login-IP-Host<br />
The VASCOGETTINGSTARTED Profile would be used, because its Profile Attribute Name is set<br />
to <strong>SBR</strong>1. The VPN Profile setting would be ignored by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> because it uses a<br />
different Profile Attribute Name than the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is configured to look <strong>for</strong>.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 41
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.7.2 RADIUS Attributes Process<br />
Image 22: Set RADIUS Attributes Process<br />
© 2006 VASCO Data Security <strong>In</strong>c. 42
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.7.3 Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s<br />
Where multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s are in use, you may need to use different RADIUS attributes <strong>for</strong><br />
each. There are two basic scenarios that may be applicable:<br />
Use Different RADIUS Profiles but User Attributes are Identical<br />
<strong>In</strong> this scenario, each <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> needs to use a different RADIUS Profile, but individual user<br />
attributes are the same across all <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s. Or, no user attributes are required.<br />
Configure each <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> to use the same Attribute Group, but different Profile Attribute<br />
Names.<br />
Image 23: Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s Using Same User Attributes<br />
© 2006 VASCO Data Security <strong>In</strong>c. 43
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
Use Different User Attributes<br />
<strong>In</strong> this scenario, each <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> needs to use different user attributes.<br />
Configure different Attribute Groups <strong>for</strong> each <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> and, if required, configure different<br />
Profile Attribute Names to use in specifying Profiles.<br />
Image 24: Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s Using Different User Attributes<br />
© 2006 VASCO Data Security <strong>In</strong>c. 44
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
2.8 Supported RADIUS Password Protocols<br />
The following protocols are supported by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>:<br />
PAP<br />
CHAP<br />
MS-CHAP with MPPE (Microsoft Point-to-Point Encryption)<br />
MS-CHAP2 with MPPE<br />
Various EAP types<br />
Some protocols do not support all authentication features of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>. See 2.9<br />
Unsupported by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> and the Login Permutations section of the<br />
Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
EAP<br />
Any EAP type which <strong>SBR</strong> translates to one of the above password protocols can be<br />
supported. This includes PEAP and EAP-TTLS.<br />
These steps must be followed to configure the 'Digipass Authentication' Authentication<br />
Method:<br />
Enable the 'Handle via Auto-EAP first' option.<br />
Enable the required EAP types.<br />
Support <strong>for</strong> the following have been specifically tested:<br />
MD5-Challenge<br />
Microsoft PEAP using EAP-MS-CHAP2<br />
Cisco PEAP using EAP-Generic-Token<br />
2.9 Unsupported by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong><br />
2.9.1 Limitations of RADIUS Password Protocols<br />
Some features of the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> are not supported with CHAP or MS-CHAP. These protocols<br />
hash login data together, making separation of various entries impossible.<br />
The unsupported features are outlined below:<br />
Self-Assignment of Digipass cannot be per<strong>for</strong>med.<br />
The Server PIN cannot be changed.<br />
Challenge/Response is not supported.<br />
Windows Back-End Authentication is not supported unless the User ID and Windows<br />
password are manually stored, and Stored Password Proxy is enabled.<br />
Password Autolearn is not supported, as clear text passwords cannot be identified.<br />
The User Self-Management Web Site, when utilized, can circumvent many of these problems<br />
by allowing Users to manage their account and Digipass. It uses RADIUS with the PAP<br />
password protocol. Users can:<br />
Per<strong>for</strong>m Self-Assignment<br />
Change their Server PIN<br />
© 2006 VASCO Data Security <strong>In</strong>c. 45
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Authentication Process<br />
Change their own Stored Static Password<br />
2.9.2 Unsupported RADIUS Password Protocols<br />
MS-CHAP with LM Hash<br />
The password change mechanism <strong>for</strong> MS-CHAP and MS-CHAP2<br />
© 2006 VASCO Data Security <strong>In</strong>c. 46
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Administration <strong>In</strong>terfaces<br />
3 Administration <strong>In</strong>terfaces<br />
The main user interfaces available <strong>for</strong> administration of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> are<br />
introduced in this section.<br />
3.1 Administration MMC <strong>In</strong>terface<br />
The Administration MMC <strong>In</strong>terface allows administration of Policy and Component<br />
records. When an ODBC or embedded database is used as the data store, it is also used to<br />
administer Digipass, Digipass User account, Domain and Organizational Unit records.<br />
The following screen includes these additional objects (when using Active Directory, you will<br />
not see them).<br />
Image 25: Administration MMC <strong>In</strong>terface<br />
To open the Administration MMC <strong>In</strong>terface, click on the Start Button and select Programs -><br />
VASCO -> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>3 -> Administration MMC <strong>In</strong>terface. It can also be<br />
added to any Microsoft Management Console using the File -> Add/Remove Snap-in...<br />
menu and adding the Digipass Administration snap-in.<br />
The differences between the Active Directory and database versions are outlined below.<br />
3.1.1 Active Directory<br />
<strong>In</strong> the tree pane, a Domain node is needed to define the Digipass Configuration Domain<br />
© 2006 VASCO Data Security <strong>In</strong>c. 47
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Administration <strong>In</strong>terfaces<br />
(the Fully Qualified Domain Name is required). This is configured <strong>for</strong> you by the installation<br />
when the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is on the same machine as the Administration MMC <strong>In</strong>terface.<br />
To log in, right-click on the Domain node and select the Connect... menu option. No logon<br />
screen is presented - an implicit logon to Active Directory will be carried out using your current<br />
Windows user context.<br />
The Administration MMC <strong>In</strong>terface will make an LDAP connection to Active Directory.<br />
Administration does not take place via the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. Your administrative permissions will<br />
depend on the permissions that your Active Directory user account has within Active Directory.<br />
When do new settings take effect?<br />
For Active Directory, when settings are changed with this program, the new values will not<br />
always take effect immediately. This is because the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> keeps Policy and Component<br />
records in memory caches. The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will periodically re-read the records (by default,<br />
every 15 minutes) so that updates do take effect eventually.<br />
However, you need to take into account the delay of Active Directory Replication, if the<br />
administration change is made using a different Domain Controller to the one used by the <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong> (especially when there are multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s in different sites). An <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
cannot update its cache with new settings until Active Directory Replication has updated them<br />
on its local Domain Controller.<br />
Restarting the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> <strong>for</strong>ces it to re-load its caches, so that settings changes take effect<br />
immediately (assuming that Active Directory Replication is not needed or has completed).<br />
3.1.2 ODBC or Embedded Database<br />
<strong>In</strong> the tree pane, an <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> node is needed to specify the location (IP address and port)<br />
of the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. This is configured <strong>for</strong> you by the installation when the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is on<br />
the same machine as the Administration MMC <strong>In</strong>terface.<br />
To log in, right-click on the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> node and select the Connect... menu option. A logon<br />
screen is presented – log in using your Digipass User account User ID and password. Once<br />
your Digipass User account has a Digipass, you will need to use it to log into the<br />
Administration MMC <strong>In</strong>terface.<br />
However, like all authentication processing, the administration logon process is subject to<br />
Policy settings. You may decide to change the settings in the default VM3 Administration Logon<br />
Policy, or even select a different Policy.<br />
The Administration MMC <strong>In</strong>terface will make an encrypted TCP/IP connection to the <strong>SBR</strong> <strong>Plug</strong>-<br />
<strong>In</strong>. It will then make an administrative logon request using this connection. If the logon is<br />
successful an administrative session will be established. Your administrative permissions within<br />
this session will depend on the Administrative Privileges of your Digipass User account (see<br />
4 Digipass User Accounts).<br />
When do new settings take effect?<br />
For an ODBC or embedded database, when settings are changed with this program, the new<br />
values will always take effect immediately. The changes are made through the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>, so<br />
it will update its caches immediately.<br />
When multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s are used with Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Replication, all <strong>SBR</strong> <strong>Plug</strong>-<br />
<strong>In</strong>s' caches will be updated by the Replication process.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 48
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Administration <strong>In</strong>terfaces<br />
3.2 Digipass Extension <strong>for</strong> Active Directory Users & Computers<br />
The Digipass Extension <strong>for</strong> Active Directory Users and Computers allows administration<br />
of Digipass User accounts and Digipass records within the Active Directory Users and<br />
Computers interface.<br />
Note<br />
The Digipass Extension <strong>for</strong> Active Directory Users and Computers is only used<br />
when Active Directory is utilized as the data store.<br />
The extension adds context menu options, User property sheet tabs and a property sheet <strong>for</strong><br />
the Digipass records, as outlined below.<br />
To open the Active Directory Users and Computers, a shortcut is provided in the Start Menu.<br />
Click on the Start Button and select Programs -> VASCO -> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> 3<br />
-> Active Directory Users and Computers. On Windows XP and Windows Server 2003,<br />
where the Saved Queries feature is available, the console file reached from this Start Menu<br />
shortcut has several Saved Queries pre-loaded.<br />
However, you can run Active Directory Users and Computers from the usual Administrative<br />
Tools shortcut or any other saved Microsoft Management Console. <strong>In</strong> that case, you will need<br />
to import the Saved Queries into that console if you wish to use them.<br />
No logon screen is presented by the extension - an implicit logon to Active Directory will be<br />
carried out using your current Windows user context. It will connect to the same Domain<br />
Controller as the Active Directory Users and Computers connection.<br />
