VASCO IDENTIKEY Appliance Administrator Reference

13. Error and Status Codes

13.2. DIGIPASS Authentication for Windows Logon Error Messages

13.3. VACMAN Controller Error Codes

13.4. Console Wizard Error Codes

IDENTIKEY Appliance 3.11.12 - Administrator Reference

Table of Contents

14.1. Tracing Message Types

14.2. Tracing Levels

14.3. Tracing Messages

15. Support Procedure

Table of Contents

IDENTIKEY Appliance 3.11.12 - Administrator Reference

Table Index

Table 1: Backup and Restore Fields

Table 2: System Fields

Table 3: Authentication Fields

Table 4: Network Fields

Table 5: SNMP Fields

Table 6: Logging Fields

Table 7: Notification Settings Fields

Table 8: Notification Filter Fields

Table 9: Notification Target Fields

Table 10: Configtool Fields

Table 11: Certificates Fields

Table 12: IDENTIKEY Authentication Server General Settings Fields

Table 13: IDENTIKEY Authentication Server SEAL Configuration Fields

Table 14: IDENTIKEY Authentication Server SOAP Configuration Fields

Table 15: IDENTIKEY Authentication Server RADIUS Configuration Fields

Table 16: IDENTIKEY Authentication Server Back-End Settings Fields

Table 17: IDENTIKEY Authentication Server Discovery Fields

Table 18: IDENTIKEY Authentication Server Audit Fields

Table 19: IDENTIKEY Authentication Server Tracing Fields

Table 20: IDENTIKEY Authentication Server Performance Monitoring Fields

Table 21: System Monitoring Settings Fields

Table 22: System Monitoring Target Fields

Table 23: System Monitoring Filter Fields

Table 24: Message Delivery Component Fields

Table 25: SMS Server Fields

Table 26: SMPP Server Fields

Table 27: SMTP Server Fields

Table 28: Voice Server Fields

IDENTIKEY Appliance 3.11.12 - Administrator Reference

Table of Contents

Table 29: IDENTIKEY Authentication Server LDAP User Synchronization: General Fields

Table 30: IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Filter Fields

Table 31: IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Mapping Fields

Table 32: Cryptographic Protocols Supported in Different Cipher Suite Security Levels

Table 33: Default SSL Cipher Suite Security Levels for Communication Interfaces

Table 34: Overview of Cipher Suites in the Web Administration Service

Table 35: User - Dashboard

Table 36: User - User Account

Table 37: User - Policy Overrides

Table 38: User - Offline Authentication

Table 39: User - Recent Activity

Table 40: User - Further User Fields

Table 41: User Attribute Fields

Table 42: Default Reports

Table 43: Administrative Privileges – ODBC Data Store

Table 44: Find/Manage DIGIPASS Criteria

Table 45: DIGIPASS – DIGIPASS

Table 46: DIGIPASS – License Information

Table 47: DIGIPASS – Activation Information (Standard Activation and Licensing)

Table 48: DIGIPASS – Activation Information (Multi-Device Activation and Multi-Device Licensing)

Table 49: DIGIPASS – Recent Activity

Table 50: DIGIPASS Application Fields

Table 51: Audit Message

Table 52: Policy Properties - Policy

Table 53: Policy Properties - User

Table 54: Policy Properties – DIGIPASS

Table 55: Challenge Policy Fields

Table 56: Secure Channel Policy Fields

Table 57: Virtual DIGIPASS Policy Fields

IDENTIKEY Appliance 3.11.12 - Administrator Reference

Table of Contents

vii

Table 58: DIGIPASS Control Parameters

Table 59: Offline Authentication

Table 60: Password Randomization

Table 61: Dynamic Component Registration

Table 62: RADIUS

Table 63: Pre-Loaded Policies

Table 64: Client Fields

Table 65: License Fields

Table 66: RADIUS Fields

Table 67: SOAP Fields

Table 68: RADIUS Back-End Server Fields

Table 69: Microsoft Active Directory Back-End Server Fields

Table 70: NetIQ eDirectory Back-End Server Fields

Table 71: Back-End Server Settings Fields

Table 72: Organizational Unit Fields

Table 73: Report Fields

Table 74: Global Configuration – Auditing

Table 75: Global Configuration – MDC Virtual DIGIPASS Message Settings

Table 76: Global Configuration – MDC Virtual Signature Message Settings

Table 77: Global Configuration – MDC Offline Activation Data Message Settings

Table 78: Global Configuration – MDC DP Activation Delayed

Table 79: Global Configuration – MDC DP Activation Completed

Table 80: Message Template Placeholders

Table 81: Server List – Summary

Table 82: Supported User Logon Format for Microsoft Active Directory

Table 83: Supported User Logon Format for NetIQ eDirectory

Table 84: User Field List

Table 85: DIGIPASS field list

Table 86: Audit field list

IDENTIKEY Appliance 3.11.12 - Administrator Reference

Table of Contents

viii

Table 87: Performance Monitoring CSV output file format

Table 88: SNMP Traps - Parameters

Table 89: MIB Table

Table 90: Login Permutations - Response-OnlyCleartext Separate

Table 91: Login Permutations - Response-Only Separate

Table 92: Login Permutations - Response-Only CHAP/MSCHAP/MSCHAP2

Table 93: Login Permutations – 2-Step Challenge/Response Cleartext Separate

Table 94: Login Permutations – Virtual DIGIPASS

Table 95: Incoming Ports used by IDENTIKEY Appliance

Table 96: Outgoing Ports used by IDENTIKEY Authentication Server

Table 97: Audit Message Types

Table 98: Audit Messages

Table 99: Audit Messages (specific to IDENTIKEY Applianceonly)

Table 100: Error Code List

Table 101: DIGIPASS Authentication for Windows Logon Error Messages

Table 102: VACMAN Controller Error Codes – Authentication and Administration

Table 103: VACMAN Controller Error Codes - DIGIPASS record import

Table 104: Console Wizard Error Codes

Table 105: Status Codes List

Table 106: Tracing Message Types

Table 107: Tracing Message Levels

Table 108: Tracing Message Contents

Table of Contents

IDENTIKEY Appliance 3.11.12 - Administrator Reference

1. Introduction

IDENTIKEY Appliance Administrator Reference is part of the documentation set about IDENTIKEY Appliance . It provides field explanations and other organized reference material for technical experts using IDENTIKEY Appliance and is intended for reference only.

If not stated otherwise, the information in this guide also applies to IDENTIKEY Virtual Appliance.

1.1. IDENTIKEY Appliance Documentation Set

The following IDENTIKEY Appliance guides are available: n n n n n n n n

IDENTIKEY Appliance Administrator Guide . Explains the steps needed for administration tasks, including monitoring and troubleshooting.

IDENTIKEY Appliance Administrator Reference . Provides field explanations and other organized reference material for technical experts using IDENTIKEY Appliance intended for reference only.

IDENTIKEY Appliance Installation and Maintenance Guide . Explains the steps required to connect the

IDENTIKEY Appliance to your network, first-time configuration and maintenance procedures, such as updating and re-licensing.

IDENTIKEY Appliance Product Guide . Describes the structure of the product, the concepts underpinning authentication and how IDENTIKEY Appliance can support authentication within an existing infrastructure.

IDENTIKEY Authentication Server SDK Programmer Guide . Provides in-depth information required for development work using the SDK. This document is relevant to SOAP Authentication, electronic signatures and provisioning using the IDENTIKEY Appliance.

Documents about DIGIPASS Authentication for Windows Logon. Provide information about the concepts, installation and configuration, setup, and procedures to test DIGIPASS Authentication for Windows Logon.

Two Password Synchronization Manager guides for installation and usage information.

Filter guides for each available filter for installation and usage information.

Access to the IDENTIKEY Appliance documentation is provided via the IDENTIKEY Appliance Configuration Tool.

Manuals for IDENTIKEY Appliance add-ons are provided on the CD-ROM delivered with the appliance.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.1. System

2.1.1. Backup & Restore

Table 1: Backup and Restore Fields

Field Name Description

Backup Encryption

Use Custom

Encryption Pass

Phrase

Check this option to provide a password for backups. All backups are encrypted, and can be restored using the administrator's default credentials. However, with this option you can provide a different password specifically for restoring backups.

Backup encryption passwords are applied to both automated and scripted backups.

Use this field to supply a custom password to decrypt encrypted backups.

Custom Encryption Pass Phrase

Confirm Confirmation of the above password.

Automatic Backups

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 1: Backup and Restore Fields (continued)

Field Name Description

Protocol For the backup server, two protocols, FTP or SFTP, are available. Select the check box of the relevant protocol to be used on the backup server. The fields to adjust the settings of the selected protocol are displayed after the protocol was selected.

FTP Authentication Settings

FTP server

FTP directory

Username

Password

SFTP Authentication Settings

SFTP server

SSH Server RSA Fingerprint

The FQDN or IP address of the FTP server

The directory of the SFTP / FTP server in which to place the backup files.

The FTP server user name

The FTP server password

SFTP directory

Authentication Method

Username

Public Key

The FQDN or IP address of the SFTP server

Enter the address of the SSH server fingerprint manually; the fingerprint should be generated by the RSA algorithm. Alternatively, you can click the

Fetch Fingerprint button (after the SFTP server has been filled in) to supply the SSH server RSA fingerprint.

The directory of the SFTP / FTP server in which to place the backup files.

Public Key: Select this method to authenticate with the public key of the SFTP user.

Password: Select this option to authenticate with a classic user name / password pair.

The SFTP server user name

The public key of the IDENTIKEY Appliance, which has to be downloaded for public key authentication when the Public Key authentication method is selected.

Generic settings

Test Settings

Schedule

Click this link to test your configuration

Set the desired schedule for the automatic backups.

Scripted Backups

Enabled Check this option to enable scripted backups. A scripted backup is intended for advanced administrators who prefer to use their own scripts to create IDENTIKEY Appliance backups. The backups can only be retrieved via HTTPS (use wget in your backup scripts).

More information is available in the IDENTIKEY Appliance Install and configuration guide.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 1: Backup and Restore Fields (continued)

Field Name Description

Username

Password

Confirm

The user who is allowed to take scripted backups

The password of the above user

Confirm the password

Allowed Networks The networks from which the user may fetch IDENTIKEY Appliance backups. Use the CIDR notation.

Test Backup Click on this link to test the currently saved configuration. If you performed any recent configuration changes, save them first before clicking the link.

2.2. Settings

2.2.1. System

Table 2: System Fields

Field Name

Settings

Hostname

Description

This is the internal name of IDENTIKEY Appliance and is used: n n to uniquely identify log lines when sent to a remote syslog server. For more information refer to the IDENTIKEY ApplianceProduct Guide , Section "Logging".

to identify an IDENTIKEY Appliance in a replication setup

Time

Time zone

NTP Servers

Each log line and audit event in the IDENTIKEY Appliance is generated with a time stamp. This time zone field determines the time-offset of the time stamp. We recommend setting the time zone to 'UTC' (= Greenwich Mean Time) for an efficient support service.

List of NTP servers used in the company network. The Network Time Protocol (NTP) is designed to synchronize the clocks of computers over a network. If multiple servers are specified, the NTP service will attempt to synchronize allservers. To provide redundancy, it is good practice to configure multiple servers. In general, best accuracy is obtained by using servers that have a low network latency.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.2.2. Authentication Settings

Table 3: Authentication Fields

Field Name Description

Sysadmin User

Enabled

Password

Clear to disable the sysadmin user.

Change the password of the sysadmin user

IDENTIKEY Authentication Server Web Administration

Share IAS Web Administration

Session

Select this option to enable session sharing between the Configuration Tool and Administration

Web Interface. If enabled, users with the Appliance Administration privilege can log in once, either to the Configuration Tool or the Administration Web Interface, to access both applications.

Selecting / clearing this option takes effect only for new sessions and does not affect existing sessions.

Rescue Users

Number of Additional Logins

Required

Rescue Users

Use this field to specify the number of credential sets required in addition to the rescue log in.

This is to protect the rescue facility, and enable only a certain set of administrators to use the features it provides. By default, the rescue login does not have a password.

Click Add Rescue User and enter the user name and password. Click Save . The number of users defined here must correspond to the number of additional logins required field above.

2.2.3. Network Settings

Table 4: Network Fields

Field Name

Address and Routing

IP Address

Description

Default Gateway

List of the IP addresses of the IDENTIKEY Appliance used to communicate within the company network. The Classless Inter Domain Routing (CIDR) notation is used, for instance 192.168.0.100/24.

The default gateway is a server in your network, which routes the traffic from the

IDENTIKEY Appliance to the outside network. Enter the default gateway for your network.

DNS Settings

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 4: Network Fields (continued)

Field Name

DNS Suffixes

DNS Servers

Description

List of domain suffixes. The DNS search path or DNS suffix is used to complete a partial DNS name whenever a DNS lookup is performed, for example 'intranet' is completed to 'intranet.mycompany.com'. Enter the domain used within your company in this field. A partial DNS name is completed with each domain starting from the top of the list until a valid DNS name is found.

List of DNS servers used in your network. A DNS server is used to convert human readable DNS names into IP addresses used in the network. The first entry in the list is used to perform DNS resolving. A subsequent server in the list is used if the previous DNS server in the list is unavailable.

Proxy Server

A proxy server is used in larger companies and organizations to improve network operations and security. It can be used to prevent direct communication between two or more networks. A proxy server forwards all allowed data requests to remote servers.

The use of a proxy server is optional. Proxy authentication works for basic authentication and DIGEST authentication, but not for form-based authentication.

Use Proxy Server for HTTP(S) Click the check box to enable/disable use of a proxy server.

Proxy Server

Port

Enable Authentication

Enter the IP address of the proxy server used in your network.

Enter the IP port used to contact your proxy server.

Click the check box to enforce authentication for HTTP(S) access through the proxy server.

User Name

Password

Enter the user name to authenticate towards the proxy server in your network before a connection is allowed.

Enter the password for the supplied user name to authenticate towards the proxy server in your network before a connection is allowed.

2.2.4. SNMP

These settings allow you to define SNMP traps, SMS and email warnings for critical system OS events. For more details about system monitoring, refer to Chapter

9. System Monitoring

Table 5: SNMP Fields

Field Name Description

SNMP

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 5: SNMP Fields (continued)

Field Name Description

Enable SNMP v2c

Enable SNMP v3

Check to enable the Simple Network Management Protocol (SNMP) v2c. This allows you to use an SNMP client to manage and monitor the IDENTIKEY Appliance. SNMP v2c: SNMPv2 (RFC

1441–RFC 1452) includes improvements in the areas of performance, security, confidentiality, and manager-to-manager communications.

Note : SNMP v1 is also supported by selecting the v2c option

With this option enabled, the following options will also need to be configured: n n

Read community . Defines the relationship between the IDENTIKEY Appliance SNMP server and the client system. The community string acts as a password to control the clients' access to the server

Allow query from . Specifies the sources from which the IDENTIKEY Appliance SNMP server can be consulted. You can specify an IP address or range of IP addresses; netmask is required.

Check to enable the Simple Network Management Protocol (SNMP) v3. This allows you to use an

SNMP client to manage and monitor the IDENTIKEY Appliance. SNMP v3 is defined per RFC

3411–RFC 3418 (also known as 'STD0062'). SNMP v3 primarily added security and remote configuration enhancements to SNMP, such as authentication and message integrity.

With this option enabled, the following options will also need to be configured in order to enable connection to the IDENTIKEY Appliance SNMP server: n n n n n

Authentication user name (ie. Security Name)

Authentication password

Authentication type ( MD5 or SHA )

Privacy password – secret key used by privacy protocol for encrypting/decrypting messages

Privacy type – indicates which privacy protocol to use ( AES or DES )

Settings

Contact

Location

Download VASCO MIB files

The contact information of the IDENTIKEY Appliance administrator

The location of the IDENTIKEY Appliance

The Download link beside this downloads the MIB files provided by VASCO for use with SNMP.

For more information about MIB files, refer to Section

9.2. MIB .

SNMP Traps

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 5: SNMP Fields (continued)

Field Name Description

Enable v2 Traps

Enable v3 Traps

Enable SNMP v3 Inform

Requests

Enable SNMP v2 traps. With this option enabled, you will also need to configure a Community (ie. Security Name).

These options enable SNMP traps for Operating System Events. When enabling a trap, you will also need to configure a Target Host

(ie. The IP address of the SNMP host).

Enable SNMP v3 traps.

Enable SNMP v3 inform. With this trap, you will need to configure options identical to those for “Enable v3 traps”.

When enabling v3 traps or v3 inform, the following options will also need to be configured: n n n n n n

Authentication user name (ie.

Security name)

Authentication password

Authentication type ( None , MD5 , or

SHA )

Privacy password – secret key used by privacy protocol for encrypting/decrypting messages

Privacy type – indicates which privacy protocol to use ( None , AES , or

DES )

EngineID text – SNMP v3 requires an SNMP agent to define a unique

“engine ID” in order to respond to

SNMP v3 requests. The text in this field will be appended to the

IDENTIKEY Appliance engine ID in hex (e.g.

0x80001f8804TEXTINHEX).

2.2.5. Logging Settings

This interface allows you to specify level settings for system logging. It contains sections for both local and remote logging. With remote logging, log lines are forwarded to a remote syslog server. To enable this, you need to specify one or more syslog server(s).

The IDENTIKEY Appliance Configuration Tool generates information in the logging system. This logging system does not contain information from the IDENTIKEY Authentication Server component. For more information about the IDENTIKEY Appliance logging system, refer to the IDENTIKEY Appliance Product Guide , Section "Logging".

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 6: Logging Fields

Field Name

Level

Description

Select the logging level.

