VASCO Pack for Citrix DIGIPASS Authentication Integration Guideline

DIGIPASS Authentication for
Citrix XenDesktop
Web Interface
With VASCO DIGIPASS Pack for Citrix
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008Integration
VASCO Data Security.
All rights reserved.
Guideline
Page 1 of 44
Disclaimer
Disclaimer of Warranties and Limitations of Liabilities
This Report is provided on an 'as is' basis, without any other warranties, or conditions.
No part of this publication may be reproduced, stored in a retrieval system, or
transmitted, in any form or by any means, electronic, mechanical, photocopying,
recording, or otherwise, without the prior written permission of VASCO Data Security.
Trademarks
DIGIPASS & VACMAN are registered trademarks of VASCO Data Security. All
trademarks or trade names are the property of their respective owners. VASCO
reserves the right to make changes to specifications at any time and without notice.
The information furnished by VASCO in this document is believed to be accurate and
reliable. However, VASCO may not be held liable for its use, nor for infringement of
patents or other rights of third parties resulting from its use.
Copyright
© 2006 VASCO Data Security. All rights reserved.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 2 of 44
Table of Contents
DIGIPASS Authentication for Citrix XenDesktop 2.0 Web Interface................ 1 Disclaimer ...................................................................................................... 2 Table of Contents............................................................................................ 3 1 Overview ................................................................................................... 5 2 Problem Description.................................................................................. 5 3 Solution .................................................................................................... 5 4 Technical Concept ..................................................................................... 6 5 6 7 4.1 General overview ................................................................................. 6 4.2 Citrix prerequisites ............................................................................... 6 4.3 VACMAN Middleware Prerequisites .......................................................... 6 DIGIPASS Pack for Citrix .......................................................................... 7 5.1 Installation .......................................................................................... 7 5.2 DIGIPASS Pack for Citrix configuration .................................................. 11 5.2.1 Quick configuration ....................................................................... 11 5.2.2 Step by step configuration ............................................................. 11 5.3 User Rights configuration..................................................................... 13 5.4 Environment variable configuration ....................................................... 16 5.5 IIS configuration ................................................................................ 17 VACMAN Middleware ............................................................................... 22 6.1 Policy configuration ............................................................................ 22 6.2 Component configuration..................................................................... 24 User configuration .................................................................................. 25 7.1 ODBC installation ............................................................................... 25 7.1.1 User creation ............................................................................... 25 7.1.2 Import DIGIPASS ......................................................................... 27 7.1.3 DIGIPASS Assignment................................................................... 29 DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 3 of 44
7.2 8 Active Directory installation ................................................................. 31 7.2.1 User creation ............................................................................... 31 7.2.2 Import DIGIPASS ......................................................................... 33 7.2.3 DIGIPASS assignment ................................................................... 35 Test the Web Interface Login .................................................................. 37 8.1 Response Only ................................................................................... 37 8.2 Challenge / Response.......................................................................... 38 9 VACMAN Middleware features ................................................................. 40 9.1 9.1.1 Support for Windows 2000, 2003, IIS5 and IIS6 ............................... 40 9.1.2 Support for ODBC databases and Active Directory ............................. 40 9.2 Deployment ....................................................................................... 40 9.2.1 Dynamic User Registration (DUR) ................................................... 40 9.2.2 Autolearn Passwords ..................................................................... 40 9.2.3 Stored Password Proxy.................................................................. 40 9.2.4 Authentication Methods ................................................................. 40 9.2.5 Policies ....................................................................................... 41 9.2.6 DIGIPASS Self Assign ................................................................... 41 9.2.7 DIGIPASS Auto Assign .................................................................. 41 9.2.8 Grace Period ................................................................................ 41 9.2.9 Virtual DIGIPASS.......................................................................... 41 9.3 10 Installation ........................................................................................ 40 Administration ................................................................................... 42 9.3.1 Active Directory Users and Computers Extensions ............................. 42 9.3.2 Administration MMC Interface ........................................................ 42 9.3.3 User Self Management Web Site ..................................................... 43 9.3.4 Delegated administration ............................................................... 43 9.3.5 Granular access rights................................................................... 43 About VASCO Data Security .................................................................. 44 DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 4 of 44
1 Overview
The purpose of this document is to demonstrate how to configure the DIGIPASS Pack
for Citrix with the Citrix XenDesktop Web Interface.
The Citrix XenDesktop can be best described as a virtual desktop delivery. The
desktops can be randomly pooled and renewed every time. Or it can be assigned to a
specific user and store all settings for the user.
