Digipass Plug-In for SBR Administrator Reference - Vasco

Digipass Plug-In for SBR Administrator Reference Active Directory Schema
2.4.2 Old Data Used Overwrites New Data
The problems above are exacerbated when the old information used on the second Domain
Controller is updated based on the old information. As the updated record on the second
Domain Controller now has a later modification date, the end result is that the changed
information on the first Domain Controller is overwritten incorrectly.
Example
An administrator connects to DC-01 and sets a User's PIN from '1234' to '9876'. The User
logs in through the SBR Plug-In, which connects to DC-02. The User enters the new Server
PIN and his One Time Password. However, the PIN set on DC-01 has not yet been replicated
to DC-02, so because the PIN entered does not match the old PIN still recorded in the
Digipass record on DC-02, the login fails.
Because the Policy setting of Identification Threshold is in use, his login failure is written
back to the Digipass record. When replication occurs, the Digipass record on DC-02 has the
latest modification date – and is copied to DC-01, wiping out the original PIN setting made
by the administrator. Both DC-01 and DC-02 now consider '1234' to be the correct Server
PIN for the Digipass.
Time DC-01 DC-02
10:45 Replication
10:46 Administrator changes User's PIN from 9876
to 1234.
10:48 User login (with new PIN of 1234) fails.
SBR Plug-In writes failure information to
Digipass record.
10:50 Replication
Active Directory finds last instance of the Digipass blob having been modified.
Active Directory overwrites DC-01 Digipass record with DC-02 Digipass record.
The example timeline above shows how the problem can occur.
The problem shown in the example above may also occur in a Force PIN Change set by an
administrator.
2.4.3 Factors Affecting Replication Issues
A number of factors determine the likelihood and severity of the Active Directory issues
described:
Redundancy and load-balancing settings for the SBR Plug-In
There are a number of SBR Plug-In configuration settings which may affect replication issues:
Preferred Server
The SBR Plug-In will attempt to connect to the named Domain Controller, rather than
simply polling the domain for an available Domain Controller.
Preferred Server Only
The SBR Plug-In may be restricted to connecting only to the Domain Controller named in
the above setting. If this is enabled, the SBR Plug-In will not switch to any other Domain
Controller, so it will never retrieve data older than its own.
Max. Bind Lifetime
The maximum bind lifetime controls how long the SBR Plug-In will stay connected to a
Domain Controller before polling the domain for a Domain Controller connection.
© 2006 VASCO Data Security Inc. 27