The logging system can be configured to generate information at different priority levels.

When specifying a level, IDENTIKEY Appliance will log all messages at that priority level and higher; for example, when Error is the specified logging level, IDENTIKEY Appliance will log all

Error and Critical messages.

The following levels are available (in order of descending priority): n n n n n n

Critical: A system-critical warning that services may not be running.

Error: Action is required, although services may still be running.

Warning: Not an error, but an indication that an error may occur if action is not taken.

Notice: Events which are unusual but not error conditions. No immediate action required.

Info: Normal operational messages, may be collected for reporting etc. No action required.

Debug: Information useful to debug the application. Not useful during operations.

Remote Logging

Syslog Servers

Level

The IP address of the remote syslog server.

Select the level for remote logging.

2.2.6. Notifications

These settings allow you to define SNMP traps, SMS or email warnings for IDENTIKEY Appliance Configuration Tool events.

Table 7: Notification Settings Fields

Field Name Description

Enabled

Filters

If selected, notifications are enabled.

List of notification filters.Notification filters restrict the audit messages that are monitored.

Targets

Click Add filter to add a new filter (see Section

2.2.6.1. Add Filter ).

List of notification targets. Notification targets define where and how notifications are sent.

Click Add target to add a new target (see Section

2.2.6.2. Add Target

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.2.6.1. Add Filter

Table 8: Notification Filter Fields

Field Name Description

Enabled

Name

Target

Filter

If selected, the filter is enabled.

The filter name used to distinguish between different filters.

A target as specified in the Targets section (see Section

2.2.6.2. Add Target ).

Optional. List of audit filters. Filters restrict the audit messages that are monitored. A filter defines a match criteria that must be met in order to trigger a notification.

Severity

Click Add to define a new audit filter.

You can configure a notification to be sent to multiple recipients/channels by adding multiple targets to a single filter.

The severity settings allow you to select conditions to monitor. You can choose multiple condition types: n n n n n

Error

Success

Warning

Failure

Info

2.2.6.2. Add Target

Table 9: Notification Target Fields

Field Name Description

Type Notification target type.

n n n

SNMP

SMS

The target name used to distinguish between different notification targets.

Name

SNMP

Host

Type

The IP address of the SNMP host to which SNMP traps will be sent.

SNMP notification type.

User Name n n n

INFORM . This type expects an acknowledgement and will resend the message until it gets a response.

TRAP . This is an SNMP v3 trap. For this notification target, an engine ID field is displayed (read-only) which is required to configure the server.

TRAPv2c . This is an SNMPv2c trap.

The user name for SNMP v3.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 9: Notification Target Fields (continued)

Field Name Description

Authentication Type Required, if SNMP Type is set to INFORM or TRAP . Specifies whether messages sent and received on behaof of this user can be authenticated, and if so, which authentication protocol to use.

Authentication Secret

Privacy Type

Privacy Secret n n

MD5

SHA

Required, if SNMP Type is set to INFORM or TRAP . Passphrase used to create the authentication key.

Available, if SNMP Type is set to INFORM or TRAP . Specifies whether messages sent and received on behalf this user can be encrypted, and if so, which encryption protocol to use.

n n n

AES

DES

None

Available, if SNMP Type is set to INFORM or TRAP . Passphrase used to create the encryption key.

Required, if SNMP Type is set to TRAPv2c .

Communitystring

From

Subject

SMS

Mobile

The sender's email address.

The message subject header field.

The recipient's email address.

The phone number to send the message to.

For more information about notification targets in general, refer to the IDENTIKEY Appliance Administrator Guide ; for more information on SNMP traps as notification targets and trap parameters, refer to Section

9.1. SNMP Trap

Parameters

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.2.7. Configtool Settings

Table 10: Configtool Fields

Field Name

Limit Access To Networks

Description

List of IP addresses of client computers that are allowed to access the Configuration Tool. The

Classless Inter-Domain Routing (CIDR) notation can be used to specify IP address blocks, e.g.

192.168.0.100/24. If this list is empty, any client computer can access the IDENTIKEY Appliance Configuration Tool.

Default setting: -

Note

If you inadvertently lock yourself out by setting this option to an incorrect value, you can reset it using the Rescue Tool.

Maximum Configtool Session

Length (minutes)

Configtool HTTPS Certificate

The time span a Configuration Tool session remains active before IDENTIKEY Appliance terminates it automatically. The value is given in minutes.

Default setting: 45

The certificate used to encrypt connections to the Configuration Tool. The list contains all valid certificates created/imported using the Certificate Management tab (see

2.2.8. Certificate

Management ).

A default certificate for the Configuration Tool is created automatically during setup. A new default certificate is automatically created whenever you change the hostname.

2.2.8. Certificate Management

This tab is used to manage all server and certification authority (CA) certificates used by all components of

IDENTIKEY Authentication Server and IDENTIKEY Appliance, respectively.

Table 11: Certificates Fields

Field Name Description

Server Certificates

Server certificates contain public and private keys and are usually used to secure connections to a server or a component using SSL, e.g.

SEAL communicator, SOAP communicator, Configuration Tool, etc.

Some server certificates are created by the built-in certification authority (CA) during installation.

Subject The entity associated with the public key stored in the certificate.

Description An optional description of the server certificate. Can be changed.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 11: Certificates Fields (continued)

Field Name Description

Issued By

Expiry

In Use

Expiry

In Use

IDENTIKEY Appliance Root CA

The authority, which issued this certificate.

Shows how long the certificate is still valid. The value is given in days.

Shows how many components are currently using this server certificate.

Trusted Root Certificate Authorities

Trusted certification authority (CA) certificates are typically used to determine which client certificates to trust. Trusted CA certificates often come in bundles containing several different trusted root CA's.

Description

Content

An optional description of the trusted root CA certificate/bundle. Can be changed.

The entity associated with the public key stored in the certificate, or, if the item is a CA certificate bundle, the number of CAs in the bundle.

Shows how long the CA certificate/bundle is still valid. The value is given in days.

Shows how many components are currently using this CA certificate/bundle.

IDENTIKEY Appliance contains a built-in certification authority (CA) used to sign all automatically generated default certificates. This list contains the root CA certificate for the IDENTIKEY Appliance CA.

Description A description of the root CA certificate.

Content

Expiry

The entity associated with the public key stored in the certificate.

Shows how long the CA certificate is still valid. The value is given in days.

For more information about managing your certificates, refer to the IDENTIKEY Appliance Administrator Guide , Section "Managing Certificates".

2.3. IDENTIKEY Authentication Server Settings

2.3.1. Scenarios

Table 12: IDENTIKEY Authentication Server General Settings Fields

Field Name Description

Administration

Max. Concurrent Sessions

The maximum number of concurrent administration sessions permitted. If this is set to 0, concurrent sessions will be unlimited.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 12: IDENTIKEY Authentication Server General Settings Fields (continued)

Field Name Description

Max. Session Time

(seconds)

Idle Timeout (seconds)

The maximum allowed length of an administration session. There is no way to extend a session beyond this limit.

The maximum length of time of inactivity allowed during a session, before the session is automatically terminated by the IDENTIKEY Authentication Server.

Authentication

Enabled Enable or disable processing of authentication requests. The IDENTIKEY Authentication Server license key must enable authentication for this setting to be applicable.

Provisioning

Enabled

Max. Reactivation

Attempts

Enable or disable processing provisioning requests. Note that the IDENTIKEY Authentication Server license key must enable provisioning for it to be enabled.

Min. Reactivation Interval The minimum length of time in minutes between activation attempts for a particular DIGIPASS.

Default value: 1440

The total number of activation attempts (successful or unsuccessful) per DIGIPASS.

Default value: 3

Max. Reactivation Locations

The maximum number of different locations at which a particular DIGIPASS can be activated.

This only applies where the location is specified as part of provisioning (DIGIPASS for Web).

Default value: 5

Online Provisioning Registration Identifier

Length

Character Set

The minimum length of the registration identifier for online provisioning for DIGIPASS for Mobile.

Default value: 8

The character set used for the registration identifier.

Possible values: n n

Alphanumeric

Numeric

Default value: Alphanumeric

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 12: IDENTIKEY Authentication Server General Settings Fields (continued)

Field Name Description

Case

Online Provisioning Activation Password

Length The minimum lengths of the activation password for online provisioning for DIGIPASS for Mobile.

Default value: 8

Character Set

The letter case used for the character set for the registration identifier.

Possible values: n n n

Upper Case

Lower Case

Mixed Case

Default value: Mixed Case

Case

The character set used for the activation password.

Possible values: n n

Alphanumeric

Numeric

Default value: Alphanumeric

The letter case used for the character set for the activation password.

Possible values: n n n

Upper Case

Lower Case

Mixed Case

Default value: Mixed Case

Signature

Enabled Enable or disable the Signature scenario. Note that the IDENTIKEY Authentication Server license key must enable Signature for it to be enabled.

EMV-CAP

Enabled Enable or disable the EMV-CAP Hardware Security Module scenario.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.3.2. SEAL Configuration

Table 13: IDENTIKEY Authentication Server SEAL Configuration Fields

Field Name Description

SSL Cipher Suite Security Level

SSL Cipher Suite Security

Level

For more information, refer to Chapter

3. SSL Cipher Suites

n n n

High Uses key lengths larger than 128 bits.

Medium Uses key equal to 128 bits.

Low Uses 64 or 56 bit encryption algorithms, excluding export cipher suites.

SEAL Certificate

Server Certificate The certificate used to encrypt connections using the SEAL protocol. The list contains all valid certificates created/imported using the Certificate Management tab (see

2.2.8. Certificate

Management ).

A default certificate for SEAL connections is created automatically during setup.

SEAL Client Certificate Verification

Require Client Certificate

CA Certificate Store

Re-verify On Re-Negotiation

Automatically Trust Certificates

Indicates whether the client certificate is required to during SSL processing.

The valid values are: n n n n

Never

Optional

Required

Required - Signed Address Only

For more information, refer to the IDENTIKEY Appliance Product Guide , Section "SSL".

The CA certificate used to authenticate the clients. The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

If you select the default certificate for SEAL connections to use as Server Certificate , CA Certificate

Store will be the certificate of the IDENTIKEY Appliance root CA.

If enabled, the client certificate is re-verified.

For more information, refer to the IDENTIKEY Appliance Product Guide , Section "SSL".

Check to automatically trust certificates.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.3.3. SOAP Configuration

Table 14: IDENTIKEY Authentication Server SOAP Configuration Fields

Field Name Description

SSL CipherSuite Security Level

SSL Cipher Suite Security

Level

For more information, refer to Chapter

SSL Cipher Suites

n n n

High Uses key lengths larger than 128 bits.

Medium Uses key equal to 128 bits.

Low Uses 64 or 56 bit encryption algorithms, excluding export cipher suites.

SOAP Certificate

Server Certificate The certificate used to encrypt connections using the SOAP protocol. The list contains all valid certificates created/imported using the Certificate Management tab (see

2.2.8. Certificate

Management ).

A default certificate for SOAP connections is created automatically during setup.

SOAP Client Certificate Verification

Require Client Certificate

CA Certificate Store

Re-verify On Re-Negotiation

Require Client Certificate indicates whether the client certificate is required to during SSL processing.

The valid values are: n n

Never

Required

For more information, refer to the IDENTIKEY Appliance Product Guide , Section "SSL".

The CA certificate used to authenticate the clients. The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

If you select the default certificate for SOAP connections to use as Server Certificate , CA Certificate

Store will be the certificate of the IDENTIKEY Appliance root CA.

If enabled, the client certificate is re-verified.

For more information, refer to the IDENTIKEY Appliance Product Guide , Section "SSL".

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.3.4. RADIUS Configuration

Table 15: IDENTIKEY Authentication Server RADIUS Configuration Fields

Field Name Description

Click to enable/disable RADIUS communicator Enable RADIUS Communication

Authentication Port

Accounting Port

Server Certificate

SSL Security Level

The port number on which to listen for RADIUS access requests .

The port number on which to listen for RADIUS accounting requests .

Server Certificate

For more information, refer to Chapter

3. SSL Cipher Suites

n n n n

Very High .

High . Uses key lengths larger than 128 bits.

Medium . Uses key equal to 128 bits.

Low . Uses 64 or 56 bit encryption algorithms, excluding export cipher suites.

The certificate used to encrypt connections using the RADIUS protocol. The list contains all valid certificates created/imported using the Certificate Management tab (see

4. RADIUS Dictionary Format

A default certificate for RADIUS connections is created automatically during setup.

RADIUS Dictionary File

Default Dictionary

Upload New Dictionary

Click the icon to download the default dictionary of RADIUS attributes.

Each dictionary file contains a list of RADIUS attributes and values, which the server uses to map between descriptive names and on-the-wire data. The names have no meaning outside of the RADIUS server itself, and are never exchanged between server and clients.

Use this function to upload your own set of RADIUS attributes. Once you have uploaded your own RADIUS attribute file, it will be marked as “current” (in use) and will be available for download.

For more information, refer to Chapter

2.3.5. Authentication Back-End Settings

Table 16: IDENTIKEY Authentication Server Back-End Settings Fields

Field Name Description

IBM Security Directory Server

Enabled Check this option to activate the IBM Security Directory Server LDAP back-end server type for the

IDENTIKEY Authentication Server.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 16: IDENTIKEY Authentication Server Back-End Settings Fields (continued)

Field Name Description

IBM Directory

SSL Certificate

The certificate used to authenticate the IDENTIKEY Authentication Server to the IBM Security Directory

Server back-end server. The list contains all valid certificates created/imported using the Certificate

Management tab (see

2.2.8. Certificate Management

Microsoft Active Directory

Enabled

AD SSL Certificate

Enable this check box to activate the Microsoft Active Directory back-end server type for the

IDENTIKEY Authentication Server.

The certificate used to authenticate the IDENTIKEY Authentication Server to the Active Directory (AD) back-end server. The list contains all valid certificates created/imported using the Certificate Management tab (see

NetIQ eDirectory

Enabled Enable this check box to activate the NetIQ eDirectory back-end server type for the IDENTIKEY

Authentication Server. For more information about NetIQ eDirectory back-end servers, refer to

IDENTIKEY ApplianceProduct Guide .

RADIUS

Enabled Enable this check box to activate the RADIUS back-end server type for the IDENTIKEY Authentication

Server. For more information about RADIUS back-end servers, refer to IDENTIKEY ApplianceProduct

Guide .

2.3.6. Server Discovery

Table 17: IDENTIKEY Authentication Server Discovery Fields

Field Name Description

Enabled

DNS Server Address

Authentication Type

Shared Key File

DNS Domain

Enable this check box to activate server discovery for the IDENTIKEY Authentication Server. For no DNS service registration, the check box should not be enabled.

Enter the IP address of the DNS server.

None Use this for DNS service registration with a DNS server supporting dynamic DNS anonymously.

TSIG Use this for DNS service registration with a DNS server supporting dynamic DNS with TSIG authentication.

Browse to the TSIG key file, if TSIG authentication type is being used (see previous field).

Enter the domain name.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 17: IDENTIKEY Authentication Server Discovery Fields (continued)

Field Name Description

Host Name

Priority

The FQDN of the machine hosting the IDENTIKEY Authentication Server. You may also enter an IP address in this field.

Primary This IDENTIKEY Authentication Server will be the first to which authentication requests are sent during Windows Logon, where more than one IDENTIKEY Authentication Server exists on the network.

Backup This IDENTIKEY Authentication Server will be the backup to which authentication requests are sent during Windows Logon, where more than one IDENTIKEY Authentication Server exists on the network, but the IDENTIKEY Authentication Server nominated as 'Primary'

(see above) is unavailable.

2.3.7. Audit Settings

Table 18: IDENTIKEY Authentication Server Audit Fields

Field Name Description

Send Audit Messages To Syslog

Syslog Message Type Select one or more of these options, to enable logging the respective types of audit messages. Available types are: n n n n n

Error

Warning

Info

Success

Failure

For more information, refer to Chapter

12. Audit Message Types .

Remote Audit Viewer

Enable Remote Audit

Viewer

Maximum Connections

Authentication Timeout

If the option is enabled, you can use the IDENTIKEY Authentication Server Audit Viewer (client application).

The maximum number of Audit Viewer clients that can be connected to IDENTIKEY Authentication

Server at the same time. A high number of connections could impact performance. The default maximum number of connections is 3 .

Number of seconds until an authentication times out in case of inactivity. The default value is 60 seconds.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 18: IDENTIKEY Authentication Server Audit Fields (continued)

Field Name Description

Audit message type Select one ore more of these options, to enable the respective types of audit messages. Available types are: n n n n n

Error

Warning

Info

Success

Failure

For more information, refer to Chapter

12. Audit Message Types .

Audit Viewer SSL

Enable SSL Connections If you wish to secure the audit connection with SSL, select this check box.

SSL Cipher Suite Security Level

IDENTIKEY Appliance supports SSL Cipher Suites at Very High, High, Medium, and Low levels for

SSL cipher suites. For more information, refer to the IDENTIKEY Appliance Administrator Guide .

Server Certificate

Certificate Password

The certificate used to encrypt audit connections via SSL. The list contains all valid certificates created/imported using the Certificate Management tab (see

A default certificate for SEAL connections is created automatically during setup.

The password for the certificate file.

Client Certificate Verification

Require Client Certificate You can set if selecting a Certificate Authority (CA) certificate file is required; if you do not require an

SSL client certificate, select Never from this drop-down list; if you select any other setting than Never , you will be required to select a CA certificate.

CA Certificate Store

Re-Verify On Re-Negotiation

The CA certificate used to authenticate the clients. The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

8. Performance Monitoring

If you select the default certificate for SEAL connections to use as Server Certificate , CA Certificate

Store will be the certificate of the IDENTIKEY Appliance root CA.

