Digipass Plug-In for SBR Administrator Reference - Vasco

Digipass Plug-In for SBR Administrator Reference Set Up Active Directory Permissions
5.2 Permissions Needed by Administrators
5.2.1 Domain Administrators
Domain Administrators already have all required permissions within their Domain.
5.2.2 Delegated Administrators
The term 'Delegated Administrators' is used here to refer to administrators who have been
delegated control over an Organizational Unit. Generally speaking, they have administrative
control over the user and computer accounts within their Organizational Unit.
See the Digipass Records topic in the Product Guide for more information on possible
approaches to delegating Digipass administration.
By default, these administrators will be able to view the Digipass User Account data for their
users and the Digipass that are located within their Organizational Unit. However, they will not
be able to modify any of that data or assign Digipass.
If you wish to delegate responsibility for all Digipass-related administration within an
Organizational Unit, the following additional permissions are required by the Delegated
Administrator:
Within the scope of the Organizational Unit, Write permission to the new attributes that
are added to the User class for Digipass Plug-In for SBR (these are in the auxiliary class
vasco-UserExt) – you can add Write permissions for each individual Property Set or if
appropriate, grant 'Write All Properties' permission
Within the scope of the Organizational Unit, Full Control over all Digipass (vasco-
DPToken) and Digipass Application (vasco-DPApplication) objects
Create and Delete permission for Digipass (vasco-DPToken) objects within the
Organizational Unit
If the Delegated Administrator should be allowed to assign Digipass from the Digipass
Pool to their users, they need Delete Digipass permission in the Digipass-Pool container
5.2.3 Reduced-Rights Administrators
The term 'Reduced-Rights Administrator' is used here to refer to administrators who are
granted permissions to perform only selected Digipass-related administration tasks. They may
be granted these permissions within the scope of the whole Domain, or only within an
Organizational Unit.
An example is a Helpdesk operator who is permitted to troubleshoot Digipass operations, but
not to assign/unassign Digipass to/from users.
By default, all users have read access to everything in the Active Directory. The modification
permissions that can be granted to this kind of administrator are:
Write permission for any of three Property Sets on the Digipass User Account fields:
Digipass User Account Information – all attributes except those covered by the other two
Property Sets, including Authorization Profiles/Attributes
© 2006 VASCO Data Security Inc. 63