KB 150094
LDAP SYNC or Dynamic User Registration in
IDENTIKEY Authentication Server.
Creation date: 16/01/2013
Last Review: 30/01/2013
Document type: Documentation
Revision number: 2
Security status: EXTERNAL
Summary
This article will compare the pro and con’s of LDAP SYNC versus Dynamic User
Registration (DUR).
Details.
There are four ways to create users in IDENTIKEY Authentication Server: manually,
using a CSV user import file, automatically using DUR and using the LDAP sync tool.
This article will compare DUR with the LDAP sync tool, and when to use one or the
other.
The LDAP sync tool is a standalone tool that will interact between an LDAP back-end
and IDENTIKEY Authentication Server to create, update and/or delete users. The
LDAP sync tool can be used once to create all the users, or it can be scheduled to run
on regular intervals.
LDAP sync is delivered together with IDENTIKEY Authentication Server. It is delivered
with its own documentation.
DUR is a built-in feature of IDENTIKEY Authentication Server that can create users if
they don’t exist and the back-end authentication is successful. DUR can be turned on
in the Policies.
DUR is documented in the IDENTIKEY Authentication Server documentation.
Features compared:
Features
LDAP sync
DUR
Create a user with his UserID
Yes
Yes
No
No
Fill in / update the stored static password
Applies to: IDENTIKEY Authentication Server 3.4
KB 150094– 30/01/2013
2013 VASCO Data Security. All rights reserved.
(1)
Page 1 of 2
Delete a user
(2)
Yes
No
Fill in / update the phone number
Yes
No
Fill in / update the email address
Yes
No
Fill in / update the user name
Yes
No
Runs only once
Depends
Only users that are needed are created
No
Yes
No
Yes
Yes
No
Yes
No
User immediately available
Extra load on the machine
More lines in the audit files
(4)
(5)
(6)
DIGIPASS Assignment
(1)
(2)
(3)
(4)
(5)
(6)
(7)
(8)
Yes
(7)
(3)
Yes
Yes
(8)
Both solutions cannot fill in or update the password. Therefore you need the
“Password Auto-learn and Stored Password Proxy” features of IDENTIKEY
Authentication Server or the PSM Password Synchronization Manager
This can be a disadvantage. When you move a user in LDAP the user will be
deleted in one OU and recreated in the OU it is moved to. When the user has a
DIGIPASS assigned manual intervention will be needed to move the DIGIPASS and
reassign it.
As stated before the LDAP sync can be used once to create the users, or can be
scheduled to run regularly.
Once the user is created in LDAP, DUR can be used, the user can log in. When
using LDAP sync the user will be created after LDAP sync has run. Depending on
the schedule this can take a while.
As the LDAP sync is an independent tool, every time it will run it will consume CPU
and memory, even if there are no users changed in the LDAP.
All actions (read/update/create/delete) are logged in the audit. Therefore the audit
log can grow rapidly especially if there are large numbers of users in the LDAP
directory and/or the LDAP sync is scheduled to run frequently.
With the LDAP sync you can assign a DIGIPASS automatically when the Serial
number is stored in a synced LDAP field and the DIGIPASS is available in the pool
With DUR auto assignment can be used. When the user is created a non-assigned
DIGIAPSS from the pool is assigned to the user.
As you can see DUR is using fewer resources, and is therefore preferred when it can
do the job.
LDAP sync is better suited when Virtual Digipass is used and the phone or email is
needed.
LDAP sync can also be used to initially create all the users with their attributes.
Applies to: IDENTIKEY Authentication Server 3.4
KB 150094– 30/01/2013
2013 VASCO Data Security. All rights reserved.
Page 2 of 2
">