If you select this option, an SSL handshake is performed each time the audit viewer is re-connected to

IDENTIKEY Authentication Server, i.e. the connection is forced to be re-verified each time a connection is established.

Note that enabling the Re-Verify on Re-Negotiation option may incur a performance penalty; therefore this option should be enabled only if absolutely necessary.

Automatically Trust Certificates

When this option is enabled, your server will copy the certificate authority details from the destination server to an empty file that needs to be specified in the CA Certificate Store field. This option guarantees certificate verification by copying the necessary certificate details (during each connection).

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.3.8. Tracing Settings

Table 19: IDENTIKEY Authentication Server Tracing Fields

Field Name Description

Trace Level n n n n

None No tracing / disable tracing

Basic Show all logging information, except debugging information

Full Shows all logging information, debugging information included. This level is advised for troubleshooting.

Debug Shows all logging information, with more debugging information included. This setting is only for use when advised to do so by VASCO Customer Service.

Trace File Rotation

Number of Archived Logs The number of log files to be archived. Older logs are removed, and IDENTIKEY Appliance can keep a maximum of 10 logs; as such, the maximum accepted value for this field is also 10.

Rotate On Select whether logs should be rotated based on: n n

Days The number of days they exist.

Size The size in MB of the log file

2.3.9. Performance Monitoring

Table 20: IDENTIKEY Authentication Server Performance Monitoring Fields

Field Name Description

Enabled

CSV Plugin

Enable CSV Plugin

Enable Log Rotation

Enables/disables the performance monitoring system

Enable the CSV Plugin by clicking the Enable CSV Plugin field.

CSV log files can be rotated, with a new file being created after a specified elapsed time period, or when a specified size is reached. Check this box to enable CSV log file rotation.

Number of Archived Logs Specify the number of CSV log files to keep. The number of archived CSV log files will remain constant, but a new file will be added to the archive list, and the oldest file will be lost.

Rotate On Select the criteria to decide when to rotate the log file.

Size

Days

Compression n n

Size . Rotate when the log file exceeds a specified size limit.

Days . Rotate after a specified amount of time.

The file size limit for log file rotation. This value is given in KB.

Default setting: 10240

The time limit for log file rotation.

Default setting: 1

Check this to compress the kept CSV log files.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 20: IDENTIKEY Authentication Server Performance Monitoring Fields (continued)

Field Name Description

Counter Plugin

Enabled Enable the Counter Plugin by clicking the Enable Counter Plugin field. The Counter Plugin will generate data relating to the number of times certain transactions have been performed, adding this data into the SNMP server. The Counter Plugin is only available if SNMP is enabled, and can only be viewed via SNMP.

Filters

Add Filter Filters allow the Performance Monitoring tool to restrict the amount of information that it monitors.

At least one filter must be provided.

The filter must consist of the name of a performance transaction.

The filter can contain the exact name of the performance transaction, or wildcards can be used to identify a group of transactions.

For more information about performance monitoring filters, refer to Chapter

2.3.10. System Monitoring Alerts

These settings allow you to define SNMP traps, SMS and email warnings for IDENTIKEY Authentication Server events. For more details about system monitoring, refer to Chapter

9. System Monitoring

Table 21: System Monitoring Settings Fields

Field Name Description

Enabled

Targets

If selected, notifications are enabled.

List of notification targets. Notification targets define where and how notifications are sent.

Filters

Click Add target to add a new target (see Section

2.3.10.1. Add Target ).

List of notification filters.Notification filters restrict the audit messages that are monitored.

Click Add filter to add a new filter (see Section

2.3.10.2. Add Filter

2.3.10.1. Add Target

Table 22: System Monitoring Target Fields

Field Name Description

Type Notification target type.

n n n

SNMP

SMS

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 22: System Monitoring Target Fields (continued)

Field Name Description

The target name used to distinguish between different notification targets.

Name

SNMP

Host

Type

Security Name

Authentication Type

Authentication Secret

Privacy Type

Privacy Secret

The IP address of the SNMP host to which SNMP traps will be sent.

SNMP notification type.

n n n

INFORM . This type expects an acknowledgment and will resend the message until it gets a response.

TRAP .This is an SNMP v3 trap. For this notification target, an engine ID field is displayed (read-only) which is required to configure the server.

TRAPv2c . This is an SNMPv2c trap.

The user name for SNMP v3 or the community name for SNMPv2c.

Required, if SNMP Type is set to INFORM or TRAP . Specifies whether messages sent and received on behalf of this user can be authenticated, and if so, which authentication protocol to use.

n n

MD5

SHA

Required, if SNMP Type is set to INFORM or TRAP . Pass phrase used to create the authentication key.

Available, if SNMP Type is set to INFORM or TRAP . Specifies whether messages sent and received on behalf this user can be encrypted, and if so, which encryption protocol to use.

n n n

AES

DES

None

Available, if SNMP Type is set to INFORM or TRAP . Pass phrase used to create the encryption key.

Required, if SNMP Type is set to TRAPv2c .

Communitystring

From

Subject

SMS

Mobile

The sender's email address.

The message subject header field.

The recipient's email address.

The phone number to send the message to.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

2.3.10.2. Add Filter

Table 23: System Monitoring Filter Fields

Field Name Description

Enabled

Name

Target

Filter

If selected, the filter is enabled.

The filter name used to distinguish between different filters.

List of notification targets as specified in the Targets section (see Section

2.3.10.1. Add Target ).

Optional. List of audit filters. Filters restrict the audit messages that are monitored. A filter defines a match criteria that must be met in order to trigger a notification.

Severity

Click Add to define a new audit filter.

You can configure a notification to be sent to multiple recipients/channels by adding multiple targets to a single filter.

The severity settings allow you to select conditions to monitor. You can choose multiple condition types: n n n n n

Error

Success

Warning

Failure

Info

2.3.11. Message Delivery Component

The Message Delivery Component (MDC) is used sending notifications and a one-time password (OTP) by SMS, email, or voice message when Virtual DIGIPASS is used.

For more information about setting up Virtual DIGIPASS, refer to the IDENTIKEY Appliance Administrator Guide .

Table 24: Message Delivery Component Fields

Field Name Description

Enable this check box to activate the Message Delivery Component.

Enabled

Tracing

Trace Level

Enable Log Rotation

Number of Archived Logs n n n

None No tracing / disable tracing

Basic Show all logging information, except debugging information

Full Shows all logging information, debugging information included. This level is advised for troubleshooting.

Check this option to enable log rotation. Log rotation specifies when new logs files are created, based on the number of days they exist (their age) or the log file size.

The number of log files to be archived. The oldest log file is removed.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 24: Message Delivery Component Fields (continued)

Field Name Description

Rotate On Select whether logs should be rotated based on: n n

Days The number of days they exist.

Size The size in MB of the log file

Check this option to compress the archived logs to save disk space.

Compress Archived Logs

SMS Delivery

Gateways List of SMS gateways.

Click Add SMS Server to define a new HTTP/HTTPS SMS gateway. For more information, refer to

Section

2.3.11.2. Add SMS Server .

Click Add SMPP Server to define a new SMPP gateway. For more information, refer to Section

2.3.11.3. Add SMPP Server

E-Mail Delivery

Gateways List of email gateways.

Click Add SMTP Server to define a new SMTP gateway. For more information, refer to Section

2.3.11.4. Add SMTP Server

Voice Delivery

Gateways List of voice gateways.

Click Add Voice Server to define a new voice gateway. For more information, refer to Section

2.3.11.5. Add Voice Server

2.3.11.1. Importing and Exporting Gateways

For each gateway option, an Import gateway and Export gateway button is available. These functions allow you to import and export a description file and easily apply gateway settings from different IDENTIKEY Appliance instances or to import gateway settings from IDENTIKEY Authentication Server into IDENTIKEY Appliance (and vice versa).

2.3.11.2. Add SMS Server

Table 25: SMS Server Fields

Field Name Description

Enabled

Profile

If selected, this gateway is enabled.

Name of the MDC profile; should not be confused with the profile's display name. The MDC profile name is nonunique and thus multiple MDC profiles with the same name may exist for this delivery method. The highestranked, enabled, and available MDC profile with the specified profile name will be used.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 25: SMS Server Fields (continued)

Field Name Description

Name

Server Type

Display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.

Specifies how the MDC performs load-balancing, failover, and/or fail-back.

n n

Primary

Backup

Connection Settings

URL The complete URL of the HTTP/HTTPS gateway, including the protocol, URI, and port.

<Protocol>://<Host>[:<Port>][/<Path>]

If the port is omitted, then standard values are assumed depending on the specified protocol, i.e. port 80 for

HTTP and port 443 for HTTPS..

Example http://myHost/myPath https://myHost:443/

Certificate The CA certificate used to verify encrypted connections to the gateway. Required, if the gateway uses HTTPS.

The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

2.2.8.

Certificate Management ).

If the list does not contain the correct certification authority (CA), you can select Add Authority from the list to upload a certificate file using the Upload Certificate wizard.

SMS Gateway Account Settings

User Name

Password

The user name needed to authenticate with the gateway

The password needed to authenticate with the gateway

Query & Result

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 25: SMS Server Fields (continued)

Field Name Description

Query String This field defines the query string which is submitted to the HTTP server, either using POST or GET (as specified by the query method). This string must contain all the required variables that are expected by the HTTP gateway.

Example

Form Method

The following parameters can be included in the query string and are set by the MDC before submitting the query:

[acc_user] specifies the account name for the gateway used to submit the information

[acc_pwd]

[otp_msg] sets the password for the gateway account specified by the [Username] parameters specifies the part of the query string, where the OTP is substituted

[otp_dest] specifies the part of the query string, where the destination for the OTP (usually the mobile phone number) is substituted. The query string should also incorporate any other parameters which might be expected by the gateway.

This field designates either the GET or POST method for transferring account and message data to the

HTTP/HTTPS gateway.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 25: SMS Server Fields (continued)

Field Name Description

Result Matching Rules

List of result matching rules. A result page is returned by the gateway service when a text message is submitted by the GET or POST methods. This page would normally be a HTML formatted page containing specific error codes and/or additional messages for success/failure.

Click Add Result to define a new result matching rule.

Message Delivery Component Result

Name

Messagetype

Matching Pattern

Audit Text

Test SMS

Send Test Message To

Phone number to send a message to test the configuration settings.

Click Test Settings to effectively send a test message.

Description used to distinguish between different result matching rules.

The category of the result message.

n n n

Information . Message has been delivered successfully.

Warning . The submission or delivery failed, but it is most likely a specific error only affecting this user.

Error . An error occurred while attempting delivery.

This field specifies the result page template to match the result page returned by the

HTTP service. If this template is matched, the corresponding audit message is composed and returned to the IDENTIKEY Appliance audit message.

This field specifies the audit message template for the message to be compiled and sent back to the IDENTIKEY Appliance.

Variables may be included in this field.

2.3.11.3. Add SMPP Server

Table 26: SMPP Server Fields

Field Name

Enabled

Description

If selected, this gateway is enabled.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 26: SMPP Server Fields (continued)

Field Name

Profile

Name

Server Type

Connection Settings

IP Address

Port

Certificate

SSL Enabled

Certificate

SMS Gateway Account Settings

User Name

Password

SMPP System Settings

System Type

Description

Name of the MDC profile; should not be confused with the profile's display name. The MDC profile name is non-unique and thus multiple MDC profiles with the same name may exist for this delivery method. The highest-ranked, enabled, and available MDC profile with the specified profile name will be used.

Display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.

Specifies how the MDC performs load-balancing, failover, and/or fail-back.

n n

Primary

Backup

The IP address of the SMPP server.

The server port used by the SMPP server.

Default setting: 2775

If selected, the SMPP server used encryption.

The CA certificate used to verify encrypted connections to the gateway. The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

If the list does not contain the correct certification authority (CA), you can select Add Authority from the list to upload a certificate file using the Upload Certificate wizard.

The user name required to authenticate with the SMPP server

The password required to authenticate with the SMPP server

Name to identify the gateway.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 26: SMPP Server Fields (continued)

Field Name

Message Mode

Priority Flag

Privacy Indicator

SMPP Source Address

Type of Number (TON)

Numbering Plan Indicator (NPI)

Number

SMPP Destination Address

Type of Number (TON)

Numbering Plan Indicator (NPI)

SMPP Timeout Settings

Description

Specifies how Message Delivery Component handles messages sent to the gateway.

n n

Datagram . When sending a message Message Delivery

Component expects a confirmation on whether the gateway received the message.

Transaction . When sending a message Message Delivery Component expects a confirmation on whether the gateway AND the intended recipient received the message.

The priority level of messages sent by Message Delivery Component. A higher number indicates a higher priority.

The privacy level of sent messages.

n n n n n

None

Not Restricted

Restricted

Confidential

Secret

The Type of Number (TON) of the addresses used for outgoing messages send by the gateway.

n n n n n n n

Unknown

International

National

Network Specific

Subscriber Number

Alphanumeric

Abbreviated

The Numbering Plan Indicator (NPI) as specified in the SMPP specification.

The phone number used as the sender's.

The Type of Number (TON) of the addresses of incoming messages served by the gateway.

The Numbering Plan Indicator (NPI) as specified in the SMPP specification.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 26: SMPP Server Fields (continued)

Field Name

Transaction Timeout (sec)

Inactivity Timeout (sec)

Enquire Link Timeout (sec)

Test SMS

Send Test Message To

2.3.11.4. Add SMTP Server

Table 27: SMTP Server Fields

Field Name

Enabled

Profile

Description

The time span Message Delivery Component waits to receive a reply for a transaction request until the transaction fails. The value is given in seconds.

Default setting: 10

The time span a session remains active before Message Delivery

Component terminates it automatically. The value is given in seconds.

Default setting: 300

The time span between operations before Message Delivery Component sends an enquire_link request to the gateway to test whether the gateway has still an active session. The value is given in seconds.

Default setting: 10

Phone number to send a message to test the configuration settings.

Click Test Settings to effectively send a test message.

Name

Server Type

SMTP Host

Description

If selected, this gateway is enabled.

Name of the MDC profile; should not be confused with the profile's display name.

The MDC profile name is non-unique and thus multiple MDC profiles with the same name may exist for this delivery method. The highest-ranked, enabled, and available MDC profile with the specified profile name will be used.

Display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.

Specifies how the MDC performs load-balancing, failover, and/or fail-back.

n n

Primary

Backup

Enter the FQDN or IP address of the SMTP server used for audits and reporting.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 27: SMTP Server Fields (continued)

Field Name Description

SMTP Port

Connection Security

Certificate

Enter the port number of the SMTP server (25 is the default)

Select the applicable encryption used on the SMTP server.

n n n

No SSL/TLS . No encryption is used (default setting)

SSL . The SMTP server uses SSL to encrypt mail traffic. A certificate file needs to be uploaded.

TSL . The SMTP server uses TLS to encrypt mail traffic. A certificate needs to be uploaded.

The CA certificate used to verify encrypted connections to the gateway. Required, if the gateway uses HTTPS. The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

Certificate Management ).

If the list does not contain the correct certification authority (CA), you can select Add

Authority from the list to upload a certificate file using the Upload Certificate wizard.

Authentication

Enable SMTP Authentication Allow the IDENTIKEY Appliance to log in to the SMTP automatically.

Username

Password

SMTP Options

From Address

The user name required to authenticate with the SMTP server

The password required to authenticate with the SMTP server

The email address which should appear in the From field when a notification is sent.

Test E-mail

Send Test Message To The email address to send a message to test the configuration settings.

Click Test Settings to effectively send a test message

2.3.11.5. Add Voice Server

Table 28: Voice Server Fields

Field Name Description

Enabled

Profile

Name

If selected, this gateway is enabled.

Display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 28: Voice Server Fields (continued)

Field Name Description

Server Type Specifies how the MDC performs load-balancing, failover, and/or fail-back.

n n

Primary

Backup

Connection Settings

URL The complete URL of the voice gateway, including the protocol, URI, and port.

<Protocol>://<Host>[:<Port>][/<Path>]

If the port is omitted, then standard values are assumed depending on the specified protocol, i.e. port 80 for

HTTP and port 443 for HTTPS.

Example http://myHost/myPath https://myHost:443/

Certificate The CA certificate used to verify encrypted connections to the gateway. Required, if the gateway uses HTTPS.

The list contains all valid and trusted CA certificates imported using the Certificate Management tab (see

2.2.8.

If the list does not contain the correct certification authority (CA), you can select Add Authority from the list to upload a certificate file using the Upload Certificate wizard.

Voice Gateway Account Settings

User Name

Password

The user name needed to authenticate with the gateway

The password needed to authenticate with the gateway

Voice Settings

Phone Number

Prefix

Query & Result

A prefix that is automatically added to the beginning of the user's phone number when sending a voice message.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 28: Voice Server Fields (continued)

Field Name Description

Example

Form Method

The following parameters can be included in the query string and are set by the MDC before submitting the query:

[acc_user] specifies the account name for the gateway used to submit the information

[acc_pwd]

[otp_msg] sets the password for the gateway account specified by the [Username] parameters specifies the part of the query string, where the OTP is substituted

This field designates either the GET or POST method for transferring account and message data to the

HTTP/HTTPS gateway.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 28: Voice Server Fields (continued)

Field Name Description

Result Matching Rules

Click Add Result to define a new result matching rule.

Message Delivery Component Result

Name

Messagetype

Matching Pattern

Audit Text

Test Voice

Send Test Message To

Phone number to send a message to test the configuration settings.

Click Test Settings to effectively send a test message.