The extension will make its own LDAP connection to Active Directory. Administration does not<br />
take place via the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. Your administrative permissions will depend on the permissions<br />
that your Active Directory user account has within Active Directory.<br />
When do new settings take effect?<br />
When settings are changed with the extension, the new values may not always take effect<br />
immediately. You need to take into account the delay of Active Directory Replication, if the<br />
administration change is made using a different Domain Controller to the one used by the <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong> (especially when there are multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s in different sites). An <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
cannot read new settings until Active Directory Replication has updated them on its local<br />
Domain Controller.<br />
3.2.1 Context Menu Extensions – Tree Pane<br />
Additional context menu options are available on the following containers in the tree pane:<br />
The Users container<br />
All Organizational Units<br />
The Digipass-Pool, Digipass-Reserve and Digipass-Configuration containers<br />
The main menu option that is useful in this context is the Import Digipass... option. This is<br />
used to import Digipass records into the selected container. Other options are <strong>for</strong> showing<br />
version in<strong>for</strong>mation, configuring encryption settings and enabling tracing.<br />
3.2.2 Context Menu Extensions – User Records<br />
Additional context menu options are available when right-clicking on one or more User records<br />
© 2006 VASCO Data Security <strong>In</strong>c. 49
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Administration <strong>In</strong>terfaces<br />
in the result pane:<br />
Assign Digipass... – <strong>for</strong> single or bulk assignment of Digipass<br />
Unassign Digipass – to unassign all Digipass from the selected User(s)<br />
3.2.3 Property Sheet Extensions – User Records<br />
Additional tabs are available when viewing the property sheet of a User record:<br />
The Digipass User Account tab contains extra in<strong>for</strong>mation about the Digipass User<br />
account required by Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>. This includes settings such as<br />
authentication policy overrides, and the date and time that a Digipass User account was<br />
created.<br />
The Digipass Assignment tab contains in<strong>for</strong>mation on all Digipass assigned to the<br />
Digipass User. These Digipass can be administered from this tab, including unassignment<br />
or enabling Backup Virtual Digipass. Digipass may also be assigned to the Digipass User<br />
from this tab.<br />
Image 26: Digipass Extension <strong>for</strong> Active Directory Users and Computers<br />
3.2.4 Digipass Record Administration<br />
Digipass in<strong>for</strong>mation may be viewed via the property sheet of its assigned User, or by turning<br />
on Advanced Features. This allows you to see Digipass records wherever they are located in<br />
Active Directory (typically in the Digipass-Pool container if unassigned), view properties and<br />
© 2006 VASCO Data Security <strong>In</strong>c. 50
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Administration <strong>In</strong>terfaces<br />
use a number of context menu actions.<br />
For more details on these actions, see 5 Digipass.<br />
The context menu of the Digipass record contains options <strong>for</strong> bulk management:<br />
Assign and unassign the Digipass<br />
Reset, activate, inactivate and delete the Applications<br />
Reset the PIN and <strong>for</strong>ce a PIN change<br />
Move the Digipass to another Organizational Unit or container<br />
The property sheet <strong>for</strong> the Digipass record shows full details of the Digipass and all its<br />
Applications and enables all administration tasks <strong>for</strong> the record.<br />
3.3 <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> uses a local XML text file <strong>for</strong> various configurations settings. This can be<br />
administered using a graphical user interface referred to as <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration. To<br />
run it, click on the Start Button and select Programs -> VASCO -> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong><br />
<strong>SBR</strong> -> Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Configuration.<br />
When settings are changed with this program, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> must be restarted be<strong>for</strong>e the<br />
new values take effect. On exiting, the program can do this <strong>for</strong> you.<br />
The following groups of settings are configured using <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration. For more<br />
detail, see the Administrator Reference, Configuration Settings section.<br />
Various IP addresses and port numbers<br />
Administration session control settings<br />
Tracing settings<br />
Active Directory connection settings (if applicable)<br />
ODBC or embedded database connection settings (if applicable)<br />
For ODBC or embedded database, some important settings that control User ID and<br />
Domain resolution: User ID Case Conversion, Windows User Name Resolution and<br />
the choice of Master Domain<br />
Audit settings<br />
Replication settings<br />
3.4 Digipass TCL Command-Line Administration<br />
Digipass TCL Command-Line Administration allows interactive command-line and scripted<br />
administration of Digipass related data. It has a number of possible uses:<br />
<strong>In</strong>teractive command-line administration<br />
Scripted administration<br />
Complex bulk administration tasks<br />
Reporting on the data in the data store<br />
It is an extension of the TCL 8.4 scripting language, and administrators will require a basic<br />
© 2006 VASCO Data Security <strong>In</strong>c. 51
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Administration <strong>In</strong>terfaces<br />
competence in TCL in order to use the command-line utility. See the Digipass TCL Command-<br />
Line Administration topic in the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 52
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass User Accounts<br />
4 Digipass User Accounts<br />
4.1 Digipass User Account Creation<br />
A Digipass User account can be created in a number of ways:<br />
4.1.1 Manual Creation<br />
A Digipass User Account can be created manually by an administrator.<br />
4.1.2 Dynamic User Registration<br />
When the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> receives an authentication request <strong>for</strong> a User without a Digipass User<br />
account, it can check the credentials with the back-end authenticator (eg. Windows). If the<br />
authentication is successful with the back-end authenticator, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can create a<br />
Digipass User account automatically <strong>for</strong> the User. This process is called Dynamic User<br />
Registration (DUR) and can be enabled via the Administration MMC <strong>In</strong>terface.<br />
This feature is commonly used in conjunction with Auto-Assignment, so that the new account<br />
is immediately assigned a Digipass.<br />
Note<br />
ODBC Database (including embedded database): If the data store is casesensitive<br />
and the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> has not been configured to convert User IDs and<br />
Domains to upper or lower case, the potential exists <strong>for</strong> multiple Digipass User<br />
accounts to be created <strong>for</strong> a single User. For example, if a User logs in with<br />
'jsmith' on one occasion, and JSmith on another, two Digipass User accounts<br />
may be created – jsmith and JSmith.<br />
This can be avoided by:<br />
Enabling Windows Name Resolution in the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration GUI, if<br />
the underlying user accounts are Windows user accounts. See the ODBC<br />
Connection and Domains and Organizational Units topics in the<br />
Administrator Reference <strong>for</strong> more in<strong>for</strong>mation. This is highly recommended.<br />
Configuring the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> to convert all User IDs and domains to upper or<br />
lower case. See the Encoding and Case-Sensitivity topic in the<br />
Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
4.1.3 User Self-Management Web Site<br />
Enabling Dynamic User Registration on a system which includes the User Self-Management<br />
Web Site will allow Users to create their own Digipass User Account via the web site.<br />
4.2 Changes to Stored Static Password<br />
Any changes to a User's Windows or RADIUS server password need to be communicated to the<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> if Stored Password Proxy is enabled. There are two ways to do this:<br />
4.2.1 Password Autolearn<br />
If Password Autolearn is enabled, a User may directly log in with their new static password in<br />
front of their OTP. If it does not match the static password stored by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>, it can<br />
be verified with the back-end authenticator (Windows). If correct, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will store<br />
© 2006 VASCO Data Security <strong>In</strong>c. 53
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass User Accounts<br />
the new static password <strong>for</strong> future use and authenticate the User.<br />
4.2.2 User Self-Management Web Site<br />
When the User Self Management Web Site is utilized, the User may modify the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>'s<br />
record of their stored static password. They must be able to log in according to current settings<br />
to do this, and the Password Autolearn feature must be enabled.<br />
4.3 Administration Privileges<br />
Active Directory<br />
Access is given to administer Digipass-related records based on a User's Active Directory<br />
privileges. Extra privileges may be granted via the Active Directory Users and Computers<br />
console.<br />
An administrator may be assigned permissions based on:<br />
Type of permission (eg. Read, Create)<br />
Type of object (eg. Digipass, Policy)<br />
An administrator may be restricted by Domain or Organizational Unit.<br />
See the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
ODBC or Embedded Database<br />
Administration of data in an ODBC database is per<strong>for</strong>med through the Authentication Server to<br />
control the administrator's access to data. An administrator may be assigned permissions<br />
based on:<br />
Type of permission (eg. Read, Create)<br />
Type of object (eg. Digipass, Policy)<br />
The Domain and Organizational Unit in which the administrator account is located will<br />
determine their range of administration access:<br />
If the account belongs to an Organizational Unit, the administrator will be able to<br />
administer User accounts and Digipass belonging to that Organizational Unit.<br />
If the account does not belong to an Organizational Unit, the administrator will be able to<br />
administer all Digipass and User accounts in the Domain to which they belong.<br />
If the account belongs to the Master Domain, the administrator will be able to administer<br />
all Digipass and User accounts in the database.<br />
See the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 54
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5 Digipass<br />
This section contains in<strong>for</strong>mation specific to Digipass, their setup and management on your<br />
network.<br />
5.1 Digipass Record Functions<br />
A number of functions are available to administer Digipass records. These are typically<br />
required <strong>for</strong> maintenance – eg. a User has <strong>for</strong>gotten their Server PIN, or a Digipass has been<br />
locked.<br />
5.1.1 Reset Application<br />
A Digipass Application may need to be reset if the time difference between it and the server<br />
needs to be recalculated. This would typically be <strong>for</strong> time-based Response Only Digipass after<br />
a very long period of inactivity. The 'reset' widens the allowable time window <strong>for</strong> the next<br />
