Digipass Plug-In for SBR Administrator Reference - Vasco
Digipass Plug-In for SBR Administrator Reference - Vasco
Digipass Plug-In for SBR Administrator Reference - Vasco
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
<strong>Digipass</strong> <strong>Plug</strong>-<strong>In</strong> <strong>for</strong> <strong>SBR</strong> <strong>Administrator</strong> <strong>Reference</strong> Field Listings<br />
Field Name in<br />
Administration<br />
<strong>In</strong>terfaces<br />
Windows Group Check<br />
(radio buttons)<br />
Description<br />
incorrect or the account is Disabled, the failure would not count towards the lock threshold.<br />
Locking is used mainly <strong>for</strong> incorrect OTPs and static passwords.<br />
Specifies whether and how the Windows Group Check feature is to be used. This feature<br />
is typically used <strong>for</strong> a staged deployment of <strong>Digipass</strong> when the Auto-Assignment method<br />
is used. It can also be used when only some Users are required to use <strong>Digipass</strong> or when<br />
only some Users will be permitted access and they have to use <strong>Digipass</strong>.<br />
Options:<br />
Default Use the setting of the parent Policy.<br />
No check Do not use the Windows Group Check feature.<br />
Pass requests <strong>for</strong> users not<br />
in listed groups back to<br />
host system<br />
Reject requests <strong>for</strong> users<br />
not in listed group<br />
Use only Back-End<br />
Authentication <strong>for</strong> users<br />
not in listed groups<br />
Use the Windows Group Check so that any Users who are not in<br />
one of the listed groups are ignored by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
Use the Windows Group Check so that any Users who are not in<br />
one of the listed groups are rejected by the <strong>SBR</strong> <strong>Plug</strong>-<strong>In</strong>.<br />
Use Back-End Authentication only <strong>for</strong> any Users who are not in<br />
one of the listed groups.<br />
Group List This lists the names of the Windows Groups to be checked according to the Windows Group<br />
Check radio button setting. There are some important limitations of this check:<br />
Certain built-in Active Directory groups such as Domain Users and Everyone will not<br />
be checked. The check is intended to be used with a new group created specifically <strong>for</strong><br />
this purpose.<br />
Nested group membership will not be detected by the check.<br />
There is no Domain qualifier <strong>for</strong> a group. The named group must be created in each<br />
Domain where User accounts exist that need to be added to the group.<br />
<strong>In</strong> the case of an ODBC Database, a local machine group can be used also.<br />
Assignment Mode Specifies the method of automated <strong>Digipass</strong> Assignment that will be used <strong>for</strong> this Policy, if<br />
any. There are two methods, Auto-Assignment and Self-Assignment.<br />
Auto-Assignment is used in conjunction with Dynamic User Registration (DUR). When<br />
DUR occurs, the next available <strong>Digipass</strong> is assigned to the new <strong>Digipass</strong> User account. A<br />
Grace Period is set <strong>for</strong> the <strong>Digipass</strong> according to the Grace Period setting in the Policy.<br />
Self-Assignment is typically used with DUR also, but if the <strong>Digipass</strong> User accounts are<br />
created first by the administrator, DUR is not necessary. <strong>In</strong> the Self-Assignment mode, a<br />
User is able to assign themselves a <strong>Digipass</strong> by entering the Serial Number, a valid OTP<br />
from the <strong>Digipass</strong> and their static password. There is no Grace Period associated with Self-<br />
Assignment, because the User has to use the <strong>Digipass</strong> to per<strong>for</strong>m Self-Assignment.<br />
<strong>In</strong> both cases, any Applicable <strong>Digipass</strong> restrictions <strong>for</strong> the Policy apply. For example, it will<br />
not be permitted to self-assign a DP300 if the Policy restricts <strong>Digipass</strong> Types to DPGO3 and<br />
DPGO1. <strong>In</strong> addition, if the User already has a <strong>Digipass</strong> assigned that meets the Policy<br />
restrictions, they will not be able to self-assign another <strong>Digipass</strong>.<br />
Options:<br />
Default Use the setting of the parent Policy.<br />
Auto-Assignment Use the Auto-Assignment method.<br />
Self-Assignment Use the Self-Assignment method.<br />
Neither Do not use either method of automated assignment.<br />
Grace Period Default time period (in days) to give Users between Auto-Assignment of a <strong>Digipass</strong> and<br />
the date they must start using their <strong>Digipass</strong> to login. Be<strong>for</strong>e that time they can still use a<br />
static password (unless the Local Authentication setting is <strong>Digipass</strong> Only). However, the<br />
first time that an OTP is used to log in, the Grace Period is ended at that point if it has not<br />
already ended.<br />
This setting does not affect manual assignment by an administrator.<br />
Serial No. Separator The character (or short sequence of characters) that will be included at the end of the<br />
© 2006 VASCO Data Security <strong>In</strong>c. 89