VASCO DIGIPASS Authentication User Manual

INTEGRATION GUIDE
General Radius Config
DIGIPASS Authentication
Disclaimer
Disclaimer of Warranties and Limitation of Liabilities
All information contained in this document is provided 'as is'; VASCO Data Security assumes no
responsibility for its accuracy and/or completeness.
In no event will VASCO Data Security be liable for damages arising directly or indirectly from any
use of the information contained in this document.
Copyright
Copyright © 2010 VASCO Data Security, Inc, VASCO Data Security International GmbH. All
®
logo
rights reserved. VASCO®, Vacman ®, IDENTIKEY®, aXsGUARD™™, DIGIPASS® and
are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data
Security International GmbH in the U.S. and other countries. VASCO Data Security, Inc.
and/or VASCO Data Security International GmbH own or are licensed under all title, rights and
interest in VASCO Products, updates and upgrades thereof, including copyrights, patent
rights, trade secret rights, mask work rights, database rights and all other intellectual and
industrial property rights in the U.S. and other countries. Microsoft and Windows are
trademarks or registered trademarks of Microsoft Corporation. Other names may be
trademarks of their respective owners.
1
DIGIPASS Authentication
DIGIPASS Authentication
Table of Contents
Disclaimer ...................................................................................................................... 1
Table of Contents ........................................................................................................... 2
Reference guide ............................................................................................................. 3
1
Introduction.............................................................................................................. 4
2
setup......................................................................................................................... 4
3
Basic Identikey configuration ................................................................................... 5
3.1
IDENTIKEY Server ................................................................................................. 5
3.1.1
Policies .......................................................................................................... 5
3.1.2
Client ............................................................................................................ 6
3.1.3
User .............................................................................................................. 6
3.1.4
DIGIPASS ...................................................................................................... 7
3.2
Test the Solution ................................................................................................... 9
4
FAQ ......................................................................................................................... 10
5
Appendix ................................................................................................................. 10
2
DIGIPASS Authentication
DIGIPASS Authentication
Reference guide
ID
3
Title
DIGIPASS Authentication
Author
Publisher
Date
ISBN
DIGIPASS Authentication
1
Introduction
This is a general document which will help to configure your device for One Time Password
authentication in combination with Identikey Authentication Server using RADIUS.
RADIUS is a standard authentication protocol used in most security appliances and products.
The Identikey Authentication Server is installed with RADIUS protocol enabled on the standard
ports:
•
•
Authentication:
Accounting:
1812
1813
This can be changed in the Identikey configuration if necessary.
2
setup
Topology
To configure the source device please consult your device documentation for RADIUS
authentication
Server configuration info:
IP address of source device
Shared Secret
Authentication Port
Accounting Port
[IP address of source device]
[Shared Secret]
1812
1813
In order to test the Identikey Authentication Server a test user needs to be created. That user
needs to be added in the Identikey Authentication Server and linked to a Digipass.
User configuration info:
Username
4
DIGIPASS Authentication
[Test username]
DIGIPASS Authentication
3
Basic Identikey configuration
3.1
IDENTIKEY Server
There are lots of possibilities when using IDENTIKEY Server for what concerns the source of
users. We can authenticate with:
Local users (Defined in IDENTIKEY Server)
Active Directory (Windows) or general LDAP based repositories.
•
•
In this whitepaper we will use Local users to authenticate.
3.1.1
Policies
In the Policy the behavior of the authentication is defined. It gives all the answers on: I have got
a user and a password, what now?
•
Create a new Policy
•
•
Policy ID : Test
Inherits From: Base Policy
Inherits means: The new policy will have the same behavior as the policy from which he
inherits, except when otherwise specified in the new policy.
Example:
Base
Policy
1
2
3
4
5
a
b
c
d
e
New
Policy
f
g
Behaviour
New policy will do a
New policy will do b
New policy will do f
New policy will do d
New policy will do g
The new policy is created, now we are going to edit it.
•
5
Click edit
DIGIPASS Authentication
DIGIPASS Authentication
Local Authentication : Digipass/Password
Click Save
•
•
3.1.2
Client
In the clients we specify the location from which IDENTIKEY Server will accept requests and
which protocol they use.
We are going to add a new RADIUS client.
Client Type : select Radius Client from “select from list”
Location : [IP address of source device]
Policy ID : Select the Policy that was created in Policies
Protocol ID: RADIUS
Shared Secret: [Shared Secret]
Confirm Shared Secret: [Shared Secret]
Click Save
•
•
•
•
•
•
•
3.1.3
User
We are going to create a user.
6
DIGIPASS Authentication
DIGIPASS Authentication
User ID: [Test username]
•
3.1.4
DIGIPASS
The purpose of using IDENTIKEY Server, is to be able to log in using One Time Passwords (OTP).
To make it possible to use OTP we need to assign a DIGIPASS to the user. The Digipass is a
device that generates the OTP’s.
7
•
•
Open the user by clicking on its name
Select Assigned Digipass
•
Click ASSIGN
•
Click Next
DIGIPASS Authentication
DIGIPASS Authentication
8
•
Grace period: 0 Days
•
Grace period is the period that a user can log in with his static password. The first time
the user uses his DIGIPASS the grace period will expire.
Click ASSIGN
•
Click Finish
DIGIPASS Authentication
DIGIPASS Authentication
3.2
Test the Solution
The configuration can be tested by tying to login with [Test username] and an OTP from the
assigned Digipass.
9
DIGIPASS Authentication
DIGIPASS Authentication
4
5
10
FAQ
Appendix
DIGIPASS Authentication
">