login, allowing the User to log in and the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> to calculate the current time shift.<br />
5.1.2 Set Event Counter<br />
If the event count <strong>for</strong> an event-based application has become unsynchronised between the<br />
Digipass and the server, this function can be used to set the server event count to the event<br />
count on the Digipass.<br />
5.1.3 Reset PIN<br />
If a User’s Server PIN needs to be changed – usually because the User has <strong>for</strong>gotten it – then<br />
it can be reset, and the User can create a new Server PIN when they next log in. This may be<br />
done when unassigning or re-assigning a Digipass.<br />
5.1.4 Force PIN Change<br />
This function can be used when an administrator wants a User to change their Server PIN on<br />
their next login. This may be desirable as a security measure.<br />
5.1.5 Set PIN<br />
A User’s Server PIN can be set to a specific value and communicated to the User.<br />
5.1.6 Unlock Digipass<br />
If a User incorrectly enters their Digipass PIN into their Digipass a predetermined number of<br />
times, the Digipass will become locked. Once locked, the assistance of an administrator will be<br />
required to unlock it. This function allows an administrator to provide the User with an Unlock<br />
Code to enter into their Digipass.<br />
5.1.7 Reset Application Lock<br />
If a User has attempted to log in with incorrect details too many times, the Digipass<br />
Application used may be locked, depending on Policy settings. This function can be used to set<br />
the record <strong>for</strong> the Digipass Application to the status of unlocked. This differs from User<br />
locking, as the User may still log in with a different Digipass.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 55
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5.1.8 Test a Digipass Application<br />
Use this function to check that a Digipass Application is working as expected. There is also a<br />
function to test the Backup Virtual Digipass functionality.<br />
5.2 Digipass Programming<br />
A Digipass is programmed using a Digipass Programmer and the necessary software. This may<br />
be done by your company or by your supplier.<br />
Common settings which may affect your administration tasks are explained below.<br />
5.2.1 Digipass PIN<br />
A Digipass PIN may be required <strong>for</strong> a Digipass. If set, the PIN must be entered into the<br />
Digipass be<strong>for</strong>e obtaining a One Time Password. This means that just possessing the Digipass<br />
is not enough to log in to a network – the person logging in must also know the Digipass PIN.<br />
Digipass PIN settings include:<br />
An <strong>In</strong>itial PIN can be set <strong>for</strong> a Digipass. The PIN must then be sent to the User of the<br />
Digipass, typically separate from the Digipass delivery.<br />
First Use PIN Modification allows a Digipass to require a PIN change from the User<br />
upon first use.<br />
PIN Change allows a User to change their PIN as desired.<br />
The PIN Length can be set <strong>for</strong> a Digipass.<br />
Digipass Lock sets the number of consecutive faulty PIN entries allowed be<strong>for</strong>e the<br />
Digipass is locked.<br />
5.2.2 Time/Event-based Digipass Applications<br />
Response Only<br />
Response Only Digipass Applications can be either time-based or event-based:<br />
Time-based<br />
A time-based Application will change the OTP to be displayed based on the current time. The<br />
common time step used is 36 seconds – and means that the OTP to be displayed will change<br />
every 36 seconds, whether or not an OTP has been requested from the Digipass.<br />
Event-based<br />
An event-based Digipass Application will display a new OTP each time a request <strong>for</strong> an OTP is<br />
made.<br />
Challenge/Response<br />
Challenge/Response Digipass Applications can be either time-based or non-time-based:<br />
Time-based<br />
A time-based Challenge/Response Digipass Application will generate an OTP based on the<br />
Challenge given and the current time. The common time step used is 9 hours ('slow<br />
challenge'). This would mean that if the exact same Challenge were given to a Digipass within<br />
a 9 hour period, the Digipass Application will generate the same OTP. However, Challenges<br />
are very rarely repeated within such a time period.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 56
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
Non-time-based<br />
A non-time-based Challenge/Response Digipass Application will generate an OTP based only on<br />
the Challenge given.<br />
5.2.3 OTP Length<br />
The length of the OTP (excluding check digit) generated by the Digipass <strong>for</strong> Response Only<br />
and Challenge/Response Digipass Applications.<br />
Check Digit<br />
A check digit may be added to each OTP. This is generated from the response and allows <strong>for</strong><br />
faster invalidation of incorrect OTPs.<br />
5.2.4 Challenge Length<br />
The length of the Challenge (excluding check digit) which should be expected by the Digipass.<br />
This is used by the Challenge/Response Digipass Application.<br />
Check Digit<br />
A check digit may be expected with each Challenge. This is generated by the server from the<br />
Challenge and allows the Digipass to reject most invalid Challenges.<br />
5.3 Digipass Record Settings<br />
These settings are kept in the record <strong>for</strong> a Digipass Application, and affect which OTP is<br />
expected by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
5.3.1 Time/Event-based Settings<br />
Time Based<br />
Specifies whether the algorithm <strong>for</strong> the Digipass application is time-based (see Time/Eventbased<br />
Digipass Applications <strong>for</strong> more in<strong>for</strong>mation).<br />
Time Step Used<br />
The time step used by the Digipass Application (see Time/Event-based Digipass<br />
Applications <strong>for</strong> more in<strong>for</strong>mation).<br />
Last Time Shift<br />
Time Shift records any misalignments between the time recorded on the Digipass and the time<br />
recorded on the server, each time a User logs in. This ensures that if either clock drifts from<br />
the correct time, an allowance can be made by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> and the User will still be able<br />
to log in. If the time drift goes beyond the allowable time window between User logins, the<br />
Digipass record will have to be reset (this allows <strong>for</strong> recalculation of the time drift).<br />
Example<br />
Time window may be 5 steps in either direction.<br />
This means that 11 OTPs would be considered valid – the exact OTP <strong>for</strong> that time, and the<br />
OTPs <strong>for</strong> the 5 time steps either side of the exact time. If the OTP given is <strong>for</strong> a different<br />
time step, the time shift <strong>for</strong> that Digipass will be recorded. The next time the User logs in,<br />
the expected OTP will be calculated based on that time shift.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 57
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
Last Event Value<br />
The current number of uses of the Digipass Application, according to the Digipass. This can<br />
get out of sync with the number of uses recorded by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> when:<br />
login failures occur <strong>for</strong> other reasons than incorrect OTP<br />
the Digipass has been used without a login (eg. children have been playing with it)<br />
The Digipass is being used to log in to two separate systems<br />
The purpose of this setting is much the same as the Last Time Shift setting – it allows the <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong> to track any shifts between the event count recorded by itself and the Digipass.<br />
5.3.2 Response Length<br />
This setting determines the length of the OTP (excluding check digit) expected by the server<br />
from the Digipass Application.<br />
Response Check Digit<br />
Whether a check digit may be expected with each OTP from the Digipass Application. This is<br />
generated from the response and allows <strong>for</strong> faster invalidation of incorrect OTPs.<br />
5.3.3 Server PIN<br />
The term 'Server PIN' is used to mean a PIN that the user enters into the login password field<br />
in front of the OTP displayed on the Digipass. It is checked by the authenticating server. The<br />
'Digipass PIN' referred to earlier indicates a PIN entered into a keypad on the Digipass. That is<br />
checked by the device itself, and is never transmitted to the server.<br />
There are a number of Server settings regulating Server PINs:<br />
PIN Supported<br />
Whether a PIN must be included in a User's login.<br />
PIN Change On<br />
Is a User allowed to change their Server PIN <strong>for</strong> this Digipass?<br />
Force PIN Change<br />
Must the User change their Server PIN the next time they log in?<br />
PIN Length<br />
The length of the current Server PIN.<br />
PIN Minimum Length<br />
The minimum PIN length required by the Server.<br />
5.3.4 Backup Virtual Digipass<br />
Policy and Digipass settings<br />
Several settings dictate how a User may utilize the Backup Virtual Digipass feature. These<br />
settings are:<br />
Enable or disable Backup Virtual Digipass and enable method (eg. Required).<br />
Time limit/expiry (applies to Time Limited enable only)<br />
Maximum number of times a User may make use of the Backup Virtual Digipass.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 58
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
The above settings may be set both at the Policy level and at the Digipass record level.<br />
<strong>In</strong>dividual settings override Policy settings <strong>for</strong> an individual Digipass, but some Policy settings<br />
(see below) may be used to automatically set Digipass settings which are blank when the<br />
Backup Virtual Digipass is first utilized by the User.<br />
Time Limit and Max. Uses/User<br />
Policy Setting Digipass Setting<br />
Time Limit Enabled Until<br />
Max. Uses/User Uses Remaining<br />
Table 1: Backup Virtual Digipass Policy/Digipass Settings<br />
If Backup Virtual Digipass is enabled <strong>for</strong> a Digipass and set to Time Limited, and the Enabled<br />
Until field in the Digipass property sheet is blank on their first use of the Backup Virtual<br />
Digipass, their time limit will begin on their first use of the feature. The expiry date (today’s<br />
date + Time Limit) will then be displayed in the Enabled Until field.<br />
If a Max. Uses/User is set <strong>for</strong> the relevant Policy and a Digipass record's Uses Remaining<br />
field in their User property sheet is blank on their first use of the Backup Virtual Digipass, a<br />
number (Max Uses/User) will be automatically entered into their Uses Remaining field and<br />
immediately decremented by 1.<br />
Note<br />
If a User has Backup Virtual Digipass enabled with Enabled Until date set and<br />
their Uses Remaining has been set (automatically or manually), whichever of<br />
these expires first will disable Backup Virtual Digipass <strong>for</strong> the User.<br />
eg. Backup Virtual Digipass is enabled <strong>for</strong> a User as Time Limited, and the<br />
server Time Limit setting is 3 days. The Max. Uses/User Policy setting is 5.<br />
When the User first makes use of the Backup Virtual Digipass, their Enabled<br />
Until is set to a date 3 days hence and their Uses Remaining to 4. During<br />
the next 48 hours, they log in 4 more times. Although the User’s time limit<br />
does not run out <strong>for</strong> another 24 hours, their Uses Remaining is now 0 and<br />
Backup Virtual Digipass is disabled.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 59
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5.4 Assigning Digipass to Users<br />
Digipass may be assigned to Users in a number of ways, depending on the requirements of<br />
your company. For example, a company with only a few User accounts may use Manual<br />
Assignment. A larger company needing to distribute large numbers of Digipass may find it<br />
easier to simply distribute the Digipass and require each User to go through Self-Assignment.<br />
Note<br />
Digipass records must be imported into the data store be<strong>for</strong>e being assigned to<br />
Users.<br />
5.4.1 Self-Assignment<br />
