Digipass Plug-In for SBR Administrator Reference - Vasco

Digipass Plug-In for SBR Administrator Reference Field Listings
Field Name in
Administration
Interfaces
Windows Group Check
(radio buttons)
Description
incorrect or the account is Disabled, the failure would not count towards the lock threshold.
Locking is used mainly for incorrect OTPs and static passwords.
Specifies whether and how the Windows Group Check feature is to be used. This feature
is typically used for a staged deployment of Digipass when the Auto-Assignment method
is used. It can also be used when only some Users are required to use Digipass or when
only some Users will be permitted access and they have to use Digipass.
Options:
Default Use the setting of the parent Policy.
No check Do not use the Windows Group Check feature.
Pass requests for users not
in listed groups back to
host system
Reject requests for users
not in listed group
Use only Back-End
Authentication for users
not in listed groups
Use the Windows Group Check so that any Users who are not in
one of the listed groups are ignored by the SBR Plug-In.
Use the Windows Group Check so that any Users who are not in
one of the listed groups are rejected by the SBR Plug-In.
Use Back-End Authentication only for any Users who are not in
one of the listed groups.
Group List This lists the names of the Windows Groups to be checked according to the Windows Group
Check radio button setting. There are some important limitations of this check:
Certain built-in Active Directory groups such as Domain Users and Everyone will not
be checked. The check is intended to be used with a new group created specifically for
this purpose.
Nested group membership will not be detected by the check.
There is no Domain qualifier for a group. The named group must be created in each
Domain where User accounts exist that need to be added to the group.
In the case of an ODBC Database, a local machine group can be used also.
Assignment Mode Specifies the method of automated Digipass Assignment that will be used for this Policy, if
any. There are two methods, Auto-Assignment and Self-Assignment.
Auto-Assignment is used in conjunction with Dynamic User Registration (DUR). When
DUR occurs, the next available Digipass is assigned to the new Digipass User account. A
Grace Period is set for the Digipass according to the Grace Period setting in the Policy.
Self-Assignment is typically used with DUR also, but if the Digipass User accounts are
created first by the administrator, DUR is not necessary. In the Self-Assignment mode, a
User is able to assign themselves a Digipass by entering the Serial Number, a valid OTP
from the Digipass and their static password. There is no Grace Period associated with Self-
Assignment, because the User has to use the Digipass to perform Self-Assignment.
In both cases, any Applicable Digipass restrictions for the Policy apply. For example, it will
not be permitted to self-assign a DP300 if the Policy restricts Digipass Types to DPGO3 and
DPGO1. In addition, if the User already has a Digipass assigned that meets the Policy
restrictions, they will not be able to self-assign another Digipass.
Options:
Default Use the setting of the parent Policy.
Auto-Assignment Use the Auto-Assignment method.
Self-Assignment Use the Self-Assignment method.
Neither Do not use either method of automated assignment.
Grace Period Default time period (in days) to give Users between Auto-Assignment of a Digipass and
the date they must start using their Digipass to login. Before that time they can still use a
static password (unless the Local Authentication setting is Digipass Only). However, the
first time that an OTP is used to log in, the Grace Period is ended at that point if it has not
already ended.
This setting does not affect manual assignment by an administrator.
Serial No. Separator The character (or short sequence of characters) that will be included at the end of the
© 2006 VASCO Data Security Inc. 89