Description used to distinguish between different result matching rules.

The category of the result message.

n n n

Information . Message has been delivered successfully.

Warning . The submission or delivery failed, but it is most likely a specific error only affecting this user.

Error . An error occurred while attempting delivery.

This field specifies the result page template to match the result page returned by the

HTTP service. If this template is matched, the corresponding audit message is composed and returned to the IDENTIKEY Appliance audit message.

This field specifies the audit message template for the message to be compiled and sent back to the IDENTIKEY Appliance.

Variables may be included in this field.

2.3.12. LDAP User Synchronization

LDAP user synchronization is server-specific and therefore requires configuring specifically for different LDAP servers. To set up synchronization requires configuring a synchronization profile. The tables below present: n n

General fields for a synchronization profile

Filter fields: records to be synchronized from the source LDAP server can be filtered by matching certain

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings n attributes. All attributes listed must match for a user account to be synchronized.

Attribute Mapping fields: this is the mapping of LDAP server attributes to user account properties.

For example configurations, refer to the IDENTIKEY Appliance Administrator Guide .

For more information about LDAP user synchronization, refer to the IDENTIKEY Appliance Product Guide .

Table 29: IDENTIKEY Authentication Server LDAP User Synchronization: General Fields

Field Name Description

Tracing

Tracing n n n

None . No tracing / disable tracing

Basic . Show all logging information, except debugging information

Full . Shows all logging information, debugging information included. This level is advised for Troubleshooting.

Adding a Synchronization Profile

Enabled

Description

Start Time

Frequency

Create Users

Delete Users

Enable Created Users

Update Users

LDAP URI

Bind DN

This field must be checked to enable automatic synchronizations using this synchronization profile at the frequency defined in the Frequency field (see below).

The default value is disabled, i.e. unchecked, in which case the profile is not operational and no user accounts are updated or copied from the LDAP Server.

A description should be entered to help identify this synchronization profile.

The time that the first synchronization of a day is to start.

The frequency defines the interval at which automatic synchronization occurs, once the profile has been manually configured. Synchronization frequency can be configured from every 15 minutes to every 24 hours.

Check this box to allow users to be created during synchronizations.

If this option is checked, the LDAP Synchronization process will go through the users that it has created on IDENTIKEY Appliance, and will check to make sure that they still exist on the

LDAP side. If they don't, they will be deleted from IDENTIKEY Appliance. This function does not work if the Reporting Scenario is not enabled in IDENTIKEY Appliance.

If users are to be created during synchronizations, create them as enabled users.

Allow synchronizations to update existing users. Select from drop down list: n n n n

None – do not update existing users during synchronization

All – update all existing users during synchronization, if necessary

Created by LDAP Synchronization only – only update user records previously created by LDAP Synchronization

Not created by LDAP Synchronization – only update user records NOT previously created by LDAP Synchronization

This is the protocol and host of the source LDAP server.

This is the Distinguished Name to authenticate towards the LDAP server. This should be a string-represented DN as defined in RFC 1779. Entering the bind DN is optional.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 29: IDENTIKEY Authentication Server LDAP User Synchronization: General Fields (continued)

Field Name Description

Bind Password

Search Base

Filter

Attribute Mapping

Destination

Create Missing OU's

Mirror OU Structure

Include LDAP Children

Return DIGIPASS to Parent

OU on Move/Delete

This is the bind password to authenticate towards the LDAP server. Entering the bind password is optional.

The search base is the starting point for searches in the LDAP server. This should be a stringrepresented DN as defined in RFC 1779.

This field serves to add LDAP attribute filter properties to the synchronization profile (refer to the Table

IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Filter Fields

below for more details).

This field serves to add LDAP attribute mapping properties to the synchronization profile (refer to the Table

IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Mapping

Fields

below for more details).

The Destination field defines the domain and optionally the organizational unit on the

IDENTIKEY Appliance where the user accounts will be created or updated. The Destination field therefore defines the root of the replicated organizational structure.

Checking this box will enable the synchronization process to create the same organizational structure on the destination data store as exists on the source LDAP data store. The synchronization will create the organizational structure on the destination data store if it does not already exist.

During synchronization the LDAP Synchronization Tool tries to reconcile the organizational structure of the source LDAP data store with the organizational structure of the destination data store.

If the structures are the same: The synchronization will proceed without creating any more organizational units.

If the structures differ:To create any missing organizational units with users in them, the option Create Missing OU's needs to be selected. With this option selected, users in organizational units will be created that already exist in IDENTIKEY Authentication Server.

Allow synchronization to create records derived from LDAP children. This option will replicate the organizational structure of the source LDAP data store onto the destination IDENTIKEY

Authentication Server data store, where the organizational structure will be created, should that not already exist. If the Mirror Organizational Unit Structure option is not selected, the

LDAP children will be synchronized, but on the destination IDENTIKEY Authentication Server data store they will be created straight under the root directory, without extra organizational units being created.

If, during synchronization, the LDAP Synchronization Tool detects that a user has been deleted, it will reassign the user's DIGIPASS to the organizational unit's administrator account.

The LDAP Synchronization Tool will interpret a moved user as being deleted from its original organizational unit. When the user is created in its new organizational unit by the LDAP Synchronization Tool, the original DIGIPASS will be re-assigned to the user.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 30: IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Filter Fields

Field Name Description

Attribute

Match

This must be the name of an LDAP server attribute. All attributes listed must match for a user account to be synchronized.

This is the value for the attribute defined in the previous field and must match for a user account to be retrieved for synchronization. Asterisks can be used as wild cards for the value, indicating zero or more characters.

Table 31: IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Mapping Fields

Field Name Description

Type

Source Attribute/Value

Destination Property

This defines whether the mapping is n n for an LDAP attribute name (Type: ldap ) for a constant value (Type: constant ).

For type ldap , this entry should be an LDAP attribute name.

For type constant , this entry should be the value of the corresponding IDENTIKEY Authentication Server Property.

This is the property name in the IDENTIKEY Authentication Serverwhich corresponds to the

LDAP server attribute specified in the previous field.

For all possible values for these properties, see Section

5.1. User Properties

IDENTIKEY Authentication Server properties available for attribute mapping are: n n n n n n n n n n n n n n n n n n n n

User ID

User Name

Description

E-Mail

Mobile Phone Number

Phone Number

Password

Assigned DIGIPASS

Linked User ID, Linked User's Domain n

Users can be linked to other users by supplying the Linked User's

Domain and the Linked User ID fields. Both fields must have values supplied, either by having an LDAP attribute mapped to them, or by supplying a fixed value.

Local Authentication (set to 'Default' if unspecified)

Back-End Authentication (set to 'Default' if unspecified)

Expiration time

Disabled

Lock Count

Locked (set to ' False' if unspecified)

Offline Authentication (set to 'Default' if unspecified)

Virtual DIGIPASS Delivery Method

Virtual DIGIPASS MDC Profile

Virtual Signature Delivery Method

Virtual Signature MDC Profile

IDENTIKEY Appliance 3.11.12 - Administrator Reference

2. Configuration Tool: Field Listings

Table 31: IDENTIKEY Authentication Server LDAP User Synchronization: Attribute Mapping Fields (continued)

Field Name Description

Destination This is the domain and (optionally) the organizational unit in the where user accounts will be copied to or updated. If the domain is changed after user accounts have already been copied, the user accounts are copied to the new domain but not deleted from the previous domain. If the organizational unit is changed to another one in the same domain, user accounts which have been created or updated by this synchronization profile are moved from the old to the new location.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

3. SSL Cipher Suites

SSL cipher suites can be used with SOAP and SEAL communicators. IDENTIKEY Appliance supports SSL cipher suites defined under the security level labels Very High, High, Medium, and Low.

n n n

SEAL will accept SSLv2 and SSLv3 connections.

SOAP will only accept SSLv3 and TLSv1 connections.

RADIUS/EAP protocols will accept SSLv2 and SSLv3 connections.

The security levels are applied to the following communication protocols: n n n

SOAP

SEAL

RADIUS (RADIUS / EAP-TTLS and RADIUS / PEAP only)

Table 32: Cryptographic Protocols Supported in Different Cipher Suite Security Levels

SSL Cipher Suite

Security Level

Cryptographic Protocol Support

SSLv2 SSLv3 TLSv1 TLSv1.1

Very High

High

Medium

Low

TLSv1.2

3.1. Default Security Levels for SSL Cipher Suites

For each communication interface of IDENTIKEY Appliance, the SSL cipher suite security level is set by default. The following table lists these default level settings.

Table 33: Default SSL Cipher Suite Security Levels for Communication Interfaces

IDENTIKEY Authentication Server Communication Interface

IDENTIKEY Authentication Server SOAP Communicator

IDENTIKEY Authentication Server SEAL Communicator with SSL/TLS

IDENTIKEY Authentication Server RADIUS Communicator

IDENTIKEY Authentication Server Live Audit Connection (SEAL)

Default Security Level of

SSL Cipher Suite

Very High

Medium

Very High

You can configure a communicator that is enabled with SSL/TLS to use another than the default SSL cipher suite security level and select either Very High , High , Medium , or Low via the Configuration Tool. Navigate to Authentication Server and select the required communicator to configure the cipher suite security level.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

3. SSL Cipher Suites

3.1.1. Blocked Cipher Suites

The IDENTIKEY Authentication Server communication interfaces, when configured to use SSL/TLS, will actively block certain cipher suites. All IDENTIKEY Authentication Server components actively block the suites to which the criteria listed below apply. This also includes custom cipher suites, i.e. if the criteria also apply to custom-defined cipher suites, the IDENTIKEY Authentication Server components will also actively block these suites.

Criteria for cipher suites to be blocked: n n n n n n

All cipher suites which do not offer encryption

All cipher suites which do not offer authentication

All export encryption algorithms

Cipher suites defined by OpenSSL as low encryption

All cipher suites which use MD5 as hashing algorithm

All cipher suites that use pre-shared keys

3.1.2. Cipher Suites in IDENTIKEY Authentication Server Web Administration Service

The following cipher suites are accepted by the IDENTIKEY Authentication ServerWeb Administration Service :

Table 34: Overview of Cipher Suites in the Web Administration Service

Cipher Suite Cryptographic Key

Exchange

Protocol(s)

Authentication

Encryption MAC

ECDH

RSA

ECDSA

Algorithm

AESGCM(128) AEAD

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 * TLSv1.2

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_

SHA256 *

TLSv1.2

TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 * TLSv1.2

TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256

TLSv1.2

TLS_RSA_WITH_AES_128_GCM_SHA256 *

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 *

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_

SHA384 * °

TLSv1.2

TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 * ° TLSv1.2

TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384

* °

TLSv1.2

TLS_RSA_WITH_AES_256_GCM_SHA384 * ° TLSv1.2

ECDH/RSA ECDH

ECDH/ECDSA ECDH

RSA

ECDH

RSA

ECDSA

ECDH/RSA ECDH

ECDH/ECDSA ECDH

RSA RSA

AESGCM(128) AEAD

AESGCM(256) AEAD

IDENTIKEY Appliance 3.11.12 - Administrator Reference

4. RADIUS Dictionary Format

A custom RADIUS dictionary can be uploaded. This file contains dictionary translations for parsing requests and generating responses. This section describes the format and syntax of such a dictionary file. The format is derived from the RADIUS 5 spec, dated July 1996.

All transactions are composed of Attribute/Value Pairs. The value of each attribute is specified as one of these valid data types: n n n n n n n n n n n n n hexadecimal: Hexadecimal string hex1, hex4:1- or 4-byte hexadecimal number string: 0-254 octets (includes null terminator) stringnz: 0-254 octets (without null terminator) ipv6addr: 16 octets in network byte order (per RFC-3162) ipv6prefix: 2-18 octets in network byte order (per RFC-3162) ipv6interface: 8 octets in network byte order (per RFC-3162) ipaddr: 4 octets in network byte order ipaddr-pool: IP address selected from an IP address pool ipxaddr-pool: IPX network number selected from an IPX address pool integer: 32 bit value in big endian order (high byte first) int1, int4: 1- or 4-byte decimal number (integer is equivalent to int4) time: 32 bit value in big endian order seconds since 00:00:00 GMT, Jan. 1, 1970

All attribute names and value names in the supplied RADIUS dictionary file are derived from the Radius spec by replacing all non-alphanumeric characters with dashes ('-').

The following rules apply to the creation and use of dictionaries: n n n

All comments begin with a '#' character in column 0 OR appear on a attribute or value line with "<whitespace>#<white-space>" as the MANDATORY delimiter between dictionary data and comment text.This is a simple parser.

All attribute (and attribute value) names and numeric codes must be unique within this dictionary.

There are three meaningful line entry formats in the dictionary, one for vendor, one for attributes and one for attribute values :

VENDOR_KEY VENDOR_NAME VENDOR_CODE [COMMENT_DELIMITER COMMENT_TEXT]

ATTRIBUTE_KEY ATTRIBUTE_NAME ATTRIBUTE_CODE DATA_TYPE FLAGS [COMMENT_DELIMITER COMMENT_

TEXT]

VALUE_KEY ATTRIBUTE_NAME VALUE_NAME VALUE_CODE [COMMENT_DELIMITER COMMENT_TEXT] n

Legend for last column of an attribute entry n n n n n

'c': indicates a SINGLE valued attribute that is a candidate for inclusion in a user's check list

'C' : indicates a MULTI valued attribute that is a candidate for inclusion in a user's check list

'r': indicates a SINGLE valued attribute that is a candidate for inclusion in a user's reply list

'R': indicates a MULTI valued attribute that is a candidate for inclusion in a user's reply list

'o','O' : ordered attribute, some attributes (e.g. Reply-Message) may need to be presented in a particular order to make sense.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

4. RADIUS Dictionary Format

Note

- Absence of any of {C,c,R,r} flags indicates an item that is neither a reply nor check list item (e.g. State, Proxy-

State).

- All FLAG characters on a given attribute line must be clustered together to parse properly (i.e. no white space is allowed between individual characters).

Source: http://www.juniper.net/techpubs/en_ US/uac/topics/reference/general/uac- radius- dictionaryguidelines.html

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5. IDENTIKEY Authentication Server Administration Web Interface

Field Listings

5.1. User Properties

5.1.1. Dashboard

Table 35: User - Dashboard

Field Name Description

Account Overview

This section provides an overview of the DIGIPASS user account. You can also obtain this information from the User Account tab.

For a detailed description of the user account fields, refer to Section

5.1.2. User Account

Last Authentication The date and time of the last authentication for this user.

Account Status

Expires

Static Password

Specifies whether a DIGIPASS user account is enabled or disabled. If disabled, all requests for the user will be rejected by IDENTIKEY Authentication Server.

The date on which the user account cannot longer be used for authentication.

Administration Privileges

Policy Overrides

The static password. This may be used for static password checking by the

IDENTIKEY Authentication Server or may be a record of a password in a back-end system.

Indicates if the user has administrative privileges set.

This section contains information about user-specific settings that override the settings in the applicable policy. You can also obtain this information from the Policy Overrides tab.

For a detailed description of the policy overrides settings, refer to Section

5.1.4. Policy Overrides

Local Authentication Indicates if there are policy overrides for the local authentication setting in the applicable policy.

Back-End Authentication

Offline Authentication

Indicates if there are policy overrides for the back-end authentication setting in the applicable policy.

Indicates if there are policy overrides for the offline authentication setting in the applicable policy.

Virtual DIGIPASS

Virtual Signature

Indicates if there are policy overrides for the Virtual DIGIPASS setting in the applicable policy.

Indicates if there are policy overrides for the Virtual Signature setting in the applicable policy.

User Info

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 35: User - Dashboard (continued)

Field Name Description

This section contains general user information. You can also obtain this information from the User Account tab.

For a detailed description of the user info fields, refer to Section

5.1.2. User Account .

User Name The full name of the user; ODBC database only.

Phone

Mobile

The user's phone number; ODBC database only.

The user's mobile phone number; this may be used for Virtual DIGIPASS logins.

Email Address

ODBC database only.

The user's e-mail address; this may be used for Virtual DIGIPASS logins.

Description

ODBC database only.

Any descriptive text or notes; ODBC database only.

Assigned DIGIPASS

This section contains information about the five last used DIGIPASS authenticators assigned to this user. You can access the Assigned

DIGIPASS tab by selecting the corresponding hyperlink; for more information on this tab, refer to Section

5.1.3. Assigned DIGIPASS .

Serial Number

DIGIPASS Type

Status

The serial numbers of the last five DIGIPASS authenticators assigned to the relevant user.

For instance DIGIPASS 300.

Active Applications

Virtual DIGIPASS (VDP)

Displays the expiration date of the authenticator or if it is already expired; this field can also display the grace period expiration date or if the end of the grace period has already been reached.

This field lists all active applications for the relevant authenticator.

Indicates which type of VDP the relevant authenticator is - possible values are

Primary and Backup .

Recent Activity

This section lists the five last activity records for a user. You can also obtain information on recent user activity from the Recent Activity tab.

For a more detailed description of the recent activity fields, refer to Section

5.1.8. Recent Activity

Time The date and time when the user activity was recorded.

Category

Description

The category of the audit message.

The textual description of the audit message.

Used Clients

This section lists the five last client components used by the selected user. You can also obtain information on recently used clients from the

Recent Activity tab.

For a more detailed description of the recent activity fields, refer to Section

5.1.8. Recent Activity

Time The time at which the last activity for the relevant used client was recorded.

Client Type States which type the used client is.

Click the client identifier to go to the Client Properties page for this client.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 35: User - Dashboard (continued)

Field Name

Policy ID The policy related to the used client.

Description

Click the policy ID to go to the Policy Properties page for this policy.