A Digipass may be assigned to a User by their own action. The User must log in and include<br />
the serial number, Windows static password and One Time Password. This in<strong>for</strong>ms the <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong> of the assignment, and provided that the User enters the details correctly, a link will be<br />
made between the Digipass record and the User account. A grace period is not used <strong>for</strong> this<br />
method.<br />
Image 27: Self-Assignment Process<br />
© 2006 VASCO Data Security <strong>In</strong>c. 60
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5.4.2 Auto-Assignment<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can automatically assign an available Digipass when a Digipass User account<br />
is created using Dynamic User Registration (DUR). The correct Digipass must then be<br />
delivered to the User. A grace period is typically set, which allows a number of days in which<br />
the User may still log in using only their static password.<br />
Image 28: Auto-Assignment Process<br />
© 2006 VASCO Data Security <strong>In</strong>c. 61
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5.4.3 Manual Assignment<br />
A selected Digipass is manually assigned to a specific Digipass User account. The Digipass<br />
must then be sent out to the User. A grace period is typically set, during which the User may<br />
still log in using only their static password.<br />
Image 29: Manual Assignment Process<br />
© 2006 VASCO Data Security <strong>In</strong>c. 62
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5.5 Virtual Digipass Implementation Considerations<br />
5.5.1 Digipass Assignment Options<br />
With the introduction of Virtual Digipass, there are several different assignment combinations<br />
that can be used. The first option in the table below does not utilize Virtual Digipass. The<br />
others include a Virtual Digipass in either a backup or primary mode.<br />
Primary Backup<br />
Digipass None User must log in using a Digipass.<br />
Digipass Backup Virtual<br />
Digipass<br />
Digipass<br />
(temporarily<br />
disallowed)<br />
Primary Virtual<br />
Digipass<br />
Table 2: Digipass Options<br />
5.5.2 Cost<br />
Backup Virtual<br />
Digipass<br />
User usually logs in using a Digipass, but may utilize the Backup<br />
Virtual Digipass feature where required. Usage of the feature may<br />
be limited.<br />
User must log in using the Backup Virtual Digipass feature. This<br />
might be used while a User’s Digipass is lost, until the Digipass is<br />
recovered.<br />
N/A User is assigned a Virtual Digipass and must log in using it.<br />
Your company will probably need to pay an amount <strong>for</strong> each text message sent. <strong>In</strong> some<br />
countries, mobile phone owners might need to pay an amount <strong>for</strong> each text message received<br />
on their mobile phone. This will need to be taken into consideration when deciding how to<br />
implement Virtual Digipass functionality.<br />
5.5.3 Security<br />
Hardware Digipass devices provide the highest level of security. Virtual Digipass provides a<br />
lower, although still high, level of security. This needs to be weighed against other<br />
considerations be<strong>for</strong>e deciding whether your company will implement Virtual Digipass, and if<br />
so, how it will be implemented.<br />
5.5.4 Convenience<br />
Virtual Digipass is more convenient than a hardware Digipass <strong>for</strong> many Users. Only one’s<br />
usual mobile phone is required: there are no extra devices to carry around. Users who do not<br />
habitually carry their mobile phone with them, though, are likely to find a GO 3 or GO 1 easier<br />
to transport.<br />
For Users with the Backup Virtual Digipass enabled, it might be the difference between going<br />
to work to pick up a <strong>for</strong>gotten Digipass and getting important work done at home.<br />
5.5.5 Gateway and account<br />
Your company will need the use of an text message gateway and an account with the gateway.<br />
The Message Delivery Component will need configuration in<strong>for</strong>mation <strong>for</strong> the gateway and the<br />
Username and password <strong>for</strong> the account. Your VASCO supplier can assist with this process.<br />
5.5.6 Limiting Usage of Virtual Digipass<br />
Use of Virtual Digipass may be limited by:<br />
Using Backup Virtual Digipass only.<br />
Minimizing the number of Users assigned a Primary Virtual Digipass.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 63
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
A User’s Primary Virtual Digipass use cannot be limited.<br />
The Backup Virtual Digipass feature may be enabled as an ‘emergency’ backup <strong>for</strong> Users who<br />
have left their primary Digipass at home, or <strong>for</strong> other reasons do not have access to their<br />
primary Digipass. Use of this feature can be limited <strong>for</strong> each Digipass by:<br />
Time period<br />
Set a time period in which a User may access the Backup Virtual Digipass. After this period<br />
has expired, any Virtual Digipass requests from the User will be rejected. If the User is still<br />
unable to use their Digipass, the time period must then be extended by an administrator.<br />
Once they have started using their Digipass again, the administrator must reset the time<br />
period if the User is to be allowed to use Backup Virtual Digipass again.<br />
Number of Uses<br />
Set a maximum number of times a User may request an OTP using the Backup Virtual Digipass<br />
feature. When the User has reached this number of uses, any further OTP requests from the<br />
User will be rejected. This must be reset by an administrator if further use of the Backup<br />
Virtual Digipass is required <strong>for</strong> the User.<br />
Global and <strong>In</strong>dividual Backup Virtual Digipass settings<br />
Backup Virtual Digipass options can be set globally or individually, to allow a standard policy<br />
<strong>for</strong> all Digipass with exceptions made where necessary. Global settings will affect all Digipass<br />
whose individual option is set to 'Default'.<br />
Global options are defined in the Policy that controls authentication. There<strong>for</strong>e, by using<br />
multiple Policies, you have some additional flexibility.<br />
5.5.6.1 Backup Virtual Digipass Usage <strong>Guide</strong>lines<br />
Some questions which will need to be answered be<strong>for</strong>e arriving at a Backup Virtual Digipass<br />
usage guidelines are:<br />
Will any users have access to Backup Virtual Digipass?<br />
If so, will all users have access to Backup Virtual Digipass?<br />
Will usage of Backup Virtual Digipass be limited? If so, how?<br />
Time-limited<br />
Limited number of uses<br />
Some Possible <strong>Guide</strong>lines<br />
<strong>Guide</strong>line Pro Con<br />
Backup Virtual Digipass disabled <strong>for</strong> all - enabled<br />
<strong>for</strong> individual Users as required.<br />
Backup Virtual Digipass enabled <strong>for</strong> all - either<br />
time/number of usage limit set.<br />
Backup Virtual Digipass enabled <strong>for</strong> all - no limits<br />
set.<br />
Table 3: Backup Virtual Digipass Example <strong>Guide</strong>lines<br />
Low text message costs Manual enable <strong>for</strong> each User<br />
and circumstance. Possible<br />
heavy administration load.<br />
Predictable text message<br />
costs<br />
Administrator may need to reset<br />
limits frequently – medium<br />
administration load.<br />
Lighter administration load Possible high text message<br />
costs.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 64
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Digipass<br />
5.5.7 Resetting Virtual Digipass Restrictions<br />
When a User has reached their limit of Virtual Digipass use, an administrator must reset their<br />
limit.<br />
5.5.8 Virtual Digipass Login options<br />
A decision must be made as to how Users will log in using Virtual Digipass. <strong>In</strong> particular, Users<br />
with a hardware Digipass and the Backup Virtual Digipass enabled must be able to request an<br />
OTP to be sent to their mobile when required, but to login using the hardware Digipass at<br />
other times.<br />
The simplest method <strong>for</strong> the User is to allow a 2-step login process, where the User enters<br />
their User ID and password only, triggering an OTP Request, and are redirected to a second<br />
login page to enter the OTP sent to them. To use this method, though, your system must be<br />
set up to allow 2-step logins. Check with your system administrator if unsure.<br />
Alternatives to the 2-step login are a sequence of two 1-step logins or the use of the OTP<br />
Request Site.<br />
See the Administrator Reference <strong>for</strong> in<strong>for</strong>mation on possible login permutation.<br />
5.5.9 Location of OTP Request Site<br />
If the OTP Request Site is to be used, its location must be decided. You may choose to install<br />
the Web Site onto any web server, bearing the following in mind:<br />
If the Web Site is installed onto a web server in the DMZ, you need to permit TCP/IP<br />
access from the web server to the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> on port 20003. This is the recommended<br />
option.<br />
The Web Site can be used on the <strong>In</strong>ternet, however it would be essential to provide SSL<br />
(or TLS) encryption <strong>for</strong> access to it. Otherwise, an attacker could discover static<br />
passwords and PINs. The other point to take into consideration is that publishing the<br />
Web Site on the <strong>In</strong>ternet would allow anyone in the world to send requests to the <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong> – this would provide the potential <strong>for</strong> denial of service and brute <strong>for</strong>ce attacks. It<br />
would be strongly advised to protect the Web Site from general use in some way.<br />
If the Web Site is installed onto a web server that communicates over a WAN link to the<br />
<strong>SBR</strong> Server(s), the WAN link must be encrypted. For example, an IPSEC-based VPN<br />
connection would be sufficient.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 65
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Components<br />
6 Components<br />
The following diagram illustrates how Component records are used to apply different Policies to<br />
different authentication scenarios:<br />
Image 30: Component Overview<br />
6.1 Pre-loaded Components<br />
One Component record is created during the installation of Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>:<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Component<br />
A Component is created <strong>for</strong> the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>, to hold its License Key and provide a default<br />
Component <strong>for</strong> Policy selection. The <strong>SBR</strong> Base Policy is set as the Policy. This Component will<br />
be checked each time the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is started, to verify the License Key. If the License Key<br />
is missing, invalid or expired, all authentication except <strong>for</strong> administration logons will be<br />
refused.<br />
6.2 Licensing<br />
Each <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> needs a license. The License Key is loaded into the corresponding<br />
Component record, and details of the License Key may be viewed via the Component list<br />
context menu or property sheet.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 66
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Policies<br />
7 Policies<br />
7.1 Policy <strong>In</strong>heritance<br />
Policies may be set up in a hierarchy, where one Policy will inherit most of its attributes from a<br />
parent Policy, but with some modifications <strong>for</strong> a slightly different scenario.<br />
Image 31: Policy <strong>In</strong>heritance<br />
<strong>In</strong> the example above, all attributes are inherited from the parent Policy, except those<br />
explicitly set.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 67
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Policies<br />
7.1.1 Show Effective Settings<br />
As the various levels of settings in Policy inheritance can get confusing, functionality is<br />
available which allows you to view the settings effective <strong>for</strong> a selected Policy, taking inherited<br />