2 Problem Description
The Citrix XenDesktop Web Interface still uses static passwords to authenticate a user.
As this package assures you a safe environment, the authentication should be safe
too.
3 Solution
Figure 1: Solution
After configuring the Web Interface in the right way, you eliminate the weakest link in
any security infrastructure – the use of static passwords – that are easily stolen
guessed, reused or shared.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 5 of 44
4 Technical Concept
4.1
General overview
The DIGIPASS Pack for Citrix has to be installed on the machine that has the Web
Interface installed for your XenDesktop installation. In most cases this will be on the
server that contains the Desktop Delivery Components.
4.2
Citrix prerequisites
Please make sure you have a working setup of Citrix XenDesktop. It is very important
this is working correctly before you start implementing the DIGIPASS Pack for Citrix.
Figure 2: Citrix prerequisites (2)
4.3
Figure 3: Citrix prerequisites (2)
VACMAN Middleware Prerequisites
In this guide we assume you already have VACMAN Middleware 3.0 (VM) installed and
working. If this is not the case, make sure you get VM working before installing any
other features.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 6 of 44
5 DIGIPASS Pack for Citrix
5.1
Installation
You can start the installation from CD. If you didn’t get a CD, you may download the
files you need at http://www.VASCO.com/citrix. Here you can find the VACMAN
Middleware and the DIGIPASS Pack for Citrix.
Start the Installation of the DIGIPASS Pack for Citrix.
Read the license agreement, to continue you have to press the “I agree” button
Figure 4: Setup - License Agreement
Following, you have to enter your serial number. If you only want to test the
installation, then tick the “Use an evaluation license” box and click Next.
Figure 5: Setup – Customer information
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 7 of 44
Specify the IP address of the Authentication Server of VACMAN Middleware. If you
are using the Active Directory storage, choose this option. If you are using the initial
database (PostgreSQL) or any other database, select ODBC-compliant database.
Click Next to continue.
Figure 6: Setup – Connection details
In case of the ODBC database, give the admin account to automatically create the
component in the data store of the authentication server, click Next to continue.
In case of the Active Directory option, you will have to specify a user with
administrative privileges on the domain.
Figure 7: Setup – Administrator login details
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 8 of 44
Choose an installation directory. Default “C:\Program Files\VASCO\DIGIPASS Pack
for Citrix Web Interface\” is used. Click Next to continue.
Figure 8: Setup – Select directory
The installation process will now start, adding also the IIS extension.
Figure 9: Setup – Installation progress
When the installation has finished, click Next to go on.
Figure 10: Setup – Installation finished
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 9 of 44
If you need a new license, choose to go to the activation page. Otherwise you can
instantly load a file you saved before, or continue without adding a license. If you
request a new license from the VASCO website, an input screen will be available to
point to your recently downloaded license file.
Figure 11: Setup – License file
When the installation is finished, it is necessary to restart the operating system.
Figure 12: Setup – Restart required
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 10 of 44
5.2
DIGIPASS Pack for Citrix configuration
The DIGIPASS Pack for Citrix expects to find a Web Interface installed belonging to
the Citrix Access Suite. So we have to change a few settings to let it work with the
Citrix XenDesktop Web Interface.
If you know what to change, you can find a quick configuration sheet below.
Otherwise you can follow the guide at 5.2.2 Step by step configuration.
5.2.1
Quick configuration
Configuration
parameter
Value
Login Submit URL
/Citrix/DesktopWeb/auth/login.aspx
Failed Login URL
/Citrix/DesktopWeb/auth/login.aspx?NFuse_MessageType=ERROR
&NFuse_MessageKey=InvalidCredentials&
Username field
user
Password field
password
Domain field
domain
5.2.2
Step by step configuration
Open the DIGIPASS Pack for Citrix Web Interface Configuration. On the authentication
tab, select the site “Citrix Web Interface 2.x” and click Edit.
Figure 13: DIGIPASS Pack configuration
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 11 of 44
Here, you can use the configuration table as found in 5.2.1 Quick Configuration
table to fill up all the necessary fields.
Figure 14: Citrix Web Interface
details (1)
Figure 15: Citrix Web Interface
details (2)
In the General tab, you can activate Full Tracing. This will enable detailed logging
information, assisting you with the troubleshooting and configuration kit.
Figure 16: Enable tracing
To be able to see if everything went good so far, it is best to restart the IIS service.
This is most easily done by running the “iisreset” command in the Start - Run menu.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 12 of 44
5.3
User Rights configuration
To allow the IIS6 module access to the trace file, the Log folder has to be writeable.