5.1.2. User Account

Table 36: User - User Account

Field Name

User ID

Organizational Unit

Last Authentication

Account Status

Expires

Lock Count

Static Password

Last Password Update

User Info

User Name

Phone

Description

ID of the selected user.

ODBC database only; lists the organizational unit in which the user is located. This is optional as the user does not have to be located in an organizational unit.

Read only. The Move command must be used to change this.

The date and time of the last authentication for this user. This field is used to determine how many days an account has remained inactive. This field will be populated for the first time during the first authentication.

Specifies whether a DIGIPASS user account is enabled or disabled. If disabled, all requests for the user will be rejected by IDENTIKEY Authentication Server.

It is possible to set the date on which the user account cannot longer be used for authentication. This field is typically used for temporary users such as contractors or external auditors. IDENTIKEY Authentication Server does not automatically delete

"expired" users.

Specifies whether a DIGIPASS user account is locked or not. If locked, all requests for the user will be rejected by the IDENTIKEY Authentication Server.

The Locked indicator is normally set automatically when the user exceeds a certain number of failed authentication attempts. The User Lock Threshold is set in the policy.

The static password. This may be used for static password checking by the

IDENTIKEY Authentication Server or may be a record of a password in a back-end system.

In view mode, the system will only show whether a password is set or not.

The Set Password and Reset Password commands are used to change this, although it can also be entered when creating the DIGIPASS user account.

Date and time of the user's last static password update.

The full name of the user; ODBC database only.

The user's phone number; ODBC database only.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

Email Address

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 36: User - User Account (continued)

Field Name

Mobile

Description

The user's mobile phone number; this may be used for Virtual DIGIPASS logins.

ODBC database only.

The user's e-mail address; this may be used for Virtual DIGIPASS logins.

ODBC database only.

Any descriptive text or notes; ODBC database only.

Description

Account Linking

Linked User ID It is possible to share a DIGIPASS authenticator between different user accounts, by linking user accounts together. This feature is intended for the case where one person, such as an administrator, has multiple user accounts. If their accounts are linked, there is no need to give more than one DIGIPASS authenticator to that person.

This feature is used by assigning the DIGIPASS authenticator to one user account, then linking all the other user accounts for the person to the one that has the

DIGIPASS authenticator.

This field is read only.

ODBC Database only:

If a user is linked to another user, their Linked User Account field will show the user

ID and domain of the linked user, for example: testuser [vasco.com]

Update History

Created

Modified

The date and time that the DIGIPASS user account was created. Read-only.

The date and time that the DIGIPASS user account was last modified. Read-only.

5.1.3. Assigned DIGIPASS

In this tab, all authenticators assigned to the selected user are listed. For each DIGIPASS authenticator, the list of active applications is given with the application type indicated in brackets (). For example:

0058384426 RESP_ONLY(RO), CHALLENGE(CR)

In this example line, the DIGIPASS authenticator with serial number 0058384426 has two active applications: one response-only application RESP_ONLY and oneChallenge/Response application CHALLENGE.

If the user does not have any DIGIPASS authenticator assigned directly, but is linked to another user to use the

DIGIPASS authenticator (see Linked User Account ), the linked user's DIGIPASS authenticator list is shown with the serial numbers in square brackets (eg. [0058384426]).

When a DIGIPASS authenticator in the list is selected, the remainder of the property sheet tab indicates values from the corresponding DIGIPASS record.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Read-only.

5.1.4. Policy Overrides

Table 37: User - Policy Overrides

Field Name

Local Authentication

Description

Specifies whether authentication requests for the user account will be handled by the

IDENTIKEY Authentication Serverusing Local Authentication. For more information about local authentication and back-end authentication, refer to the IDENTIKEY Authentication Server

Product Guide , Section " Authenticating Users" .

Normally, this field will be Default , meaning that the policy applicable to the authentication request determines the setting. This field in the DIGIPASS user account is used to override the policy setting for special cases.

When local authentication is used, there are two factors that determine whether DIGIPASS authentication is used – any policy restrictions on DIGIPASS types and/or applications that can be used and whether the DIGIPASS user account has any assigned DIGIPASS authenticator that meets the restrictions. For example, if the policy requires a DIGIPASS 300, but the user has a DIGIPASS 700, the user cannot use DIGIPASS authentication under that policy.

Possible values: n n n n n

Default . Use the setting of the parent policy.

None . IDENTIKEY Authentication Server will not use local authentication under this policy. They may be handled using back-end authentication or not handled at all by

IDENTIKEY Authentication Server.

Digipass Only . IDENTIKEY Authentication Server will always use local authentication under this policy, using DIGIPASS authentication. If DIGIPASS authentication is not possible, the user cannot log in. Back-end authentication may also be used.

DIGIPASS/Password during Grace Period . IDENTIKEY Authentication Server will always use local authentication under this policy; possibly using DIGIPASS Authentication for Windows Logon if applicable. The static password can only be used within a (configurable) grace period until a DIGIPASS authenticator is used the first time.

Back-end authentication may also be used.

DIGIPASS or Password . This authentication mode allows users to permanently use their static password or their DIGIPASS authenticator, even after the grace period has expired and/or they have previously already used their authenticator for authentication. Use of this authentication mode is subject to licensing.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 37: User - Policy Overrides (continued)

Field Name

Back-End Authentication

Description

Specifies whether authentication requests for the user account will be handled by the

IDENTIKEY Authentication Server using back-end authentication. For more information about local authentication and back-end authentication, refer to the IDENTIKEY Authentication Server

Product Guide , Section " Authenticating Users" .

Normally, this field will be Default , meaning that the policy applicable to the authentication request determines the setting (see

Table 52: Policy Properties - Policy ). This field in the

DIGIPASS user account is used to override the policy setting for special cases.

Possible values:

Default

None

If Needed

Always

Use the setting of the parent policy.

Back-end authentication will not be used.

IDENTIKEY Appliance will utilize back-end authentication but only in certain cases: n n n n n

Dynamic User Registration

Self-Assignment

Password Autolearn

Requesting a challenge or Virtual

DIGIPASS OTP, when the request method includes a password

Static password authentication, when verifying a Virtual DIGIPASS password-

OTP combination, during the grace period, or if the local authentication mode is set to DIGIPASS or Password .

Provisioning registration n

IDENTIKEY Appliance will use back-end authentication for every authentication and provisioning registration request.

This setting is required, if you want to use offline authentication for DIGIPASS Authentication for Windows Logon.

To enforce static password verification during offline authentications via DIGIPASS Authentication for

Windows Logon, you need to disable Stored Password Proxy and set Back-End Authentication to

Always .

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 37: User - Policy Overrides (continued)

Field Name

Offline Authentication

Description

Indicates whether offline Authentication has been enabled for this user for Windows Logon.

When offline authentication is disabled for a user, be aware of the following: n n

Disabling offline authentication for a user means that IDENTIKEY Authentication

Server will not send any new encrypted offline logon data to the client PC .

Disabling offline authentication for a user means that the user will still be able to use offline authentication from the time that it is disabled until the encrypted offline logon data has expired OR until the user performs their next online authentication.

The options are: n n n

Default - the settings for offline authentication are dependent on the prevailing policy settings.

No - offline authentication is not enabled.

Yes - offline authentication is enabled

This function is only available if Windows Logon is enabled on your system.

Virtual DIGIPASS

Virtual DIGIPASS Delivery Method The method used to deliver the Virtual DIGIPASS to the selected user. The options are: n n n n

Default - Use the settings of the parent policy

Email - Deliver the OTP via email. Requires an email address to be set up for the user.

SMS - Deliver the OTP via SMS. The DIGIPASS user account must have a mobile phone number.

Voice - Deliver the OTP via voice channel (i.e. dictated over a phone line).

Virtual DIGIPASS MDC Profile

The DIGIPASS user account must have a mobile phone number. This field also allows you to specify a combination of delivery methods, specifically: n n n

Email and SMS

SMS and Voice

Email and Voice

The MDC profile whose settings should be used for this delivery method. An MDC profile defines a specific group of settings for a particular delivery method. If there is no specified

MDC profile in this field, then the highest-ranked, enabled, and available MDC profile for the specified delivery method/s will be used.

The MDC profile name should not be confused with the profile's display name. The display name is simply an ad-hoc field used primarily to describe and further identify the profile. The

MDC profile name is the name that appears in the Profile column of the MDC Configuration

GUI.

The MDC profile name is non-unique; as such, multiple MDC profiles with the same name may exist for this delivery method. The highest-ranked, enabled, and available MDC profile with the specified MDC profile name will be used.

Virtual Signature

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 37: User - Policy Overrides (continued)

Field Name

Virtual Signature Delivery Method

Description

The method used to deliver the virtual signature to the selected user. The options are:

Virtual Signature MDC Profile n n n n

Default - Use the settings of the parent policy

Email - Deliver the OTP via email. Requires an email address to be set up for the user.

SMS - Deliver the OTP via SMS. The DIGIPASS user account must have a mobile phone number.

Voice - Deliver the OTP via voice channel (i.e. dictated over a phone line). The

DIGIPASS user account must have a mobile phone number.

This field also allows you to specify a combination of delivery methods, specifically: n n n

Email and SMS

SMS and Voice

Email and Voice

The MDC profile whose settings should be used for this delivery method. An MDC profile defines a specific group of settings for a particular delivery method. If there is no specified

MDC profile in this field, then the highest-ranked, enabled, and available MDC profile for the specified delivery method/s will be used.

The MDC profile name should not be confused with the profile's display name. The display name is simply an ad-hoc field used primarily to describe and further identify the profile. The

MDC profile name is the name that appears in the Profile column of the MDC Configuration

GUI.

5.1.5. User Attributes

Refer to Section

5.2. User Attributes

for the list of user attributes in this tab.

5.1.6. Admin Privileges

A list of all administrative privileges assigned to the selected user. Refer to Section

5.4. Administrative Privileges

for more information on administrative privileges.

5.1.7. Offline Authentication

Table 38: User - Offline Authentication

Field Name

Client

Description

The client to which the offline authentication data was sent for this user.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 38: User - Offline Authentication (continued)

Serial Number

DIGIPASS Type

Offline Data

Field Name Description

Serial number of the DIGIPASS authenticator used to generate the one-time password used for authentication.

Type of DIGIPASS used to generate the one-time password for authentication.

The date and time or the event block for which the offline authentication data was generated.

5.1.8. Recent Activity

Table 39: User - Recent Activity

Field Name

Time

Code

Description

Category

Client

DIGIPASS

Policy ID

Reason

Description

The date and time when the user activity was recorded.

The audit message code of the user activity.

If you click a particular code, the respective audit message record is displayed (see

5.8. Audit Message ).

The textual description of the audit message.

The category of the audit message.

The location of the client component that triggered the audit message.

If you click a particular client, the properties of the respective client component are displayed (see

5.11. Client Properties ).

The serial number of the DIGIPASS authenticator associated with the audit message.

If you click a particular policy, the properties of the respective DIGIPASS authenticator are displayed (see

5.6. DIGIPASS Properties ).

The identifier of the policy handling the request.

If you click a particular policy, the properties of the respective policy are displayed (see

5.9. Policy Properties ).

The textual description indicating the reason for a failure.

5.1.9. Reports

Refer to Section

5.3. User Reports

for the list of reports available in this tab.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.1.10. Further User Fields

Table 40: User - Further User Fields

Field Name

New Password

Confirm Password

Domain

Description

These fields are used to modify the static password that is stored in the DIGIPASS user account. If they are left blank, no modification is made.

The domain to which the user belongs; ODBC database only.

Read only. This cannot be changed.

5.2. User Attributes

Table 41: User Attribute Fields

Field Name Description

Attribute Group

Name

Attribute Groups provide a way to add different attributes to the user account for different client components.

Client Components – an SBR Plug-In, IIS Module, or custom SOAP applications – may request a specific attribute group during an authentication request. IDENTIKEY Appliance will return any custom user attributes set for that user in the specified attribute group.

RADIUS reply attributes may be returned to RADIUS clients. The attribute group(s) to be used are specified in the policy.

See the IDENTIKEY Appliance Product Guide , Section User Attributes for further information.

The name of the attribute.

Custom User attributes: This must match the name of an attribute expected by the client component. For the DIGIPASS Pack for IIS Basic Authentication, this would be either User-Name or

Password.

RADIUS attributes: This must match an entry in the RADIUS dictionary in use by the IDENTIKEY

Appliance. For relevant instructions, refer to the section on how to customize the RADIUS attributes dictionary in the IDENTIKEY Appliance Administrator Guide .

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 41: User Attribute Fields (continued)

Field Name Description

Usage

Value

Specifies the usage of the user attribute. This is an optional setting, not available for RADIUS attributes.

Options:

Basic Designates an attribute used by the DIGIPASS module for IIS Basic

Authentication.

Check

Profile

Used to specify a check attribute for SBR, where the SBR plug-in is in use. Refer to the DIGIPASS Authentication for Steel-Belted Radius

Server Administrator Guide for more information.

Used to specify the name of a RADIUS profile for SBR, where the SBR plug-in is in use.

Return Used to specify a return attribute for SBR, where the SBR plug-in is in use.

This value of the attribute. In the DIGIPASS module for IIS Basic Authentication example above, this would be a user ID or password.

5.3. User Reports

For generating a user-specific report from the Reports tab in the User Properties page, by default, the following reports are available:

Table 42: Default Reports

Report

Account Lock Trend

Administration Activity Summary

Authentication Activity by User

Authentication Trend

Detailed Activity Summary

Detailed Authentication

Detailed DIGIPASS Registration Digipass:User ID

Digipass:Domain

Default Fieldss

Detailed Provisioning

Detailed Signature Validation

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 42: Default Reports (continued)

Report

DIGIPASS About To Expire

Default Fieldss

DP Assignment Activity Summary

DP Last Authentication List

Expired DIGIPASS

Digipass:User ID

Digipass:Domain

Digipass:User ID

Digipass:Domain

Digipass:User ID

Digipass:Domain

Digipass:User ID

Digipass:Domain

Failed Operations Summary

Inactive DIGIPASS List Digipass:User ID

Digipass:Domain

Provisioning Activity by User

Provisioning Activity Trend

RADIUS User Activity Summary

RADIUS User Detailed Activity

Signature Validation History

Succeeded Operations Summary

Transaction Signing Activity by User

Transaction Signing Activity Trend

5.4. Administrative Privileges

Most administrative privileges rely on other privileges to work correctly.

The following information lists the available privileges and the privileges set by IDENTIKEY Authentication Server when each is assigned to a user via the Administration Web Interface.

Table 43: Administrative Privileges – ODBC Data Store

Privilege Name Depends On Notes

Access Data in All Domains Administrative Logon With this, an administrator can view and manage data in all domains, not just their own.

Only available if the user belongs to the master domain and not to an organizational unit.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Access Domain Administrative Logon

Administrative Logon

IDENTIKEY Authentication

Server System Logon

Administrative Logon

When this permission is set, it allows generating reports for all orgunits in the entire domain of the administrator.

Required for all administrators.

Without this privilege, the user will not be able perform any administration because they will not be able to log on.

It could be removed as a temporary measure without removing all the user’s privileges.

This privilege controls the IDENTIKEY Authentication Server system logon. Without this privilege, the user will not be able to log on to the system administration interface of the IDENTIKEY Authentication

Server.

Assign DIGIPASS

Appliance Administration

Administrative Logon

View User

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon This privilege specifies whether the user is allowed to modify the

IDENTIKEY Appliance system administration settings using the

IDENTIKEY Appliance Configuration Tool.

Bind DIGIPASS

Cancel Task

Change Report File Ownership

Change Report Owner

Create Back-End Server

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View Task

Administrative Logon

View User

View Domain

View Organizational Unit

View Report File

Administrative Logon

View User

View Domain

View Organizational Unit

View Report Definition

Administrative Logon

View Back-End Server

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Create Component Administrative Logon

View Policy

View Component

Create Domain Administrative Logon

Access Data in All Domains

View Domain

Create EMV-CAP Application Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Only available if the user belongs to the master domain and not to an organizational unit.

Allows creation of EMV-CAP DIGIPASS records, including the BLOB.

This privilege will only be available if: n n

The HSM, EMV-CAP and EMV-CAP Provisioning license options are all enabled

The administrator account is located in the Master domain

Create Key

Create Organizational Unit

Create Policy

Create Report Definition

Create User

Deactivate DIGIPASS

Delete Admin Session

Administrative Logon

View Key

Administrative Logon

View Domain

View Organizational Unit

Administrative Logon

View Policy

Administrative Logon

View Report Definition

Administrative Logon

View User

Unlock User

Enable User

Disable User

Set User Expiration

Set User Password

Reset User Password

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View Admin Session

Create report definition and report format.

Create user and user attribute.

This privilege allows an administrator to deactivate a

DIGIPASS authenticator, or, in the context of Multi-Device Licensing and Activation, to generate a deactivation message for a specific

DIGIPASS instance.

With this privilege an administrator can delete any administrative session.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Delete Back-End Server

Delete Component

Delete DIGIPASS

Administrative Logon

View Back-End Server

Administrative Logon

View Component

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Delete Domain

Allows an administrator to delete aDIGIPASS authenticator from the storage: delete DPSoftParams, DIGIPASS and DIGIPASS Applications.

In the context of Multi-Device Licensing and Activation, when administrating DIGIPASS licenses as well as instances, when a DIGIPASS license is deleted, its DIGIPASS instances are also deleted. Only when DIGIPASS instances or only deactivated DIGIPASS instances linked to this DIGIPASS license exist, can the DIGIPASS license be deleted.

Only available if the user belongs to the master domain and not to an organizational unit.