settings into account. The text below shows the effective settings <strong>for</strong> the <strong>SBR</strong> Windows Self-<br />
Assignment Policy:<br />
Effective Policy Settings<br />
[Local/Back-End Authentication] :<br />
Local Authentication : Digipass/Password<br />
Back-End Authentication : If Needed<br />
Back-End Protocol : Windows :<br />
[User Accounts] :<br />
Dynamic User Registration : Yes<br />
Password Autolearn : No<br />
Stored Password Proxy : No<br />
Default Domain :<br />
User Lock Threshold : 3<br />
[Windows Group Check] :<br />
Group Check Option : No Check<br />
Group List :<br />
[Digipass Assignment] :<br />
Assignment Mode : Self-Assignment<br />
Grace Period (days) : 0<br />
Serial No. Separator : |<br />
Search up Organizational Unit Hierarchy : Yes<br />
[Digipass Settings] :<br />
Application Names :<br />
Application Type : No Restriction<br />
Digipass Types :<br />
PIN Changed Allowed : Yes<br />
[1-Step Challenge Response] :<br />
Enabled : No<br />
Challenge Length : 0<br />
Challenge Check Digit : No<br />
[2-Step Challenge Response] :<br />
Request Method : Keyword<br />
Request Keyword :<br />
[Primary Virtual Digipass] :<br />
Request Method : None<br />
Request Keyword :<br />
[Backup Virtual Digipass] :<br />
Enabled : No<br />
Maximum Days : 0<br />
Maximum Uses : 0<br />
Request Method : KeywordPassword<br />
Request Keyword : otp<br />
[Digipass Control Parameters] :<br />
Identification Time Window : 20<br />
Signature Time Window : 24<br />
Event Window : 20<br />
<strong>In</strong>itial Time Window : 6<br />
Identification Threshold : 0<br />
Signature Threshold : 0<br />
Check Challenge Flag : 1<br />
Level of Online Signature : 0<br />
Allowed <strong>In</strong>active Days : 0<br />
You will note that the settings listed above include those set in Policies from which the <strong>SBR</strong><br />
Windows Self-Assignment Policy inherit.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 68
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Policies<br />
7.2 Pre-Loaded Policies<br />
These Policies are created <strong>for</strong> the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> on installation of the Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>.<br />
They provide an example <strong>for</strong> setting up Policies in a typical environment.<br />
Table 4: Pre-Loaded Policies<br />
Policy Name Parent<br />
Policy<br />
Base Policy - Globally applicable settings.<br />
<strong>In</strong> general, all other Policies<br />
should inherit from this,<br />
directly or indirectly.<br />
<strong>SBR</strong> Base Policy Base Policy Settings applicable to all<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Policies,<br />
including local<br />
authentication. <strong>In</strong> general,<br />
all other <strong>SBR</strong> policies<br />
should inherit from this,<br />
directly or indirectly.<br />
<strong>SBR</strong> Windows Auto-<br />
Assignment<br />
<strong>SBR</strong> Windows Self-<br />
Assignment<br />
<strong>SBR</strong> Base Policy <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> model <strong>for</strong> Auto-<br />
Assignment with Dynamic<br />
User Registration, using<br />
Windows back-end<br />
authentication and a<br />
Windows group check.<br />
<strong>SBR</strong> Base Policy <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> model <strong>for</strong> Self-<br />
Assignment with Dynamic<br />
User Registration, using<br />
Windows back-end<br />
authentication.<br />
Description Non-Default Settings<br />
User Lock Threshold=3<br />
PIN Change Allowed=Yes<br />
Challenge Request Method=Keyword<br />
Primary VDP Request Method=Password<br />
Backup VDP Request<br />
Method=KeywordPassword<br />
Backup VDP Request Keyword=otp<br />
Identification Time Window=20<br />
Event Window=20<br />
<strong>In</strong>itial Time Window=6<br />
Identification Threshold=0<br />
Local Authentication=None<br />
Back-End Authentication=None<br />
DUR=No<br />
Password Autolearn=No<br />
Stored Password Proxy=No<br />
Group Check Mode=No Check<br />
Assignment Mode=Neither<br />
Search Up OU Path=No<br />
Application Types=No Restriction<br />
1-Step Challenge/Response=No<br />
1-Step Challenge Check Digit=No<br />
Backup VDP Enabled=No<br />
Local Authentication = Digipass/Password<br />
Back-End Authentication = If Needed<br />
Back-End Protocol = Windows<br />
Dynamic User Registration = Yes<br />
Assignment Mode = Auto-Assignment<br />
Search up OU Path = Yes<br />
Grace Period = 7<br />
Group Check Mode = Passthrough<br />
Group List = “Digipass Users”<br />
Back-End Authentication = If Needed<br />
Back-End Protocol = Windows<br />
Dynamic User Registration = Yes<br />
Assignment Mode = Self-Assignment<br />
Search up OU Path = Yes<br />
Serial No. Separator = “|”<br />
© 2006 VASCO Data Security <strong>In</strong>c. 69
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Policies<br />
7.3 Differences from VACMAN Middleware 2.3<br />
Some settings used in VACMAN Middleware 2.3 have been modified in Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong><br />
<strong>SBR</strong>. Most Server settings are found in Policies.<br />
7.3.1 Authenticator Setting<br />
The Authenticator field from VACMAN Middleware 2.3 has been split into several fields in<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong>:<br />
Local Authentication<br />
Back-End Authentication<br />
Back-End Protocol<br />
Disabled (User setting)<br />
The correspondence of the other fields is different <strong>for</strong> (VM) RADIUS and Web:<br />
VACMAN<br />
Middleware 2.3<br />
Setting<br />
RADIUS<br />
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Settings<br />
Local Auth setting Back-End Auth<br />
setting<br />
Back-End Protocol<br />
setting<br />
Local Server Digipass/Password None No<br />
Local and Proxy Digipass/Password Always RADIUS No<br />
Proxy Server None Always RADIUS No<br />
Local and Windows Digipass/Password Always Windows No<br />
Windows None Always Windows No<br />
Disabled Yes<br />
Web<br />
Local Server Digipass/Password None No<br />
Local and Proxy Digipass/Password If Needed Windows No<br />
Proxy Server None If Needed Windows No<br />
Local and Windows Digipass/Password If Needed Windows No<br />
Windows None If Needed Windows No<br />
Disabled Yes<br />
Table 5: VACMAN Middleware 2.3 and Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> Authentication Settings<br />
Disabled<br />
checkbox<br />
© 2006 VASCO Data Security <strong>In</strong>c. 70
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8 Database <strong>In</strong>tegration<br />
8.1 Active Directory<br />
8.1.1 What is Stored in Active Directory?<br />
The following in<strong>for</strong>mation is stored in Active Directory:<br />
Digipass User accounts<br />
Digipass and Digipass Application records<br />
Digipass configuration records (Policies, Components and Back-End Servers)<br />
8.1.2 Schema Extensions<br />
User attributes – vasco-UserExt class<br />
Extra VASCO attributes are added to an Active Directory User record via an 'auxiliary class'<br />
vasco-UserExt on the User class.<br />
Digipass and Digipass Application records<br />
The vasco-DPToken class is used to store Digipass attributes. It is also a container, in which<br />
vasco-DPApplication records <strong>for</strong> that Digipass are stored.<br />
Upon assignment to a User, the Digipass record is stored in the same location as the User.<br />
Policies, Components and Back-End Servers<br />
Policy, Component and Back-End Server records are stored in vasco-Policy, vasco-Component<br />
and vasco-BackEndServer objects respectively. They are located in a single “Digipass-<br />
Configuration” container in a single Domain.<br />
8.1.3 Digipass Records<br />
8.1.3.1 Location of Digipass Records<br />
When a Digipass is assigned to a User, it is moved to the same location as the Digipass User<br />
account it is assigned to. This makes it easier to set up the permissions necessary <strong>for</strong><br />
delegated administration.<br />
Note<br />
A Digipass record will not automatically be moved when the User account to<br />
which it is assigned is moved to another location. When moving User accounts<br />
within Active Directory, ensure that the records of any assigned Digipass are<br />
manually moved to the same location.<br />
Unassigned Digipass records may be stored in various places in the data store:<br />
Digipass Pool<br />
A container called Digipass-Pool is created during installation. This is intended as a general<br />
store <strong>for</strong> unassigned Digipass.<br />
Organizational Units<br />
If an Organizational Unit structure is used in the data store, Digipass can be loaded or moved<br />
© 2006 VASCO Data Security <strong>In</strong>c. 71
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
either into the exact Organizational Units where the User accounts to which they will be<br />
assigned are located, or into a few key Organizational Units in the hierarchy where they may<br />
be assigned to Users in lower level Organizational Units.<br />
Users Container<br />
When Active Directory is used as the data store, Digipass can be loaded into the Users<br />
container so they are available <strong>for</strong> Users in that container. However, it is not recommended to<br />
use the Users container <strong>for</strong> either User accounts or Digipass.<br />
When looking <strong>for</strong> an available Digipass to assign to a User, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will first look in the<br />
same Organizational Unit as the specific User account. The Search Upwards in<br />
Organizational Unit hierarchy option, when enabled, allows the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> to search in<br />
parent Organizational Units and the Digipass Pool container. This option may be set at the<br />
Policy level <strong>for</strong> system searches (eg. Auto-Assignment and Self-Assignment) or at the time of<br />
the search <strong>for</strong> manual assignment.<br />
Note<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will always find or assign the closest available Digipass record<br />
to the selected User record(s).<br />
8.1.3.2 Delegated Administration in Active Directory<br />
If the assignment is manual (per<strong>for</strong>med by an administrator), it will only find and successfully<br />
assign Digipass from locations where the administrator has the correct permissions. The<br />
administrator must have read permission <strong>for</strong> Digipass objects in the location to find a Digipass<br />
record, and if it needs to be moved to the User's location, they must have delete permission<br />
<strong>for</strong> Digipass objects to successfully assign the Digipass. If the administrator has sufficient<br />
permissions to view a Digipass record but not to assign it, the assignment will fail.<br />
Record<br />
Location<br />
Digipass Pool Digipass are available to be assigned to all<br />
Users, regardless of the Organizational Unit<br />
structure.<br />
Only administrators with access to the Digipass<br />
Pool may view or modify records <strong>for</strong> unassigned<br />
Digipass. This also means that only those<br />
administrators may manually assign Digipass.<br />
Organizational<br />
Unit<br />
Users<br />
Container<br />
Pros Cons<br />
Digipass may be portioned out to various<br />
Organizational Units. This is particularly useful<br />
where a company is contracted to provide<br />
authentication services to multiple companies,<br />
or where various departments have different<br />
Digipass quota.<br />
Digipass can be assigned to any User in the<br />
Users container.<br />
Table 6: Summary of Digipass Record Location Options<br />
An extra permission must be assigned all<br />
administrators who should be able to assign<br />
Digipass (if they are not Domain Admins). It is<br />
not possible to strictly subdivide the unassigned<br />
Digipass among the Organizational Units<br />
according to quotas.<br />
If an Organizational Unit runs out of Digipass to<br />
assign its Users, more Digipass records must be<br />
manually moved to the right location.<br />
Digipass in the Users container are only available<br />
to User accounts stored there.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 72
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8.1.3.3 Typical Digipass Location Models<br />
Digipass Pool<br />