Right-click on the “Log” folder and select Properties.
Figure 17: Log folder properties
Go to the Security tab and select the Internet Guest Account. Tick the Allow Full
Control checkbox. Click Apply when done.
Figure 18: User rights of Internet Guest Account
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 13 of 44
Select the IIS_WPG account and make sure it has Read and Write access.
Figure 19: User rights of IIS_WPG
Next, go to the Bin folder in the installation directory. Find the file vmextcfg.xml.
Right-click and go to the Properties.
Figure 20: Bin folder properties
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 14 of 44
At the Security tab, give the Internet Guest Account: Allow Full Control. Click Apply.
Figure 21: User rights of Internet Guest Account
The IIS_WPG account needs only read access here.
Figure 22: User rights of IIS_WPG
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 15 of 44
5.4
Environment variable configuration
Right-click My Computer, select Properties. Go to the Advanced tab, and click the
Environment Variables button
Figure 23: Environment Variables
In the system variable list make sure the VMMIModuleDirectory is present. If the
variable is not present, add it and set the value to the installation directory.
Figure 24: List of Environment Variables
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 16 of 44
5.5
IIS configuration
In the Administration tools, open the IIS Manager. Check the Web Service
Extensions for the entry “VM IIS6 Extension”.
If this is not present, right-click the Web Service Extensions and select “Add a new
Web service extension…”.
Figure 25: Add a new web service extension (1)
In the Extension name, fill in: “VM IIS6 Extension”. Afterwards click Add and go to
the Bin folder in the installation folder.
Figure 26: Add a new web service extension (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 17 of 44
Select the vmiisext.dll file and click OK
Figure 27: Add a new web service extension (3)
Make sure you tick the “Set extension status to Allowed” selection and click OK.
Figure 28: Add a new web service extension (4)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 18 of 44
Right-click the DesktopWeb virtual folder under the Default Web Site and select
Properties.
Figure 29: Add a new web service extension (5)
Click the Configuration button.
Figure 30: Add a new web service extension (6)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 19 of 44
At the Wildcard application maps, click the Insert button.
Figure 31: Add a new web service extension (7)
Click the Browse button.
Figure 32: Add a new web service extension (8)
Go to the Bin directory of the installation folder and select the vmissext.dll file.
Afterwards click Open.
Figure 33: Add a new web service extension (9)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 20 of 44
Click OK to add the extension to the wildcard application map. Click OK twice until all
properties screens are closed.
Figure 34: Add a new web service extension (10)
To register all changes, restart IIS by running “iisreset” in the Start – Run menu.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 21 of 44
6 VACMAN Middleware
6.1
Policy configuration
Setting up the VM only requires you to set up a policy to go to the right back-end and
to add an extra Radius component pointing to the ISA server.
To add a new policy, right-click Policies and choose New Policy.
Figure 35: VM configuration (1)
There are a few policies available by default. You can also create new policies to suit
your needs. Those can be independent policies, inherit or copy their settings from
default or other policies.
Fill in a policy name and choose the option most suitable in your situation. If you
want the policy to inherit setting from another policy, choose the inherit option. If you
want to copy an existing policy, choose the copy option and if you want to make a new
one, choose the create option.
Figure 36: VM configuration (2)
We chose to create a new policy and specify all details about the authentication policy.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 22 of 44
In the policy properties configure it to use the right back-end server. This could be
the local database, but also Windows (Active Directory) or another radius server
(RADIUS).
This could the same authentication service as you were previously using in the ISA
server.
Main Settings tab
Local auth.:
Back-End Auth.:
Back-End Protocol:
User Settings tab
Dynamic User Registration:
Password Autolearn:
Stored Password Proxy:
Windows Group Check:
Challenge Settings tab
2-Step Challenge Response
Primary Virtual DIGIPASS
Digipass/Password
If Needed
Windows
Yes
Yes
Yes
No Check
None
None
After configuring this Policy, the authentication will happen, if needed (when it does
not know the user locally), in the back-end to Active Directory. User credentials are
passed through to the VM, it will check these credentials with the AD and will answer
to the ISA server with an Access-Accept or Access-Reject RADIUS message.
Figure 37: VM
configuration (3)
Figure 38: VM
configuration (4)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Figure 39: VM
configuration (5)
Page 23 of 44
6.2
Component configuration
For testing purposes you can change the existing RADIUS Client (default RADIUS
client that listens for all connections) by right-clicking and choose Properties.