Delete Key

Delete Organizational Unit

Delete Policy

Delete Report Definition

Delete Report File

Delete Task

Delete User

Disable Server PIN

Administrative Logon

Access Data in All Domains

View Domain

Administrative Logon

View Key

Administrative Logon

View Domain

View Organizational Unit

Administrative Logon

View Policy

Administrative Logon

View Report Definition

Administrative Logon

View Report File

Administrative Logon

View Task

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Delete report definition and report format.

Delete user and user attribute.

With this privilege an administrator can disable the use of a Server

PIN with a specific DIGIPASS Application

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Disable User

Download Report File

Enable Server PIN

Enable User

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

View Report File

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Force DIGIPASS PIN Change Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Generate DIGIPASS Activation Data

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Generate Virtual DIGIPASS

OTP

Import DIGIPASS

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

With this privilege an administrator can enable the use of a Server

PIN with a specific DIGIPASS Application.

This administrative privilege is only valid with DIGIPASS for Mobile

4.0

Create DIGIPASS Applications (you do not directly create DIGIPASS); create and update DPSoftParams; upload, import, query status and stop import for DPX File.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Import User

Link User

Live Audit Connection

Administrative Logon

Assign DIGIPASS

Create User

Disable User

Enable User

Reset Last Authentication

Time

Reset Password

Set DIGIPASS Expiration

Set Password

Set User Expiration

Unlock User

Update User

View DIGIPASS

View User

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

Link a user to another DIGIPASS user

Move DIGIPASS

With this, an administrator can connect from the Audit Viewer to the Authentication Server to receive live audit messages.

Move a DIGIPASS within the existing organizational structure (other domain, other organizational structure)

Move User

Replication Reconnect

Replication Status

Reset DIGIPASS Activation

Reset DIGIPASS Application

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

Replication Status

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Move user to an organizational unit

When resetting aDIGIPASS authenticator that has been activated in multi-device activation mode, the information related to Activation

Message 1 for DIGIPASS licenses is being reset with the action corresponding to this privilege.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Reset DIGIPASS Application

Lock

Reset DIGIPASS PIN

Reset Last Authentication

Time

Reset Offline Authentication

Data

Reset User Password

Resume Task

Rotate Key

Run Report

Send DIGIPASS Activation

Data

Send Notification

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

View User

View Component

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

View Task

Administrative Logon

View Key

Administrative Logon

View Report Definition

Administrative Logon

View Domain

View DIGIPASS

View Organizational Unit

Administrative Logon

With this privilege, an administrator can reset the offline authentication history for a certain user or for a certain user/computer combination.

With this privilege, an administrator can send notification messages to a specified user, e.g. for delayed or completed DIGIPASS activation.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Set Administration Domains Set Administrative Privileges

View Administrative Privileges

View User

View Domain

View Organizational Unit

Administrative Logon

Set Administrative Privileges Administrative Logon

View User

View Administrative Privileges

View Domain

View Organizational Unit

Set Authentication Policy

Overrides

Administrative Logon

Set DIGIPASS Event Counter Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Set DIGIPASS Expiration Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Set DIGIPASS PIN

Set User Expiration

Set User Password

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Authentication policy overrides administrative privilege.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Suspend Task

Take Report File Ownership

Take Report Ownership

Take Task Ownership

Test DIGIPASS OTP

Test DIGIPASS Signature

Unassign DIGIPASS

Administrative Logon

View Task

Administrative Logon

View Report File

Administrative Logon

View Report Definition

Administrative Logon

View Task

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

With this privilege an administrator can take ownership of any report file.

With this privilege an administrator can take ownership of any report.

With this an administrator is able to test-validate a one-time password in a Response-Only or Challenge/Response scenario .

With this an administrator is able to test-validate a signature. It can also be used as an optional third step in the administrator-initiated multi-device activation process where a signature generated by

DIGIPASS upon receiving Activation Message 2 is validated.

When unassigning aDIGIPASS authenticator that has been activated in multi-device licensing mode, it is not possible to unassign a

DIGIPASS license when a DIGIPASS instance, activated or deactivated, linked to the DIGIPASS license, exists. A DIGIPASS instance can never be unassigned.

Unbind DIGIPASS

Unlink User

Unlock DIGIPASS

Unlock User

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View User

View Domain

View Organizational Unit

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

Update Back-End Server

Update Back-End Settings

Update Component

Update DIGIPASS

Update Domain

Update Key

Update Organizational Unit

Update Policy

Update Report Definition

Update Task

Update User

View Admin Session

Administrative Logon

View Back-End Server

Administrative Logon

View Back-End Settings

Administrative Logon

View Policy

View Component

Administrative Logon

View DIGIPASS

View Domain

View Organizational Unit

Administrative Logon

View Domain

Administrative Logon

View Key

Administrative Logon

View Domain

View Organizational Unit

Administrative Logon

View Policy

Administrative Logon

View Report Definition

Administrative Logon

View Task

Administrative Logon

Disable User

Enable User

Reset Offline Authentication

Data

Set User Expiration

Unlock User

View Domain

View Organizational Unit

View User

Administrative Logon

With this privilege an administrator can updated the general backend server settings.

Update DIGIPASS and DIGIPASS Applications.

Update report definition; create, update and delete report format.

Update user; create, update and delete user attributes.

With this privilege an administrator can view active admin sessions.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

View Administrative Privileges

View Audit Information

Administrative Logon

View User

View Domain

View Organizational Unit

Administrative Logon This privilege provides access to the internal IDENTIKEY Appliance Audit Viewer and allows the administrator to browse to the

View Audit Message page using the audit message identifier

(AMID) as input parameter.

View Back-End Server

View Back-End Settings

Administrative Logon

Administrative Logon With this privilege an administrator can view the general back-end server settings.

With this privilege an administrator can view the PAN in clear text rather than encrypted format.

View Clear PAN Administrative Logon

View DIGIPASS

Administrative Logon View Component

View DIGIPASS

View Domain

View EMV PAN

Administrative Logon

View Domain

View Organizational Unit

Administrative Logon

View Domain

View Organizational Unit

Administrative Logon View Key

View Organizational Unit Administrative Logon

View Domain

Administrative Logon View Policy

View Recent DIGIPASS Activity

View DIGIPASS

View and query for DPSoftParams, DIGIPASS and DIGIPASS Application. Also permits the

Get Info

command.

Allows to look up recent authentication, signature validation, provisioning, and administration activity of any DIGIPASS authenticator within the allowed domain scope.

This privilege affects the commands in the Dashboard tab and the

Recent Activity tab as well as the respective SOAP commands when using the IDENTIKEY Authentication Server SDK.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 43: Administrative Privileges – ODBC Data Store (continued)

Privilege Name Depends On Notes

View Recent User Activity View User Allows to look up recent authentication, signature validation, provisioning, and administration activity of any DIGIPASS user within the allowed domain scope.

This privilege affects the commands in the Dashboard tab and the

Recent Activity tabs as well as the respective SOAP commands when using the IDENTIKEY Authentication Server SDK.

View and query for both report definition and report format.

View Report Definition

View Report File

View Task

View User

Administrative Logon

View Domain

View Organizational Unit

View and query users and user attributes.

5.5. Find/Manage DIGIPASS

Table 44: Find/Manage DIGIPASS Criteria

Domain

Field Name Description

The domain to which the DIGIPASS authenticator belongs.

Organizational Unit

Serial Number/s

Serial Number List

DIGIPASS Type

Application Name

Application Type

This field is read-only. The

Move

command must be used to change this.

The domain to which the DIGIPASS authenticator belongs.

This field is read-only. The

Move

command must be used to change this.

A range of serial numbers can be used to search for a DIGIPASS authenticator.

A comma-separated list of serial numbers to search for a DIGIPASS authenticator.

The type of DIGIPASS represented by the DIGIPASS record (e.g. DIGIPASS 300).

The DIGIPASS application is selected via this list.

Search a DIGIPASS authenticator by type; the following choices are available in the list: n n n n n n n

Any

Response-Only (RO)

Challenge/Response (CR)

Signature (SG)

Multi-Mode (MM)

Unlock (UL)

Master-Activation (MA)

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 44: Find/Manage DIGIPASS Criteria (continued)

Field Name

Secure Channel Support? The following options are available:

Assigned?

Validity Start

Expiration

Description

Results per page

(10~100)

Description n n n

Not Applicable

Yes

When the application type has been set to Any or Signature , Secure Channel support cannot be enabled.

The following options are available: n n n

Not Applicable

Yes

The DIGIPASS start time. This is the date and time when an activated (software) DIGIPASS authenticator can effectively be used for authentication and signature operations.

For more information about delayed activation, refer to the IDENTIKEY Authentication Server Product

Guide and the IDENTIKEY Authentication Server Administrator Guide.

Fields to enter a data range for the DIGIPASS expiration.

A custom text description of the DIGIPASS authenticator. This can be used to search for specific attributes of a DIGIPASS authenticator, e.g. color, company logo.

A text field to filter the number of results displayed per page.

5.6. DIGIPASS Properties

5.6.1. DIGIPASS

Table 45: DIGIPASS – DIGIPASS

Field Name

Domain Name

Description

The domain to which the DIGIPASS authenticator belongs.

Organizational Unit

DIGIPASS Type

Description

This field is read-only. The

Move

command must be used to change this.

The domain to which the DIGIPASS authenticator belongs.

This field is read-only. The

Move

command must be used to change this.

The type of DIGIPASS represented by the DIGIPASS record (e.g. DIGIPASS 300).

A custom text description of the DIGIPASS authenticator. This can be used to search for specific attributes of a DIGIPASS authenticator, e.g. color, company logo.

Assignment Status

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 45: DIGIPASS – DIGIPASS (continued)

Field Name

Reserve for Individual Assignment

Assigned to User

Description

When used, this option prevents the DIGIPASS from being assigned using the Auto-Assignment feature or by provisioning registration. It also prevents it from being assigned by an administrator who uses the

'Assign next available...' option in the assignment wizard.

User ID of the DIGIPASS user account that the DIGIPASS is assigned to, if it is assigned. This user account must be in the same domain as the DIGIPASS.

Assignment Date

Bind Status

Grace Period End

Valid From

Expires

Read-only. The

Assign

command must be used to change this.

The date and time when the DIGIPASS was assigned to its current user.

Read-only.

The bind status of a DIGIPASS for MobileDIGIPASS.

The date on which the grace period will expire, or did expire, for this DIGIPASS. If the date shows today's date or before, the grace period has already expired. If it is blank, there is no grace period.

Date and time when an activated (software) DIGIPASS authenticator can effectively be used for authentication and signature operations.

For more information about delayed activation, refer to the IDENTIKEY Authentication Server Product Guide and the IDENTIKEY Authentication Server Administrator Guide.

The expiration date and time of the DIGIPASS authenticator.

An expired DIGIPASS authenticator is ignored when processing authentication, administrative logon, signature validation, and provisioning requests.

Backup Virtual DIGIPASS

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 45: DIGIPASS – DIGIPASS (continued)

Field Name

BVDP Mode

Description

Specifies whether and how the Backup Virtual DIGIPASS feature can be used for this DIGIPASS. Note that in order for the Backup Virtual DIGIPASS feature to function, it must also be activated in the .dpx

file for the

DIGIPASS.

Normally, this field will be Default, meaning that the policy applicable to the authentication request determines the setting. This field in the DIGIPASS record is used to override the policy setting for special cases.

Options:

Enabled Until

Uses Remaining

Static Vector ID

Default

Yes - Permitted

Yes – Time Limited

Yes - Required

Use the setting of the effective policy.

Backup Virtual DIGIPASS is not permitted.

Backup Virtual DIGIPASS is permitted, but not mandatory.

The Enabled Until date is not applicable when using this option, but the Uses

Remaining count is.

Backup Virtual DIGIPASS is permitted, but not mandatory.

Both the Enabled Until date and the Uses Remaining count will be in effect.

Backup Virtual DIGIPASS is mandatory. This may be useful if the user may have lost the DIGIPASS, to prevent it from being used until they have found it again.

The Enabled Until date is not applicable when using this option, but the Uses

Remaining count is.

The date on which the Backup Virtual DIGIPASS feature may no longer be used, provided that the effective

Enable Backup VDP setting is Yes – Time Limited (it is ignored otherwise).

If this date is blank, it will be set automatically the first time that the user requests a Backup Virtual DIGIPASS

OTP, using the Backup Virtual DIGIPASS time limit defined in the policy.

Once this date has expired, it requires administrator intervention either to extend it or to reset it to blank for the next time that the user needs to use Backup Virtual DIGIPASS .

The remaining number of times that the Backup Virtual DIGIPASS feature may be used for this DIGIPASS.

Once this number has reached zero, Backup Virtual DIGIPASS can no longer be used with this DIGIPASS, unless the administrator increases it or resets it to blank.

If this number is blank and there is a Backup Virtual DIGIPASS Max. Uses/User defined in the policy, it will be set automatically the first time that the user requests a Backup Virtual DIGIPASS OTP, based on the Max.

Uses/User.

The presence of a value here indicates that a DIGIPASS is a software DIGIPASS capable of provisioning. Its specific value is not of use to an administrator normally. It represents a lookup key of a database record used in the provisioning process (DPSoft Parameters) that stores the static vector value.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 45: DIGIPASS – DIGIPASS (continued)

Field Name

Last Activation

Description

The date and time at which the last provisioning registration operation took place using this DIGIPASS, when an activation code was generated for it.

There is a configurable minimum interval of time between registration operations for a DIGIPASS. See the

Software DIGIPASS Provisioning Section in the IDENTIKEY Authentication Server Product Guide for more details.

Activation Locations

Activation Count

This value is reset to blank by the

Reset Activation

command.

This is typically only used for DIGIPASS for Web, to keep track of the number of different locations at which a particular user has activated it. The value is a comma-separated list of hash values, where each hash value represents one location.

There is a configurable maximum number of activation locations for a DIGIPASS. See the Software DIGIPASS

Provisioning Section in the IDENTIKEY Authentication Server Product Guide for more details.

This value is reset to blank by the

Reset Activation

command.

The total number of provisioning registration operations that have taken place using this DIGIPASS, when an activation code was generated for it. This includes registration operations for which the corresponding

Activate operation was not completed successfully.

There is a configurable maximum number of activation attempts for a DIGIPASS. See the Software DIGIPASS

Provisioning Section in the IDENTIKEY Authentication Server Product Guide for more details.

This value is reset to 0 by the

Reset Activation

command.

Update History

Created

Modified

The date and time that the DIGIPASS was created. Read-only.

The date and time that the DIGIPASS was last modified. Read-only.

5.6.2. License Information

This tab is only available, if a master activation application is linked to DIGIPASS - i.e. where DIGIPASS is a DIGIPASS license.

Table 46: DIGIPASS – License Information

Field Name

License Activation Limit

Activation Count

Description

The maximum number of activations for a DIGIPASS license.

The number of activated DIGIPASS licenses. When no DIGIPASS license has been activated, 0 is displayed as the field value.

Number of remaining allowed activations.

Activations Remaining

Activation Message

Challenge Generated At The date and time, when Activation Message 1 was generated. When Activation Message 1 was never generated, Never is displayed as field entry.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.6.3. Activation Information

Table 47: DIGIPASS – Activation Information (Standard Activation and Licensing)

Field Name Description

Last Activation Date / Time

Activation Locations

Activation Count

Time and date of the last DIGIPASS activation.

Location(s) from which the relevant DIGIPASS authenticator has been activated.

The number of activated DIGIPASS licenses. When no DIGIPASS license has been activated, 0 is displayed as the field value.

Table 48: DIGIPASS – Activation Information (Multi-Device Activation and Multi-Device Licensing)

Field Name Description

The fields listed below are only available if the selected DIGIPASS authenticator is a DIGIPASS instance.

License The serial number of the activated DIGIPASS license.

Device ID

Device Type

The ID of the activated DIGIPASS device.

The type of device on which the DIGIPASS license has been activated.

The following device types are possible:

Activation Confirmed At n n n n n n n n n n n n n

Hardware Device

Unknown software platform iOS

Jailbroken iOS

Android

Rooted Android

Windows Phone

BlackBerry Native

MIDP2 Platform or BlackBerry Java

Windows

Linux

Mac

RFU

The date and time, when Activation Message 2 was validated. When Activation Message 2 was never validated, Never is displayed as field entry.

5.6.4. Recent Activity

This tab displays a list of the recent authentication, signature validation, administration, and provisioning activity of a particular DIGIPASS authenticator. This tab is only available, if the administrator has the View Recent

DIGIPASS Activity privilege set.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 49: DIGIPASS – Recent Activity

Time

Code

Field Name Description

The date and time when the DIGIPASS activity was recorded.

The audit message code of the DIGIPASS activity.

Description

Category

Client

Policy ID

Reason

If you click a particular code, the respective audit message record is displayed (see

5.8. Audit Message

The textual description of the audit message.

The category of the audit message.

The location of the client component that triggered the audit message.

If you click a particular client, the properties of the respective client component is displayed (see

5.11. Client Properties ).

The identifier of the policy handling the request.

If you click a particular policy, the properties of the respective policy is displayed (see

5.9. Policy

Properties ).

The textual description indicating the reason for a failure.

5.7. DIGIPASS Application Tab

Table 50: DIGIPASS Application Fields

Field Name in Administration Interfaces

Description

Application Status

Application Type

This field indicates whether the application is active or not. If it is not active, it cannot be used for authentication, provisioning or signature validation.

Read-only. The

Activate Application

and

Deactivate Application

commands must be used to change this.

The type of DIGIPASS Application:

RO – Response Only

CR – Challenge/Response

SG – Signature

MA - Master Activation Application

Secure Channel Support This field indicates whether the application supports the Secure Channel feature or not by displaying either Yes or No .