A centralised point of access and importation can be implemented by using the Digipass Pool<br />
to hold unassigned Digipass records. This option requires less calculation and high-level<br />
administration, as Digipass records are all imported into one area and there is no need to<br />
manually move records or calculate the exact number of Digipass required <strong>for</strong> each<br />
Organizational Unit or group of Units. However, permissions will need to be set up to permit<br />
delegated administrators access to move the Digipass out of the container upon assignment.<br />
The Digipass Pool is treated as the Domain Root by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>, as Digipass records may<br />
not be saved in the Domain Root.<br />
Image 32: Digipass Record Locations - Digipass Pool<br />
<strong>In</strong> the diagram above, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is shown searching upwards through the Organizational<br />
Unit structure <strong>for</strong> available Digipass to assign to a Digipass User in the Organizational Unit B1.<br />
Because no available Digipass are found in B1, it searches in B, then in the Digipass Pool.<br />
Administrator 1 needs delegated administrator permissions <strong>for</strong> the Organizational Unit B and<br />
its child Organizational Units. They must also have read and delete permissions <strong>for</strong> Digipass<br />
objects in the Digipass Pool container.<br />
Note<br />
The Search Upwards in Organizational Unit hierarchy option must be<br />
enabled <strong>for</strong> this model to function correctly.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 73
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
Parent Organizational Units<br />
Unassigned Digipass can be kept in key Organizational Units, and made available to their lower<br />
level Organizational Units. This requires a delegated administrator to have permissions not<br />
only <strong>for</strong> the Organizational Unit in which the User accounts are stored, but also read, write and<br />
delete permissions <strong>for</strong> Digipass objects in the Organizational Unit in which the Digipass are<br />
stored.<br />
Image 33: Digipass Record Locations - Parent Organizational Unit<br />
<strong>In</strong> the diagram above, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can search in the parent Organizational Unit <strong>for</strong><br />
available Digipass.<br />
The delegated administratration permissions can be set up in two basic ways:<br />
Administrator 1 has full admin permissions <strong>for</strong> Organizational Unit B and its child<br />
Organizational Units. She does not require any other permissions to assign Digipass from<br />
Organizational Unit B to a User in Organizational Unit B1.<br />
Administrator 2 has full admin permissions <strong>for</strong> Organizational Unit A2 only. He has read<br />
and delete permissions <strong>for</strong> Digipass objects in Organizational Unit A in order to assign<br />
Digipass from Organizational Unit A to a User in Organizational Unit A2.<br />
Note<br />
The Search Upwards in Organizational Unit hierarchy option must be<br />
enabled <strong>for</strong> this model to function correctly.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 74
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
<strong>In</strong>dividual Organizational Units<br />
Digipass can be loaded or moved into each Organizational Unit where and when they are<br />
required. It is then easy to set up permissions <strong>for</strong> delegated administrators to assign them<br />
only within their scope of control. If all Digipass in the Organizational Unit are assigned, more<br />
Digipass will need to be moved in manually by a Domain Admin be<strong>for</strong>e they can be assigned<br />
by a delegated administrator.<br />
Image 34: Digipass Record Locations - <strong>In</strong>dividual Organizational Units<br />
<strong>In</strong> the diagram above, unassigned Digipass are stored in the exact Organizational Units in<br />
which they will be assigned.<br />
Each delegated administrator only requires permissions within their specific Organizational<br />
Unit(s).<br />
Note<br />
The Search Upwards in Organizational Unit hierarchy option does not<br />
need to be enabled <strong>for</strong> this model.<br />
Combination of models<br />
Digipass may be stored in the Digipass Pool as well as some or all Organizational Units. If no<br />
unassigned Digipass records are found in the Organizational Unit, and the Search Upwards in<br />
Organization Unit hierarchy option is enabled, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will search upwards to the<br />
Domain Root and search in the Digipass Pool <strong>for</strong> an available, unassigned Digipass record.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 75
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8.1.4 Search <strong>for</strong> Digipass Records<br />
The Digipass Extension <strong>for</strong> Active Directory Users and Computers allows you to search <strong>for</strong><br />
specific Digipass records, or Digipass records meeting set criteria. This functionality can be<br />
useful when you have Digipass records in various places throughout Active Directory.<br />
Image 35: Digipass Search window<br />
8.1.5 Permissions Needed by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
The installation process will ensure that the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> has sufficient permissions. This is<br />
achieved by assigning permissions in the domain to the in-built “RAS and IAS Servers” group.<br />
It is necessary to make sure that the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is added to that group.<br />
8.1.6 Administrative Permissions<br />
Administrative permissions <strong>for</strong> <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> administrators are controlled using Active Directory<br />
security properties. See the Permissions Needed by Administrators topic in the<br />
Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
Domain Administrators may view and edit all Digipass and Digipass User in<strong>for</strong>mation in their<br />
domain, plus Digipass Configuration in<strong>for</strong>mation if the Digipass Configuration Container is<br />
located in their domain. No permissions setup is required <strong>for</strong> them.<br />
Delegated Administrators may view and edit all Digipass and Digipass User in<strong>for</strong>mation<br />
within their administrative scope of control. It is necessary to grant them full control, create<br />
© 2006 VASCO Data Security <strong>In</strong>c. 76
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
and delete permissions over the Digipass and Digipass Application objects within their scope.<br />
Reduced Rights Administrators may per<strong>for</strong>m a subset of the administration tasks. 'Property<br />
sets' are defined with the directory which can be used to enable or limit them in various<br />
Digipass administration tasks (eg. Access to the Digipass blob).<br />
8.1.7 Active Directory Command Line Utility<br />
This utility has to per<strong>for</strong>m several tasks that are needed at various times during installation<br />
and upgrade if Active Directory is selected, or afterwards <strong>for</strong> maintenance. Some of the<br />
commands are run automatically by the installation program, while others are run manually.<br />
The commands that are run automatically can be run manually also, <strong>for</strong> example to<br />
troubleshoot why the installation is not succeeding.<br />
Command Description<br />
addschema Extend the Active Directory schema.<br />
checkschema Check that the schema extensions are all present.<br />
setupdomain Sets up the Digipass Configuration Container in the specified domain.<br />
setupaccess Assign permissions to a Windows group including:<br />
Table 7: DPADadmin tasks<br />
Full read access to everything in the domain<br />
Full control over vasco-DPToken objects<br />
Full control over vasco-DPApplication objects<br />
Ability to create and delete vasco-DPToken objects<br />
Full write access to extension attributes on user objects<br />
This command can optionally be used to also add a machine to the group.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 77
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8.2 ODBC or Embedded Database<br />
8.2.1 What is Stored in the Data Store?<br />
The following in<strong>for</strong>mation is stored in the data store:<br />
Digipass User accounts<br />
Digipass and Digipass Application records<br />
Digipass configuration records (Policies, Components, Back-End Servers)<br />
8.2.2 Domains and Organizational Units<br />
Domains and Organizational Units are included in the ODBC database in a way that mirrors the<br />
data structure used by Active Directory.<br />
Image 36: Domain and Organizational Unit Overview<br />
Organizational Units are designed to hold User accounts and Digipass records. They allow<br />
grouping of Users according to department, job function, or other criteria. They also allow<br />
Digipass to be allocated <strong>for</strong> Auto-Assignment to single or multiple groups of Users. Both<br />
Domains and Organizational Units can be used to limit administrators to a group of Users<br />
and/or Digipass.<br />
8.2.3 Location of Digipass Records<br />
When a Digipass is assigned to a User, it is moved to the same Organizational Unit as the<br />
Digipass User account to which it is assigned.<br />
Note<br />
When a User account is moved to an Organizational Unit, all Digipass records<br />
assigned to it will also be moved.<br />
A Digipass record assigned to a User cannot be moved - the User account must<br />
be moved.<br />
Unassigned Digipass records may be allocated to various places in the Organizational Unit<br />
structure:<br />
Master Domain<br />
During installation, a default domain is created. Digipass are imported to the Master Domain,<br />
© 2006 VASCO Data Security <strong>In</strong>c. 78
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
and may then be moved to other domains and Organizational Units.<br />
Organizational Units<br />
If an Organizational Unit structure is used in the database, Digipass can be moved either into<br />
the exact Organizational Units where the User accounts to which they will be assigned are<br />
located, or into a few key Organizational Units in the hierarchy where they may be assigned to<br />
Users in lower level Organizational Units.<br />
When looking <strong>for</strong> an available Digipass to assign to a User, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will first look in the<br />
same Organizational Unit as the specific User account, if the User account belongs to an<br />
Organizational Unit. The Search Upwards in Organizational Unit hierarchy option, when<br />
enabled, allows the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> to search in parent Organizational Units and the Digipass Pool<br />
container. This option may be set at the Policy level <strong>for</strong> system searches (eg. Auto-Assignment<br />
and Self-Assignment) or at the time of the search <strong>for</strong> manual assignment.<br />
Note<br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will always find or assign the closest available Digipass record<br />
to the selected User record(s).<br />
If the User account being assigned a Digipass does not belong to an Organizational Unit, the<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will look <strong>for</strong> an available Digipass in the domain which does not belong to an<br />
Organizational Unit.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 79
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8.2.3.1 Typical Digipass Location Models<br />
Domain Root<br />
Digipass records may be stored in the Domain Root while unassigned.<br />
This option allows a centralised point of access <strong>for</strong> assignment of Digipass. It also requires less<br />
calculation and high-level administration - Digipass records are all stored in one area and there<br />
is no need to manually move records or calculate the exact number of Digipass required <strong>for</strong><br />
each Organizational Unit or group of Units. Administrators must belong to the Domain only<br />
(not an Organizational Unit) to assign Digipass from the Domain Root.<br />
Image 37: Digipass Record Locations – Domain Root<br />