If you already use the default RADIUS client, it would be better to create a new
RADIUS component.
Figure 40: VM configuration (6)
In the policy field you should find your newly created policy. Fill in the shared
secret you entered also in the RADIUS server properties on the ISA server. Click
Create.
Figure 41: VM configuration (7)
All configuration is done by now. The next chapter shows you how to add a user
manually. In our policy we enabled the Dynamic User Recognition (DUR). So users
who get verified through the Active Directory, and are not known in the local
database, are automatically added. It also shows how to assign a DIGIPASS to a user.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2008 VASCO Data Security. All rights reserved.
Page 24 of 44
7 User configuration
The user creation steps you will find in this chapter are optional when you didn’t
activate the option Dynamic User Registration (DUR) and/or Password
Autolearn in your policy settings.
The assignment of a DIGIPASS can happen manually as explained in the steps below.
The user creation and DIGIPASS assignment steps depend on which database backend you installed VACMAN Middleware. Either you installed it with an ODBC back-end
or with an Active Directory back-end.
7.1
7.1.1
ODBC installation
User creation
User creation, while using an ODBC back-end, will happen in the DIGIPASS
Administration MMC. Right-click the Users folder and select New User ....
Figure 42: ODBC User Creation (1)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 25 of 44
Fill in the username and password fields. Optionally choose the right domain and
Organizational Unit and click the Create button.
Figure 43: ODBC User Creation (2)
The user will now show up in the Users list of you DIGIPASS Administration MMC. At
this point it will be exactly the same as when Dynamic User Recognition (DUR) was
enabled.
Figure 44: ODBC User Creation (3)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 26 of 44
7.1.2
Import DIGIPASS
Right-click the DIGIPASS folder and select Import DIGIPASS... .
Figure 45: Import DIGIPASS (1)
Browse for your *.DPX file, fill in the Transport Key and look at your available
applications by pushing the Show Applications button. You can either import all
applications or only the ones you selected, by the Import … buttons above and below
the Show Applications button.
Figure 46: Import DIGIPASS (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 27 of 44
When the DIGIPASS is imported successfully you will receive a confirmation message.
Figure 47: Import DIGIPASS (3)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 28 of 44
7.1.3
DIGIPASS Assignment
There are two possible ways to assign a DIGIPASS to a user. You can search for a
DIGIPASS and assign it to a user or you can search for a user and assign it to a
DIGIPASS. You can see the difference in the following two figures.
Right-click a user and select Assign DIGIPASS... or ...
Figure 48: DIGIPASS assignment (1)
… you can right-click a DIGIPASS and select Assign … .
Figure 49: DIGIPASS assignment (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 29 of 44
If you leave the User ID blank and press the Find button, you will get a list of all the
available users in the same domain as the DIGIPASS. The usernames are partly
searchable too.
Notice: If no users show up, make sure the domains of the DIGIPASS and the user
match.
Figure 50: DIGIPASS assignment (3)
When assigning a DIGIPASS to a user the same procedure will be applicable. You can
either select the desired option to search for a DIGIPASS or search through serial
number. Leaving all options blank will show all possibilities in the same domain.
When the DIGIPASS gets successfully added to your user you will get a confirmation
message.
Figure 51: DIGIPASS assignment (4)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 30 of 44
7.2
7.2.1
Active Directory installation
User creation
User creation, while using an Active Directory back-end, will happen in the Active
Directory Users and Computers MMC. Right-click a user and select Properties.
This can happen automatically when the Dynamic User Registration (DUR) option in
the policy settings is active.
Figure 52: Active Directory User Creation (1)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 31 of 44
In the DIGIPASS User Account tab you will see a field to manually add a password.
This can also be automatically filled by enabling the Password Autolearn option in the
policy settings.
Figure 53: Active Directory User Creation (2)
After clicking the Apply button you will see the Update History fields being filled with
the current date and time. When these fields are filled it means the DIGIPASS account
exists and can be used.
Figure 54: Active Directory User Creation (3)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 32 of 44
7.2.2
Import DIGIPASS
To make sure you can see the DIGIPASS folders in the MMC, go to View and select
the Advanced Features. This way you will see the DIGIPASS folders.
Figure 55: Import DIGIPASS (1)
Right-click the DIGIPASS-Pool folder and select Import DIGIPASS … .
Figure 56: Import DIGIPASS (1)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 33 of 44
Browse for your *.DPX file, fill in the Transport Key and look at your available
applications by pushing the Show Applications button. You can either import all
applications or only the ones you selected, by the Import … buttons above and below
the Show Applications button.