Read-only.

Active

Attribute/Value list

This field can be used to deactivate an application, so that it cannot be used.

This list indicates various internal settings of the DIGIPASS Application.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 50: DIGIPASS Application Fields (continued)

Field Name in Administration Interfaces

Description

Created

Modified

The date and time that the DIGIPASS Application was created. Read-only.

The date and time that the DIGIPASS Application was last modified. Read-only.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.8. Audit Message

The Audit Message tab displays the details for an audit message listed in the Recent Activity tabs.

Table 51: Audit Message

Field Name Description

Date

Time

Type

Source

Category

The date at which the audit message was recorded.

The time at which the audit message was recorded.

The audit message type (code).

The audited component - i.e. the source of the audit message, e.g. "Identikey Server".

The category to which the audit message belongs.

Possible values:

Code

Description

AMID

Details

Action n n n n n

Authentication

EMV-Cap

Signature

Provisioning

Administration

The audit message code.

The description of the audit message.

The audit message identifier.

This is the intended action for a received request.

Example values: n n

Ignore

Process

The name of the DIGIPASS application.

Application

Name

Area

Audit Location

Audit Version

Back-End

Authentication

The functional area of the audited component, where the audit message was recorded.

Example: Active Directory Search

The location of the audit message source. This is typically an IP address or a host name.

The revision of the auditing format.

The back-end authentication protocol ID; value can also be None .

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 51: Audit Message (continued)

Field Name Description

Characteristics A space-separated list of keywords indicating characteristics of interest.

Client Location

Client Type

Command

Configuration

Details

Credentials

Example values (in case of a connection attempt): n n n

IPv6

SSL

TCP

When the client machine is not the source of the audit message, this field displays the location of the client.

The client component type.

The name of the command that triggered the relevant audit process.

Detailed information about the configuration settings.

The credentials that were entered for the connections / authentication attempt.

Example values: n n

None

Password

Data Source Location

The location of the data source, for instance the path and/or file name, if the data source is a file.

Data Source

Type

The type of the data source.

Example values: n n

File

Registry

The destination to deliver a message to (via Message Delivery Component).

Delivery Destination

Delivery Method The method used to deliver a message (via Message Delivery Component).

Description The description of the audit message.

Domain The domain name.

Downtime

DIGIPASS type

In case of an administrative command, this is usually the domain of the administrator. The domain of the targeted user is stored in Target Domain .

The duration (in minutes) of downtime of a RADIUS back end.

The type of DIGIPASS, e.g.

DIGIPASS 300 .

Epoch Certificate The certificate of the current epoch.

Epoch ID The identifier of the current epoch.

Epoch Sequence

Number

The sequence number of the audit message within the current epoch.

Epoch Version

Error Code

The revision of the secure auditing format.

The error code for the audit message.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 51: Audit Message (continued)

Field Name Description

Error Details

Error Message

The full dump of the error stack.

The string representation of the error code.

Expiration Date The expiration date related to the audit message subject, for instance the expiration date of the grace period.

Fields Details

From Location

A comma-separated list of fields returned by the query or All Fields if all fields are returned.

The source location for a particular process, for instance when something is moved.

Info Message

Input Details

Local Authentication

The message returned by an external component, e.g.

MDC .

Detailed information about the request parameters and/or attributes.

Indicates if local authentication was performed.

Mobile Number The mobile phone number to send a message to via Message Delivery Component (MDC).

Object The name of an object that is related to an audit query or command.

Offline Data

Details

The details of the offline data for the relevant audit message.

Offline State Data The offline state data for the relevant audit message.

Operation

Outcome

Output Details

Password Protocol

The operation that was attempted or processed when the audit message was recorded.

The outcome of an attempt of RADIUS authentication.

Example values: n n n

Challenge

Failure

Success

Detailed information about the response parameters and/or attributes.

The protocol used for password encoding.

Example values:

Policy ID

Protocol n n n n n

CHAP

EAP-MD5

MS-CHAP1

MS-CHAP2

PAP

The unique identifier of the policy handling the request.

The identifier of the communication protocol used.

Quota The value of a quota related to the audit message subject, e.g. BVDP uses remaining .

RADIUS Input Octets

The Acct-Input-Octets attribute from the RADIUS accounting packet, i.e. the number of bytes received for an account input request during the RADIUS accounting session.

RADIUS Output

Octets

RADIUS Profile

The Acct-Output-Octets attribute from the RADIUS accounting packet, i.e. the number of bytes sent for an account output request during the RADIUS accounting session.

The RADIUS profile used for setting up IDENTIKEY Authentication Server and for the RADIUS back end.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 51: Audit Message (continued)

Field Name Description

RADIUS Status

Type

Reason

Request ID

Request Type

The Acct-Status-Type attribute from the RADIUS accounting packet. Typically indicates the beginning (Start) or the end (Stop) of an accounting session.

A short phrase indicating the reason for a failure.

The request identifier, e.g. the RADIUS packet ID.

The type of packet.

Example values (in case of RADIUS protocol): n n

Access-Request

Access-Accept

Serial Number The serial number of the DIGIPASS authenticator.

Server Location The location of the server, typically an IP address or host name.

Session ID

Session Time

The session identifier.

The duration (in seconds) of the session.

Signature The cryptographic signature of the audit message.

Target Domain This is the domain of the user targeted by an administrative command.

Target User ID This is the user ID of the user targeted by an administrative command.

Task Description The description of the task.

The time that was required to complete the task.

Task Execution

Time

Task ID

Task Result

The task identifier.

The result of the task.

To Location

User ID

The destination location for a particular process, for instance when something is moved.

When the user ID refers to an IDENTIKEY Authentication Server user account, this is the exact user ID.

User Link

User Location

Valid From

In case of an administrative command, this is usually an administrator. The targeted user is stored in Target User ID .

The user ID of the user account linked to this user account.

The location (IP address) of the user's client device, e.g. the RADIUS calling-station-ID or the HTTP browser/client address

The date and time the DIGIPASS authenticator becomes active and can effectively be used, if set or modified by the respective command (delayed activation).

5.9. Policy Properties

Note

Changes to policy settings will not take effect immediately on all IDENTIKEY Authentication Server instances unless replication is used to synchronize the IDENTIKEY Authentication Server instances. Where replication is not used, changes to policy settings will take effect when each IDENTIKEY Authentication Server is restarted, once

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings the policy change is available to it in its data store. Alternatively if there is no restart, the cache of policy settings will refresh from the data store approximately every 15 minutes.

Table 52: Policy Properties - Policy

Field Name Description

Description

Inherits from Policy

This description can be entered to record the purpose of the policy.

Contains the name of the policy from which settings will be inherited, referred to as the parent policy.

Settings are inherited individually, depending on the value in the policy field. They inherit the parent policy value in the following cases:

Local Authentication n n n n

Choice lists/radio buttons – if the selected value is Default

Text fields – if the field is blank

Numeric fields – if the field is blank (not 0)

List fields – if the list is empty

The Show Effective Policy Settings button can be used to display the result of inheriting settings combined with settings of the current policy.

Specifies whether authentication requests using the policy will be handled by the using Local Authentication. For more information about local authentication and back-end authentication, refer to the

IDENTIKEY Authentication Server Product Guide , Section " Authenticating Users".

When local authentication is used, there are two factors that determine whether DIGIPASS authentication is used – any policy restrictions on DIGIPASS types and/or applications that can be used and whether the DIGIPASS user account has any assigned DIGIPASS authenticator that meets the restrictions. For example, if the policy requires a DIGIPASS300, but the user has a DIGIPASS 700, the user cannot use DIGIPASS authentication under that policy.

This setting also affects the provisioning registration process. For more information, refer to the

IDENTIKEY Authentication Server Product Guide , Section "Software DIGIPASS Provisioning".

Possible values: n n n n n

Default . Use the setting of the parent policy.

None . IDENTIKEY Authentication Server will not use local authentication under this policy.

They may be handled using back-end authentication or not handled at all by IDENTIKEY

Authentication Server.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 52: Policy Properties - Policy (continued)

Field Name Description

Back-End Authentication Specifies whether authentication requests using the policy will be handled by the IDENTIKEY Authentication Server using back-end authentication. For more information about local authentication and backend authentication, refer to the IDENTIKEY Authentication Server Product Guide , Section "Authenticating users".

Back-End Protocol

Created

Modified

This setting also affects the provisioning registration process. For more information, refer to the

IDENTIKEY Authentication Server Product Guide , Section "Software DIGIPASS Provisioning".

Possible values: n

Default . Use the setting of the parent policy.

None . Back-end authentication will not be used.

If Needed . IDENTIKEY Appliance will utilize back-end authentication but only in certain cases: n n n n n n

Dynamic User Registration

Self-Assignment

Password Autolearn

Requesting a challenge or Virtual DIGIPASS OTP, when the request method includes a password

Static password authentication, when verifying a Virtual DIGIPASS password-

OTP combination, during the grace period, or if the local authentication mode is set to DIGIPASS or Password .

Provisioning registration n

Always . IDENTIKEY Appliancewill use back-end authentication for every authentication and provisioning registration request.

This setting is required, if you want to use offline authentication for DIGIPASS Authentication for Windows Logon.

To enforce static password verification during offline authentications via DIGIPASS Authentication for Windows Logon, you need to disable Stored Password Proxy and set Back-End

Authentication to Always .

Specifies the protocol to be used for Back-End Authentication.

If you have your own Back-End Authentication engines, they will have protocol names to identify them.

The name for the required engine must be defined in the back-end protocol for the policy.

The following standard authentication options are available: n n n n n

Windows (this is only available when IDENTIKEY Appliance runs on Windows)

RADIUS

NetIQ eDirectory

Microsoft Active Directory

IBM Security Directory Server

The date and time that the policy was created. Read-only.

The date and time that the policy was last modified. Read-only.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 53: Policy Properties - User

Field Name Description

Dynamic User Registration Specifies whether the Dynamic User Registration (DUR) feature is enabled for the policy. If this feature is used, when the IDENTIKEY Appliance receives an authentication request for a user for the first time and back-end authentication is successful, it will create a DIGIPASS user account automatically. If DUR is used together with Auto-Assignment, a DIGIPASS will be assigned to the new user account immediately.

User Info Synchronization

This setting also determines whether the provisioning registration process is allowed to perform DUR or not.

Specifies whether to set user information when a DIGIPASS user account is created using Dynamic User

Registration (DUR) with an LDAP back-end server, by synchronizing the data from the LDAP back-end server to the respective DIGIPASS user account data fields (DUR user information synchronization).

Possible values:

Password Autolearn

Stored Password Proxy n n n

Default . Use the setting of the parent policy.

No . Do not synchronize user information from LDAP back-end server.

Yes . Synchronize user information from LDAP back-end server.

For more information about DUR user information synchronization, refer to the IDENTIKEY Authentication Server Product Guide .

Specifies whether the Password Autolearn feature is enabled for the policy. This feature enables

IDENTIKEY Appliance to update the password stored in the DIGIPASS user account when back-end authentication is successful.

This setting also determines whether the provisioning registration process will update the password after successful back-end authentication or not.

Specifies whether the stored password proxy feature is enabled for the policy. This feature can be used together with the back-end authentication setting and the Password Autolearn feature. With this combination, even though a back-end authentication check is done during every logon, it is done using the password stored in the DIGIPASS user account. Therefore the user does not have to enter it during the logon, unless it has changed in the back-end system. This mode of operation is referred to as Password

Replacement.

To enforce static password verification during offline authentications via DIGIPASS Authentication for

Windows Logon, you need to disable Stored Password Proxy and set Back-End Authentication to

Always .

Account Lockout

User Lock Threshold Specifies the number of invalid logon attempts that are allowed before a DIGIPASS user account is locked. For example, if User Lock Threshold is 3 , the account will become locked on the third failed logon attempt. Unlocking the account requires administrator action or user auto-unlock enabled.

Note that not all kinds of logon failure will result in locking. For example, if the user ID is incorrect or the account is disabled, the failure would not count for the lock threshold. Locking is used mainly for incorrect OTPs and static passwords.

The locking mechanism is also used for provisioning and signature validation.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 53: Policy Properties - User (continued)

Field Name Description

Minimum Lock Duration The time span a locked DIGIPASS user account remains locked before a user can try to authenticate again and unlock it using user auto-unlock. The value is given in minutes.

Lock Duration Multiplier

Maximum Unlock Tries

Applies only if user auto-unlock is enabled, effectively by setting Maximum Unlock Tries .

Possible values: 0 – 99999

The multiplier factor to increase the lock duration (initial value specified by Minimum Lock Duration ) after each unsuccessful authentication. The value is given in percent. For example, a value of 200 effectively doubles the lock duration after each unsuccessful authentication.

Applies only if user auto-unlock is enabled, effectively by setting Maximum Unlock Tries .

Possible values: 100 – 500

The maximum number of attempts to unlock a locked DIGIPASS user account during authentication

(user auto-unlock) before it is permanently locked. A locked DIGIPASS user account with no unlock attempts left, can only be unlocked manually by an administrator.

Setting this value to 0 effectively disables user auto-unlock.

Possible values: 0 – 999

For more information about user auto-unlock, refer to the IDENTIKEY Authentication Server Product

Guide .

Max Days Between Authentications Specifies the number of days a DIGIPASS user account can remain inactive before it is suspended. If the account has been suspended the user will not be able to log on.

The user will be notified during authentication that the DIGIPASS user account has been suspended.

Account Constraints

Default Domain

Accepted Domain

Local Admin Users

The default domain in which IDENTIKEY Authentication Server should look for and create a DIGIPASS user account, if a domain is not specified by the user credentials. For more information about the process of resolving the user ID and domain name, refer to the IDENTIKEY Authentication Server Product

Guide , Section "User ID and Domain Resolution".

Only users from this domain will be accepted; all others will be refused.

Indicate access allowed by the user to non-administrative tasks, if the user has administrative privileges.

Possible values: n n n n

Default . Use the setting of the parent policy.

Accept . Allow this user to proceed through the transaction

Reject . Do not allow this user to proceed through the transaction

Required . This user MUST have administrative privileges to proceed with processing.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 53: Policy Properties - User (continued)

Field Name Description

Windows Group Check Specifies whether and how the Windows Group Check feature is to be used. This feature is typically used for a staged DIGIPASS deployment when the Auto-Assignment method is used. It can also be used when only some users are required to use a DIGIPASS authenticator or when only some users will be permitted access and they have to use a DIGIPASS authenticator.

Windows Group List

Possible values: n n n n n

Default . Use the setting of the parent policy.

No check . Do not use windows group check.

Pass requests for users not in listed groups back to host system . Use windows group check so that any users who are not in one of the listed groups are ignored by IDENTIKEY

Authentication Server. Use of this setting for provisioning or signature validation will have the same effect as Reject requests for users not in listed group .

Reject requests for users not in listed group . Use windows group check so that any users who are not in one of the listed groups are rejected by IDENTIKEY Authentication Server.

Use only back-end authentication for users not in listed groups . Use back-end authentication only for any users who are not in one of the listed groups. Use of this setting for provisioning or signature validation will have the same effect as Reject requests for users not in listed group .

This lists the names of the Windows groups to be checked according to the Windows Group Check setting. There are some important limitations of this check: n n n n

Certain built-in Active Directory groups such as Domain Users and Everyone will not be checked. The check is intended to be used with a new group created specifically for this purpose.

Nested group membership will not be detected by the check.

There is no domain qualifier for a group. The named group must be created in each domain where user accounts exist that need to be added to the group.

A local machine group can be used also.

For groups to appear for an Active Directory back end, the Active Directory back end must exist in

IDENTIKEY Appliance.

RADIUS Attributes

Reply RADIUS Attributes Specifies whether to return RADIUS attributes from a user account when it returns an Access-Accept.

Possible values: n n n

Default . Use the setting of the parent policy.

No . Do not return RADIUS attributes

Yes . Return the RADIUS attributes in the groups listed below

RADIUS Attribute Group List Comma-separated list of RADIUS attribute groups. Only attributes belonging to the listed groups will be returned via this policy.

Static Password

These options allow you to define password complexity rules for the static password of the associated user.

Minimum Password Length Set the minimum length required for the static password. The maximum length is 16 characters.

Possible values: 0 – 9999

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 53: Policy Properties - User (continued)

Field Name Description

Minimum # Lowercase Characters Specifies the minimum number of lowercase characters required in the password.

Possible values: 0 – 9999

Minimum # UPPERCASE Characters Specifies the minimum number of uppercase characters required in the password.

Minimum # Numerical Digits

Possible values: 0 – 9999

Specifies the minimum number of numerical digits required in the password.

Minimum # Special Characters

Possible values: 0 – 9999

Specifies the minimum number of special characters required in the password, in this context, these are non-alphanumeric characters on the keyboard (excluding numbers or letters of the alphabet).

Different From Last # Passwords

Not Based on User ID

Possible values: 0 – 9999

Specifies how many different passwords must be used before a previously used password can be used again.

Possible values: 0 – 24

Specifies whether the password is allowed to contain all or parts of the user ID.

Possible values: n n n

Default . Use the setting of the parent policy.

No . Disables this option.

Yes . Enables this option.

Table 54: Policy Properties – DIGIPASS

Field Name Description

DIGIPASS Assignment

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 54: Policy Properties – DIGIPASS (continued)

Field Name Description

Assignment Mode Specifies the method of automated DIGIPASS Assignment that will be used for this policy, if any. There are two methods, Auto-Assignment and Self-Assignment.