<strong>In</strong> the diagram above, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> searches upwards through the Organizational Unit<br />
structure <strong>for</strong> available Digipass to assign to a Digipass User in the Organizational Unit B1.<br />
Because no available Digipass are found in B1, it searches in B, then in the Domain root.<br />
The administrator account must be located in the domain root (no Organizational Unit) in order<br />
<strong>for</strong> this model to work successfully.<br />
Note<br />
The Search Upwards in Organizational Unit hierarchy option must be<br />
enabled <strong>for</strong> this model to function correctly.<br />
This option is simplified if an Organizational Unit structure is not used in the database. User<br />
accounts and Digipass records may all be stored in the Master Domain. The Search Upwards<br />
in Organizational Unit hierarchy option does not need to be enabled in this case.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 80
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
Parent Organizational Units<br />
Unassigned Digipass can be kept in key Organizational Units, and made available to their lower<br />
level Organizational Units.<br />
Image 38: Digipass Record Locations - Parent Organizational Unit<br />
<strong>In</strong> the diagram above, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can search in the parent Organizational Unit <strong>for</strong><br />
available Digipass. Administrators will need to belong to the parent Organizational Unit.<br />
Note<br />
The Search Upwards in Organizational Unit hierarchy option must be<br />
enabled <strong>for</strong> this model to function correctly.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 81
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
<strong>In</strong>dividual Organizational Units<br />
Digipass can be loaded or moved into each Organizational Unit where and when they are<br />
required. If all Digipass in the Organizational Unit are assigned, more Digipass will need to be<br />
moved in manually by a Domain Admin be<strong>for</strong>e they can be assigned.<br />
Image 39: Digipass Record Locations - <strong>In</strong>dividual Organizational Units<br />
<strong>In</strong> the diagram above, unassigned Digipass are stored in the exact Organizational Units in<br />
which they will be assigned. Administrator accounts belonging to the Organizational Units A1<br />
and A2 have administration privileges in their own Organizational Unit only.<br />
Note<br />
The Search Upwards in Organizational Unit hierarchy option does not<br />
need to be enabled <strong>for</strong> this model.<br />
Combination of models<br />
Digipass may be stored in the Master Domain as well as some or all Organizational Units. If no<br />
unassigned Digipass records are found in the Organizational Unit, and the Search Upwards in<br />
Organization Unit hierarchy option is enabled, the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will search upwards to the<br />
Domain Root and search in the Digipass Pool <strong>for</strong> an available, unassigned Digipass record.<br />
8.2.4 Permissions Needed by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will require either:<br />
a database administrator account <strong>for</strong> the database,<br />
ownership of the VASCO tables, or<br />
permissions to insert, remove, read and modify rows in VASCO tables.<br />
See the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation. This is set up automatically in the case<br />
of the embedded database option.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 82
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8.2.5 Database Command Line Utility<br />
This utility has to per<strong>for</strong>m several tasks that are needed at various times during installation<br />
and upgrade, or afterwards <strong>for</strong> maintenance. Some of the commands are run automatically by<br />
the installation program, while others are run manually. The commands that are run<br />
automatically can be run manually also, <strong>for</strong> example to troubleshoot why the installation is not<br />
succeeding.<br />
Command Description<br />
addschema Modify the database structure to create the required VASCO tables.<br />
checkschema Check that the required database modifications and/or table name remappings have been<br />
completed.<br />
dropschema Remove all database schema modifications from the database.<br />
Table 8: DPDBadmin commands<br />
8.2.6 Additional ODBC Databases<br />
A synchronized backup database may be set up <strong>for</strong> the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. This helps to ensure<br />
continuous service if the main database fails. The synchronization can be a shadow database,<br />
a mirror or a replicated copy.<br />
The required synchronization must be set up according to the instructions provided by the<br />
database vendor. It is strongly recommended to minimize the synchronization delay.<br />
Once the database and any synchronization is set up, create a Data Source Name <strong>for</strong> the new<br />
database and add it to the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration GUI.<br />
Image 40: Additional ODBC databases<br />
See the Database Connection Handling topic in the Administrator Reference <strong>for</strong> more<br />
in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 83
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Database <strong>In</strong>tegration<br />
8.2.7 Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s<br />
If more than one <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> are installed on the system, some additional setup may be<br />
required.<br />
Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s Using Same Database<br />
If more than one <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is using the one ODBC database, no additional setup steps are<br />
required. However, use of a backup database should be considered.<br />
Image 41: Multiple <strong>Plug</strong>-<strong>In</strong>s Using Single Database<br />
Multiple <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s Using Own Database<br />
If each <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is using its own ODBC database as a data store, replication should be<br />
per<strong>for</strong>med between <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>s to ensure that each database is kept up to date and to guard<br />
against data loss.<br />
8.3 Sensitive Data Encryption<br />
Sensitive data is encrypted by the Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> using an embedded key. If<br />
needed, this encryption may be strengthened by including a custom encryption key. See the<br />
Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 84
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Licensing<br />
9 Licensing<br />
9.1 Overview<br />
VASCO products are licensed per Component record in the data store. The licensing relies upon<br />
a License Key which is checked when the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> starts. This License Key is tied to the<br />
location (IP address) where the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is installed, and stored in the Component record<br />
<strong>for</strong> the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. The <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> will not authenticate a user without a correct License<br />
Key.<br />
Evaluation Licenses<br />
An evaluation license means that you can use its full functionality until the evaluation period<br />
runs out. At the end of this period, you will need to either uninstall the product or buy a<br />
permanent license. Contact your distributor or the appropriate VASCO Reseller representative<br />
to acquire the licences you will need. For your convenience, the evaluation serial number is<br />
embedded in the installation program. You will still need to obtain and load a license key.<br />
Client module licenses can also be evaluation (time-limited) licenses.<br />
9.2 Obtaining and Loading a License Key<br />
The Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> installation process will guide you through the process of<br />
requesting and loading a License Key. However, if <strong>for</strong> some reason it is not possible to<br />
complete the licensing at installation time, the Administration MMC <strong>In</strong>terface can be used to<br />
obtain and load a License Key <strong>for</strong> a Component. This process must be completed <strong>for</strong> each <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong>, and requires an active internet connection to open the Digipass Activation Page.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 85
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Auditing and Tracing<br />
10 Auditing and Tracing<br />
10.1 Audit System<br />
The VASCO Audit System consists of a number of auditing modules which save audit messages<br />
to a specific <strong>for</strong>mat (eg. text file) and an Audit Viewer which can open, display and filter audit<br />
messages from various sources.<br />
Audit messages are primarily generated by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. They may be recorded by a<br />
number of different methods:<br />
Windows Event Log (to be viewed in the Event Log Viewer)<br />
Text file<br />
ODBC-compliant database<br />
Audit messages may also be passed directly to an Audit Viewer as a live feed.<br />
10.1.1 Configure Auditing Output<br />
Auditing output from the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can be configured using the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration.<br />
See the Configuration section of the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 86
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Auditing and Tracing<br />
10.1.2 Audit Viewer<br />
The Audit Viewer can retrieve messages from several different sources and display audit<br />
messages from each in separate windows. Audit messages may be filtered by message type,<br />
date and time, or the contents of specific fields.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 87
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Auditing and Tracing<br />
10.1.3 Audit message types<br />
Type Description<br />
Error The message contains details about a system, configuration, licensing or some internal error.<br />
Errors do not include normal processing events such as failed logins.<br />
Warning Warning messages contain details about potential problems within the system. This could include<br />
details such as a failed connection attempt to a Domain Controller.<br />
<strong>In</strong><strong>for</strong>mation <strong>In</strong><strong>for</strong>mational messages provide details about events within the system that need to be recorded<br />
but do not indicate errors or potential errors. An example of this may be a re-connection to<br />
Active Directory <strong>for</strong> load-balancing reasons.<br />
Success Success messages contain details about processing events that were correctly processed. This<br />
may include successful authentications or successful administration commands.<br />
Failure Failure messages contain details about processing events that failed. This may include rejected<br />
authentications, or administration actions that failed.<br />
Table 9: Audit message types<br />
10.1.4 Active Directory Auditing<br />
Active Directory auditing may be enabled and configured to record access and modifications to<br />
Digipass-related data used by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. See the Active Directory Auditing topic in the<br />
Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
10.2 Tracing<br />
The level of tracing <strong>for</strong> the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> can be configured using the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration<br />
utility. Tracing messages will be recorded to a text file.<br />
See the Tracing section in the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation, and instructions<br />
on configuring tracing <strong>for</strong> the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 88
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> User Self Management Web Site<br />
11 User Self Management Web Site<br />
11.1 What is the User Self Management Web Site?<br />