Figure 57: Import DIGIPASS (1)
When the DIGIPASS is imported successfully you will receive a confirmation message.
Figure 58: Import DIGIPASS (1)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 34 of 44
7.2.3
DIGIPASS assignment
There are two possible ways to assign a user to a DIGIPASS. You can search for a
DIGIPASS and assign it to a user or you can search for a user and assign it to a
DIGIPASS. You can see the difference in the following two figures.
Right-click a User and select Assign DIGIPASS... or ...
Figure 59: DIGIPASS Assignment (1)
… right-click a DIGIPASS and select Assign DIGIPASS … .
Figure 60: DIGIPASS Assignment (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 35 of 44
If you leave the User ID blank and press the Find button, you will get a list of all the
available users in the same domain as the DIGIPASS. The usernames are partly
searchable too.
Figure 61: DIGIPASS Assignment (4)
When assigning a DIGIPASS to a user the same procedure will be applicable. You can
either select the desired option to search for a DIGIPASS or through serial number.
Leaving all options blank will show you all possibilities. Remember to check the
“Search upwards …” checkbox.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 36 of 44
8 Test the Web Interface Login
Go to the Web Interface of your Citrix XenDesktop installation.
http://vDesktopDDC2.XenDT.net/Citrix/DesktopWeb/
8.1
Response Only
Figure 62: Response Only (1)
If everything goes well, you will be authenticated and the desktop connection will be
made.
Figure 63: Response Only (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 37 of 44
8.2
Challenge / Response
For the challenge response test, enter your Name and Password (challenge/response
trigger). Click the Login button.
In our case the challenge/response trigger is the user’s static password.
Figure 64: Challenge / Response (1)
You will be presented with a DP300 Challenge code. Use a pin pad enabled
DIGIPASS to enter the challenge and calculate the response. Enter the response in
the Answer field and click OK.
Figure 65: Challenge / Response (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 38 of 44
If everything goes well, you will be authenticated and the Citrix applications will be
show.
Figure 66: Challenge / Response (3)
If something went wrong, you can always check the *.trace file for detailed logging
information.
It is better to turn off the detailed logging when you use VACMAN Middleware in
production. There will be more system recourses available when detailed logging is
turned off.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 39 of 44
9 VACMAN Middleware
features
9.1 Installation
The VACMAN Middleware (VM) installation is very easy and straightforward. VM runs
on Windows platforms, supports a variety of databases and uses an online
registration. Different authentication methods allow a seamless integration into
existing environments.
9.1.1
Support for Windows 2000, 2003, IIS5 and IIS6
VM can be installed on Windows 2000 and Windows 2003. Web modules exist for IIS5
and IIS 6 to protect Citrix Web Interface, Citrix Secure Gateway, Citrix Secure Access
Manager (Form-based authentication), Citrix Access Gateway and Microsoft Outlook
Web Access 2000 and 2003 (Basic Authentication and Form-Based Authentication).
9.1.2
Support for ODBC databases and Active Directory
Any ODBC compliant database can be used instead of the default PostgreSQL database
(MS SQL Server, Oracle). Since Version 2.3 of VACMAN Middleware, AD is not only
intended for storage of DIGIPASS anymore, but configuration and management of
your DIGIPASS infrastructure is now also full integrated into the AD management
tools. This option requires an AD schema update.
9.2 Deployment
Several VACMAN Middleware features exist to facilitate deployment. Combining these
features provides different deployment scenarios from manual to fully automatic.
9.2.1
Dynamic User Registration (DUR)
This feature allows VM to check a username and password not in the database with a
back-end RADIUS server or a Windows domain controller and, if username and
password are valid, to create the username in the VM database.
9.2.2
Autolearn Passwords
Saves administrators time and effort by allowing them to change a user’s password in
one location only. If a user tries to log in with a password that does not match the
password stored in the VM database, VM can verify it with the back-end RADIUS
server or the Windows domain controller and, if correct, store it for future use.
9.2.3
Stored Password Proxy
Allows VM to save a user’s RADIUS server password or Windows domain controller
password in the database (static password). User’s can then log in with only username
and dynamic one-time password (OTP). If this feature is disabled, users must log in
with username and static password immediately followed by the OTP.
9.2.4
Authentication Methods
Different authentication methods can be set on server level and on user level: local
authentication (VM only), Back-End authentication (Windows or RADIUS). On top of
that a combination of local and back-end can be configured. The additional parameters
‘always’, ‘if needed’ and ‘never’ offers you additional customization of the back-end
authentication process.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 40 of 44
The configuration of authentication methods is done within the policy (policies).
