Digipass Plug-In for SBR Administrator Reference - Vasco

Digipass Plug-In for SBR Administrator Reference Set Up Active Directory Permissions
5.4 Multiple Domains
When using the SBR Plug-In with multiple domains, extra steps must be followed to ensure
that both the SBR Plug-In and administrators have permissions sufficient to access required
data. The main issues are:
The Digipass Configuration Container is only in one Domain. All SBR Plug-Ins need read
access to this container, even when they are in a different Domain. Cross-Domain access
for administrators is a less likely requirement however.
If a SBR Plug-In handles users and Digipass in more than one Domain, they need to be
granted the necessary permissions in all the necessary Domains.
In this manual, we will handle cross-Domain permissions using a combination of Domain Local
and Domain Global groups. It is possible in a 'native' mode Domain to use Universal groups,
but these are not recommended in Windows 2000 due to replication issues. The replication
efficiency has been improved in Windows Server 2003, however Universal groups are still not
used as commonly as Domain Local/Global groups.
Three possible scenarios for multiple domain setup are outlined below:
5.4.1 Scenario 1 – Each SBR Plug-In Handles One Domain
Each SBR Plug-In handles only the domain in which it is a member.
Install the SBR Plug-In in each domain (the result will be at least as many SBR Plug-Ins as
domains).
Give each SBR Plug-In access to the Digipass Configuration Domain:
Domain Global Group(s)
For each domain (apart from the Digipass Configuration Domain) -
1. Create a Domain Global group
2. Add the SBR Plug-In(s) to the Domain Global group (check which machines are in the
'RAS and IAS Servers' group to ensure the correct additions)
Domain Local group
In the Digipass Configuration Domain -
3. Create or use an existing Domain Local group.
4. Give the Domain Local group full read access to the Digipass Configuration Container.
5. Add the Domain Global Group from each other domain to the Domain Local group.
© 2006 VASCO Data Security Inc. 66