The User Self Management Web Site allows Users to per<strong>for</strong>m functions which are unavailable<br />
during a usual login – either because the functionality is disabled within the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong><br />
configuration, or because CHAP or another protocol is in use which does not allow the<br />
functionality:<br />
User Registration and Auto-Assignment<br />
Self-Assignment<br />
Password Synchronization<br />
PIN Change<br />
Login Test<br />
The site can also be used to help Users get started with their Digipass while they are still in the<br />
office and help is available.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 89
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> User Self Management Web Site<br />
Important Note<br />
The User Self Management Web Site is intended <strong>for</strong> RADIUS environments, and<br />
uses the RADIUS protocol to communicate with the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. If the <strong>SBR</strong><br />
<strong>Plug</strong>-<strong>In</strong> is not licensed <strong>for</strong> RADIUS, you will not be able to use the User Self<br />
Management Web Site.<br />
11.2 Customizing the User Self Management Web Site<br />
The User Self Management Web Site can be customized by modifying the pages provided with<br />
the installation. You may wish to:<br />
change the colors and graphics to match your corporate colors/logos.<br />
integrate the pages into a larger web site.<br />
translate or customize the text<br />
Any cosmetic part of the web pages may be modified. Completely new web pages may be<br />
used, provided that the correct <strong>for</strong>m fields are posted to the CGI program, and query string<br />
variables are interpreted correctly. Server scripting languages such as PHP or ASP, or any<br />
other way of generating HTML, can be used.<br />
See the Web Sites section of the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 90
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> OTP Request Site<br />
12 OTP Request Site<br />
12.1 What is the OTP Request Site?<br />
The OTP Request site provides a method <strong>for</strong> Users to request an OTP to be sent to their<br />
mobile, <strong>for</strong> use in logging in.<br />
Image 42: OTP Request Site<br />
Important Note<br />
The OTP Request Site is intended <strong>for</strong> RADIUS environments, and uses the<br />
RADIUS protocol to communicate with the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>. If the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> is<br />
not licensed <strong>for</strong> RADIUS, you will not be able to use the OTP Request Site.<br />
12.1.1 Customizing the OTP Request Site<br />
The OTP Request Site is designed to customized in a similar way to the User Self Management<br />
Web Site. See the Web Sites section of the Administrator Reference <strong>for</strong> more in<strong>for</strong>mation.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 91
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> Message Delivery Component<br />
13 Message Delivery Component<br />
13.1 What is the Message Delivery Component?<br />
The Message Delivery Component (MDC) interfaces with a gateway service to send a One Time<br />
Password to a User’s mobile phone. The MDC acts as a service, accepting messages from the<br />
<strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>, which are then <strong>for</strong>warded to a text message gateway via the HTTP/HTTPS<br />
protocol.<br />
Since every gateway uses different submission parameters, a set of configuration values is<br />
required, which can be administered by the MDC Configuration GUI.<br />
The MDC service can be started and stopped through the Windows Service Manager Console.<br />
13.2 Configuration<br />
To configure gateway settings you will need:<br />
Gateway details OR a customized configuration file ordered from your VASCO supplier.<br />
This will need to be imported using the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong> Configuration.<br />
If you will not be using a configuration file, these details are required:<br />
Protocol to use in connecting to the gateway.<br />
An address string and port to use in connecting to the gateway.<br />
The path and filename of a certificate file, if required.<br />
The required Query String.<br />
The Query Method (GET or POST) required by the gateway.<br />
Username and password <strong>for</strong> the gateway account.<br />
© 2006 VASCO Data Security <strong>In</strong>c. 92
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> <strong>In</strong>dex<br />
Alphabetical <strong>In</strong>dex<br />
2-step Login.................................................. 33<br />
Active Directory............................. 13, 50, 72, 78<br />
Audit...............................................................<br />
Active Directory Auditing.............................90<br />
Audit System............................................ 88<br />
Audit Viewer............................................. 90<br />
Authentication............................................... 14<br />
Local........................................................ 29<br />
Authenticator................................................ 71<br />
Auto-Assignment...................................... 31, 92<br />
Backup Virtual Digipass........................ 16, 33, 59<br />
Challenge..................................................... 33<br />
Challenge/Response......................... 9, 10, 33, 57<br />
1-Step Challenge/Response......................... 32<br />
2-Step Challenge/Response......................... 32<br />
Non-time-based......................................... 58<br />
Time-based............................................... 57<br />
CHAP...................................................... 45, 46<br />
Check Digit................................................... 58<br />
Component................................................... 47<br />
Components..................................12, 13, 72, 79<br />
Customize..................................................... 93<br />
Data Migration Tool................................... 14, 17<br />
Digipass...9, 13, 14, 16, 31, 33, 50, 56, 57, 61-63,<br />
72, 79<br />
Digipass Application..................................... 9<br />
Digipass <strong>for</strong> Palm....................................... 11<br />
Digipass <strong>for</strong> Pocket PC................................ 11<br />
Digipass <strong>for</strong> SIM........................................ 11<br />
Digipass <strong>for</strong> Windows................................. 11<br />
Digipass PIN............................................. 57<br />
Digipass record......................................... 56<br />
Hardware Digipass....................................... 9<br />
Login process............................................ 18<br />
Lookup..................................................... 29<br />
Programming............................................ 57<br />
Server PIN................................................ 59<br />
Software Digipass...................................... 10<br />
Unlock Digipass......................................... 56<br />
Virtual Digipass.............................. 13, 16, 33<br />
Digipass ...................................................... 13<br />
Digipass Application....................................... 16<br />
Digipass record.............................................. 61<br />
Digipass User................................ 50, 62, 72, 79<br />
Account.................................................... 54<br />
Account Creation....................................... 54<br />
Linked...................................................... 30<br />
Digital Signature........................................ 9, 10<br />
Domain............................................................<br />
ODBC....................................................... 55<br />
DUR............................................................. 54<br />
EAP.............................................................. 45<br />
Encryption.................................................... 86<br />
Event Value................................................... 59<br />
Event-based.................................................. 57<br />
Grace period............................................ 31, 61<br />
Group Check................................................. 29<br />
Licensing..........................................................<br />
License Key.............................................. 87<br />
Local Authentication....................................... 29<br />
Message Delivery Component..................... 13, 95<br />
MS-CHAP................................................. 45, 46<br />
MS-CHAP2............................................... 45, 46<br />
ODBC..................................................... 47, 55<br />
One Time Password......................... 9, 10, 13, 33<br />
Length..................................................... 58<br />
Organizational Unit............................................<br />
ODBC....................................................... 55<br />
OTP Request Site........................... 13, 33, 66, 94<br />
PAP.............................................................. 45<br />
Password..........................................................<br />
Password Autolearn.................................... 55<br />
Static Password......................................... 34<br />
© 2006 VASCO Data Security <strong>In</strong>c. 93
Digipass <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Product</strong> <strong>Guide</strong> <strong>In</strong>dex<br />
PIN..................................................................<br />
Digipass PIN........................................ 10, 57<br />
Force PIN Change...................................... 56<br />
Server PIN.......................................... 31, 59<br />
Policies......................................................... 68<br />
Policy........................................................... 29<br />
Policy record.................................................<br />
Pre-loaded............................................ 70<br />
Privileges...................................................... 55<br />
RADIUS................................................... 14, 33<br />
RADIUS Client............................................... 14<br />
RADIUS Client Simulator................................. 14<br />
Reset...............................................................<br />
Digipass Application................................... 16<br />
Reset Application....................................... 56<br />
Reset Application Lock................................ 56<br />
Reset PIN................................................. 56<br />
Response Only...................................... 9, 10, 57<br />
Schema........................................................ 72<br />
Self-Assignment....................................... 61, 92<br />
Serial Number............................................... 61<br />
Set..................................................................<br />
Set Event Counter...................................... 56<br />
Set PIN.................................................... 56<br />
Smartcard..................................................... 10<br />
Stored Password Proxy................................... 54<br />
Test Digipass Application................................. 57<br />
Text message.................................................. 9<br />
Time Shift..................................................... 58<br />
Time Step..................................................... 58<br />
Time-based................................................... 57<br />
Tracing......................................................... 91<br />
User Self Management Web Site...... 13, 55, 92, 93<br />
User Self-Management Web Site...................... 54<br />
Virtual Digipass..................... 9, 13, 16, 31-33, 64<br />
Backup Virtual Digipass... 11, 16, 32, 33, 64, 65<br />
Keyword................................................... 34<br />
OTP......................................................... 32<br />
Primary Virtual Digipass.............................. 11<br />
Request Method......................................... 34<br />
© 2006 VASCO Data Security <strong>In</strong>c. 94