9.2.5
Policies
Policies specify various settings that affect the User authentication process. Each
authentication request is handled according to a Policy that is identified by the
applicable Component record. Components can be radius clients, authentication
servers or Citrix web interfaces.
9.2.6
DIGIPASS Self Assign
Allows users to assign DIGIPASS to themselves by providing the serial number of the
DIGIPASS, the static password and the OTP.
9.2.7
DIGIPASS Auto Assign
Allows automatic assignment of the first available DIGIPASS to a user on user
creation.
9.2.8
Grace Period
Supplies a user with a certain amount of time (7 days by default) between assignment
of a DIGIPASS and the user being required to log in using the OTP. The Grace Period
will expire automatically on first successful use of the DIGIPASS.
9.2.9
Virtual DIGIPASS
Virtual DIGIPASS uses a text message to deliver a One Time Password to a User’s
mobile phone. The User then logs in to the system using this One Time Password.
Primary Virtual DIGIPASS
A Primary Virtual DIGIPASS is handled similarly to a standard physical DIGIPASS. It is
imported into the VACMAN Middleware database, assigned to a User, and treated by
the VACMAN Middleware database as any other kind of DIGIPASS.
Backup Virtual DIGIPASS
The Backup Virtual DIGIPASS feature simply allows a User to request an OTP to be
sent to their mobile phone. It is not treated as a discrete object by VACMAN
Middleware, and is not assigned to Users, only enabled or disabled. It can be enabled
for Users with another type of DIGIPASS already assigned, and used when the User
does not have their DIGIPASS available.
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 41 of 44
9.3
9.3.1
Administration
Active Directory Users and Computers Extensions
Since VACMAN Middleware version 2.3, Managing the users and DIGIPASS can be
done within the Active Directory Users and Computers section. Selecting the
properties of a user, offers complete User-DIGIPASS management.
Figure 67: VM Features (1)
9.3.2
Administration MMC Interface
A highly intuitive Microsoft Management Console (MMC) exists to administer the
product. An Audit Console is available to give an instant view on all actions being
performed on the VM. Both can be installed on the VM server itself or on a separate
PC.
Figure 68: VM Features (2)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 42 of 44
9.3.3
User Self Management Web Site
A web site running on IIS has been developed to allow users to register themselves to
the VM with their username and back-end (RADIUS or Windows) password, to do a
DIGIPASS self assign, to update their back-end password stored in the VM database,
to do a change PIN (Go-1/Go-3 DIGIPASS), to do a DIGIPASS test.
Figure 69: VM Features (3)
9.3.4
Delegated administration
Administration can be delegated by appointing different administrators per
organizational unit (OU). These administrators can only see the DIGIPASSes and users
that were added to his OU.
9.3.5
Granular access rights
It is possible in VACMAN Middleware to setup different permission per user. This can
be in function of a domain or an organizational unit. Administrators belonging to the
Master Domain may be assigned administration privileges for all domains in the
database, or just their own domain. Administrators belonging to any other Domain will
have the assigned administration privileges for that Domain only.
It’s possible to set different operator access levels.
E.g. A user can be created that only has the rights to unlock a DIGIPASS.
Figure 70: VM Features (4)
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 43 of 44
10 About VASCO Data Security
VASCO designs, develops, markets and supports patented Strong User Authentication
products for e-Business and e-Commerce.
VASCO’s User Authentication software is carried by the end user on its DIGIPASS
products which are small “calculator” hardware devices, or in a software format on
mobile phones, other portable devices, and PC’s.
At the server side, VASCO’s VACMAN products guarantee that only the designated
DIGIPASS user gets access to the application.
VASCO’s target markets are the applications and their several hundred million users
that utilize fixed password as security.
VASCO’s time-based system generates a “one-time” password that changes with every
use, and is virtually impossible to hack or break.
VASCO designs, develops, markets and supports patented user authentication
products for the financial world, remote access, e-business and e-commerce. VASCO’s
user authentication software is delivered via its DIGIPASS hardware and software
security products. With over 25 million DIGIPASS products sold and delivered, VASCO
has established itself as a world-leader for strong User Authentication with over 500
international financial institutions and almost 3000 blue-chip corporations and
governments located in more than 100 countries
DIGIPASS Authentication for Citrix XenDesktop - Integration Guideline V1.0
© 2006 VASCO Data Security. All rights reserved.
Page 44 of 44
">