Auto-Assignment is used in conjunction with Dynamic User Registration (DUR). When DUR occurs, the next available DIGIPASS is assigned to the new DIGIPASS user account. A grace period is set for the

DIGIPASS according to the Grace Period setting in the policy.

Self-Assignment is typically used with DUR also, but if the DIGIPASS user account is created first by the administrator, DUR is not necessary. In the Self-Assignment mode, a user is able to assign themselves a DIGIPASS by entering the serial number, a valid OTP from the DIGIPASS and their static password. There is no grace period associated with Self-Assignment, because the user has to use the

DIGIPASS to perform Self-Assignment.

In both cases, any applicable DIGIPASS restrictions apply to the policy. For example, it will not be permitted to self-assign a DIGIPASS 300 if the policy restricts the types to DIGIPASS GO 3 and

DIGIPASS GO 1. In addition, if the user already has a DIGIPASS assigned that meets the policy restrictions, they will not be able to self-assign another DIGIPASS.

This setting is not applicable to provisioning or signature validation.

Possible values:

Grace Period (days)

Serial No. Separator n n n n

Default . Use the setting of the parent policy.

Auto-Assignment . Use the Auto-Assignment method.

Self-Assignment . Use the Self-Assignment method.

Neither . Do not use either method of automated assignment.

This is the default period (in days) between Auto-Assignment of a DIGIPASS authenticator and the date for users to start using their authenticator to log in (if applicable).

The grace period expires the first time an OTP is used to log in (if it has not been set manually to expire prior to that). After the grace period has expired, depending on the Local Authentication settings in the relevant policy, users can then either continue to use both their static password or their

DIGIPASS authenticator ( DIGIPASS or Password ), or must only use the authenticator ( DIGIPASS/Password during Grace Period or Digipass Only ) to log in.

This setting does not affect manual assignment by an administrator or provisioning.

The character (or short sequence of characters) that will be included at the end of the DIGIPASS Serial

Number during a Self-Assignment login. It allows the to easily recognize that a Self-Assignment attempt is being made and extract the Serial Number from the credentials.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 54: Policy Properties – DIGIPASS (continued)

Field Name Description

Search Upwards in Org. Unit Hierarchy This controls the search scope for an available DIGIPASS for Auto-Assignment or Provisioning Registration, or for a specific DIGIPASS for Self-Assignment.

This setting does not affect manual assignment by an administrator.

Possible values: n n n

Default . Use the setting of the parent policy.

No . The search scope is only the organizational unit in which the user account belongs. If the user does not belong to an organizational unit, the search will look for DIGIPASS that also do not belong to an organizational unit.

Yes . The search will start in the user account's organizational unit, but if necessary it will then move upwards through the organizational unit hierarchy until it reaches the top. If Active Directory is used as the data store, the search will include the DIGIPASS-Pool container.

The length of time in days since assignment until a DIGIPASS expires Expiration Period (days)

Delayed Activation

Delay Period (hours) The delayed activation period (in hours), i.e. the time span after activation until an activated (software)

DIGIPASS authenticator can effectively be used for authentication and signature operations.

Possible values: 0 – 9999

Notify user when activation process starts

For more information about delayed activation, refer to the IDENTIKEY Authentication Server Product

Guide and the IDENTIKEY Authentication Server Administrator Guide .

Determines whether a notification should be sent to the user when a DIGIPASS activation is delayed

(delayed activation). The notification messages are scheduled to be sent via Message Delivery Component (MDC) using the delivery method specified by Delivery Method .

Notify user when activation completes Determines whether a notification should be sent to the user when a delayed DIGIPASS activation completes (delayed activation). The notification messages are scheduled to be sent via Message Delivery

Component (MDC) using the delivery method specified by Delivery Method .

Delivery Method Specifies the default delivery method when sending notifications for delayed activation. The notification messages are scheduled to be sent via Message Delivery Component (MDC) and use message templates specified in the global server configuration (see

5.15.2. MDC Message Settings ).

Possible values: n n n n

Default . Use the setting of the parent policy.

Email . Deliver the notification message via email. The DIGIPASS user account must have a configured email address.

SMS . Deliver the notification message via SMS. The DIGIPASS user account must have a configured mobile phone number.

Voice . Deliver the notification message via voice channel (ie. dictated over a phone line). The

DIGIPASS user account must have a configured mobile phone number.

Applicable DIGIPASS

Application Names The policy can specify a restriction on which DIGIPASS Applications may be used when it is effective. If the list is empty, there is no restriction. If there are one or more entries, they will indicate the application names that are permitted.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 54: Policy Properties – DIGIPASS (continued)

Field Name Description

Application Type The policy can restrict which DIGIPASS Application type (e.g. Response Only, Challenge/Response) may be used when it is effective.

Secure Channel Support

Possible values: n n n n n n

Default . Use the setting of the parent policy.

No Restriction . DIGIPASS application type is not restricted.

Response Only . Only DIGIPASS applications of type RO (Response-Only) or MM (Multi-

Mode) may be used.

Challenge/Response . Only DIGIPASS applications of type CR (Challenge/Response) or MM

(Multi-Mode) may be used.

Signature . Only DIGIPASS applications of type SG (Signature) or MM (Multi-Mode) may be used.

Multi-Mode . Only DIGIPASS applications of type MM (Multi-Mode) may be used.

Indicates if the DIGIPASS application should support Secure Channel operations.

Possible values:

DIGIPASS Type n n n n

Default . Use the setting of the parent policy.

No . DIGIPASS applications that support Secure Channel are not considered.

Yes – Permitted . DIGIPASS applications that support Secure Channel are not required, but are permitted.

Yes – Required . Requires a DIGIPASS application that supports Secure Channel.

The policy can specify a restriction on which DIGIPASS Types may be used when it is effective. If the list is empty, there is no restriction. If there are one or more entries, they will indicate the DIGIPASS

Types that are permitted.

Allow PIN change Specifies whether DIGIPASS users will be allowed to change their server PIN during authentication requests to which the current policy applies. Normally this setting is enabled, but it can be used to prevent PIN changes if required.

Multiple DIGIPASS App Validation Mode Specifies whether IDENTIKEY Authentication Server should authenticate a user if it detects multiple assigned DIGIPASS applications.

If this option is set to Single DIGIPASS , then users with multiple DIGIPASS applications assigned cannot log in.

If there are any policy restrictions on Application Type, then IDENTIKEY Authentication Server will only detect applications of the restricted type. For more information, refer to the IDENTIKEY Authentication

Server Product Guide , Section " Multiple DIGIPASS or DIGIPASS Applications".

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 55: Challenge Policy Fields

Field Name

1-Step Challenge/Response – Permitted

1-Step Challenge/Response – Challenge Length

1-Step Challenge/Response – Add Check Digit

2-Step Challenge/Response – Request Method

Description

Controls whether 1-step Challenge/Response logins will be enabled for the current policy and, if so, where the challenge should originate.

In order to enable 1-step Challenge/Response, you also need to set the Challenge Check Mode (see below).

Note that 1-step Challenge/Response is not applicable in a RADIUS environment.

Possible values: n n n n

Default . Use the setting of the parent policy.

No . 1-step Challenge/Response may not be used.

Yes – Server Challenge . 1-step Challenge/Response may be used, if the IDENTIKEY Authentication Server instance, which verifies the response also generated the challenge.

Yes – Any Challenge . 1-step Challenge/Response may be used with any random challenge.

Specifies the length of the challenge (excluding a check digit) which should be generated for 1-step Challenge/Response logins.

A check digit may be added to the generated challenge. This allows the

DIGIPASS to identify invalid Challenges more quickly.

The method by which a user has to request a 2-step Challenge/Response login.

This is the only mode of Challenge/Response available in a RADIUS environment.

The request is made in the password field during login. The request will fail if the user does not have a Challenge/Response-capable

DIGIPASS authenticator assigned. This includes DIGIPASS Applications of

Type CR, SG and MM.

Possible values: n n n n n n n n

Default . Use the setting of the parent policy.

None . Do not use 2-step Challenge/Response

Keyword . Use the Request Keyword, with or without another item. This is permitted to be blank.

Keyword Only . Only the keyword will be accepted.

Password . Use the static password.

KeywordPassword . Use the Request Keyword followed by the static password. No separator characters or whitespace should be between them.

PasswordKeyword . Use the static password followed by the

Request Keyword. No separator characters or whitespace should be between them.

KeywordPIN . Use the request keyword followed by the PIN.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 55: Challenge Policy Fields (continued)

Field Name

2-Step Challenge/Response – Request Keyword

Description

Defines the keyword that a user must enter to request a 2-step Challenge/Response login, if a method using a keyword is selected in the

Request Method.

This can be left blank.

Table 56: Secure Channel Policy Fields

Field Name

Secure Channel Support

Description

Indicates if the DIGIPASS application should support Secure Channel operations.

Possible values: n n n n

Default . Use the setting of the parent policy.

No . DIGIPASS applications that support Secure Channel are not considered.

Yes – Permitted . DIGIPASS applications that support Secure Channel are not required, but are permitted.

Yes – Required . Requires a DIGIPASS application that supports Secure Channel.

The number of days before the first activation message (Activation Message 1) will expire.

Activation Message Validity Period

Message Signing

Allow Custom Request Body

Min App Version

If true, all Secure Channel policy settings can be overwritten by providing a valid request body attribute in the request.

Minimum application version; the application version required to parse the request message.

Possible values: 0 3

1-Step Challenge/Response

Require PIN

Template Number

Font Index

If true, the device must perform PIN verification before generating the response.

Selects the template in the device that specifies the layout of a page with challenge transaction data.

Possible values: 0 15

Selects the font table in case multiple font tables are implemented in the device.

Possible values: 0 3

Signature Transaction

Require PIN

Template Number

Font Index

Show Response

Show Warning

If true, the device must perform PIN verification before generating the response.

Selects the template in the device which specifies the layout of a page with signature transaction data.

Possible values: 0 15

Selects the font table in case multiple font tables are implemented in the device.

Possible values: 0 3

If true, the response will be shown on the device.

If true, a pre-loaded warning will be shown on the device.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Note

The Secure Channel policy fields are only displayed for deployments based on an ODBC storage.

Table 57: Virtual DIGIPASS Policy Fields

Setting Field Name

Virtual DIGIPASS Delivery Method

MDC profile

Description

The method used to deliver the Virtual DIGIPASS.

Possible values: n n n n

Default . Use the setting of the parent policy.

Email . Deliver the one-time password via email. The

DIGIPASS user account must have a configured email address.

SMS . Deliver the one-time password via SMS. The DIGIPASS user account must have a configured mobile phone number.

Voice . Deliver the one-time password via voice channel (ie.

dictated over a phone line). The DIGIPASS user account must have a configured mobile phone number.

This field also allows you to specify a combination of delivery methods, namely: n n n

Email and SMS

SMS and Voice

Email and Voice

The MDC profile whose settings should be used for this delivery method. An MDC profile defines specific group of settings for a particular delivery method. If there is no specified MDC profile in this field, then the highest-ranked, enabled, and available MDC profile for the specified delivery method/s will be used.

The MDC profile name should not be confused with the profile's display name. The display name is simply an ad-hoc field used primarily to describe and further identify the profile. The MDC profile name is the name that appears in the Profile column of the MDC Configuration Utility.

The MDC profile name is non-unique; as such, multiple MDC profiles with the same name may exist for this delivery method. The highestranked, enabled, and available MDC profile with the specified MDC profile name will be used.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 57: Virtual DIGIPASS Policy Fields (continued)

Setting Field Name

Primary Virtual DIGIPASS Request Method

Request Keyword

Description

The method by which a User has to request a Primary Virtual DIGIPASS login.

The request is made in the password field during login. The request will be ignored if the user does not have a Primary Virtual DIGIPASS assigned.

Possible values: n n n n n n n

Default . Use the setting of the parent policy.

None . Do not use Primary Virtual DIGIPASS.

Keyword . Use the Request Keyword, with or without another item. This is permitted to be blank.

Keyword Only . Only the keyword will be accepted.

Password . Use the static password.

KeywordPassword . Use the Request Keyword followed by the static password. No separator characters or whitespace should be between them.

PasswordKeyword . Use the static password followed by the

Request Keyword. No separator characters or whitespace should be between them.

Defines the Keyword that a user must enter to request a Primary Virtual

DIGIPASS login, if a method using a Keyword is selected in the Request

Method. This is permitted to be blank.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

100

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 57: Virtual DIGIPASS Policy Fields (continued)

Setting Field Name

Backup Virtual DIGIPASS BVDP Mode

Time Limit (days)

Max Uses/User

Description

Specifies whether and how the Backup Virtual DIGIPASS feature can be used when this policy is effective. Note that in order for the Backup Virtual DIGIPASS feature to function, it must also be activated in the .dpx

file for the DIGIPASS.

Possible values: n n n n n

Default . Use the setting of the parent policy.

No . Backup Virtual DIGIPASS is not permitted.

Yes - Permitted . Backup Virtual DIGIPASS is permitted, but not mandatory. The Time Limit is not applicable when using this option, but the Max. Uses/User limit is.

Yes – Time Limited . Backup Virtual DIGIPASS is permitted, but not mandatory. Both the Time Limit and the Max.

Uses/User limit will be in effect.

Yes - Required . Backup Virtual DIGIPASS is mandatory. The

Time Limit is not applicable when using this option, but the

Max. Uses/User limit is.

When the Enable Backup VDP setting is Yes – Time Limited , the Time

Limit setting indicates the number of days for which the Backup Virtual

DIGIPASS feature may be used by a User, once they start using it.

The Backup Virtual DIGIPASS Enabled Until setting in the DIGIPASS record will be set automatically the first time that the user requests a

Backup Virtual DIGIPASS OTP, using the Time Limit defined in the policy. Once this date has expired, it requires administrator intervention either to extend it or to reset it to blank for the next time that the user needs to use a Backup Virtual DIGIPASS.

Note that if a user has more than one DIGIPASS capable of Backup Virtual DIGIPASS, they will have a separate limit for each one.

The maximum number of uses of the Backup Virtual DIGIPASS feature permitted for each user, if they do not have a specific limit set for them.

If the Backup Virtual DIGIPASS Uses Remaining in the DIGIPASS record is blank and there is a Max. Uses/User limit defined in the policy, the

Uses Remaining will be set automatically the first time that the user requests a Backup Virtual DIGIPASS OTP.

Once the Uses Remaining has reached zero, Backup Virtual DIGIPASS can no longer be used with this DIGIPASS, unless the administrator increases it or resets it to blank.

Note that if a user has more than one DIGIPASS capable of Backup Virtual DIGIPASS, they will have a separate limit for each one.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

101

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 57: Virtual DIGIPASS Policy Fields (continued)

Setting Field Name

Request Method

Request Keyword

Description

The method by which a user has to request a Backup Virtual DIGIPASS login.

The request is made in the password field during login. The request will be ignored if the user does not have a DIGIPASS authenticator assigned that is activated for the Backup Virtual DIGIPASS feature, or if any other policy or DIGIPASS settings do not permit Backup Virtual DIGIPASS use.

Possible values: n n n n n n

Default . Use the setting of the parent policy.

None . Do not use Backup Virtual DIGIPASS.

Keyword . Use the request keyword. This is permitted to be blank.

Password . Use the static password.

KeywordPassword . Use the request keyword followed by the static password. No separator characters or whitespace should be between them.

PasswordKeyword . Use the static password followed by the request keyword. No separator characters or whitespace should be between them.

Defines the keyword that a user must enter to request a Backup Virtual

DIGIPASS login, if a method using a keyword is selected in Request

Method . This is permitted to be blank.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

102

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 57: Virtual DIGIPASS Policy Fields (continued)

Setting Field Name

Virtual Signature Virtual Signature Mode

Delivery Method

MDC profile

Description

Specifies whether or not to allow the use of Virtual Signatures.

n n n

Default . Use the setting of the parent policy.

No . Disables this option.

Yes . Enables this option.

The method used to deliver the Virtual Signature.

Possible values: n n n n

Default . Use the setting of the parent policy.

Email . Deliver the one-time password via email. The

DIGIPASS user account must have a configured email address.

SMS . Deliver the one-time password via SMS. The DIGIPASS user account must have a configured mobile phone number.

Voice . Deliver the one-time password via voice channel (ie.

dictated over a phone line). The DIGIPASS user account must have a configured mobile phone number.

This field also allows you to specify a combination of delivery methods, namely: n n n

Email and SMS

SMS and Voice

Email and Voice

IDENTIKEY Appliance 3.11.12 - Administrator Reference

103

Signature Time Window

Initial Time Window

Event Window

Identification Threshold

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 58: DIGIPASS Control Parameters

Field Name

Identification Time Window

Description

Controls the maximum number of time steps' variation allowable between a DIGIPASS and the host system during login. This only applies to time-based DIGIPASS Applications when verifying a one-time password.

The Dynamic Time Window option may be used to allow more variation according to the length of time since the last successful login.

If this setting is not specified at all, there is an inbuilt default value of 20.

Controls the maximum number of time steps' variation allowable between a DIGIPASS and the host system during digital signature verification. This only applies to time-based

DIGIPASS Applications when validating a signature, but even then it may be used or not according to the online signature level setting.

The Dynamic Time Window option may be used to allow more variation according to the length of time since the last successful login.

If this setting is not specified at all, there is an inbuilt default value of 24.

Controls the maximum allowed time variation allowable between a DIGIPASS and the host system, the first time that the DIGIPASS is used. The time is specified in hours. This

Initial Time Window is also used directly after a Reset Application operation, which can be used if it appears that the internal clock in the DIGIPASS has drifted too much since the last successful login.

This only applies to time-based DIGIPASS Applications when verifying a one-time password.

In either case, after the first successful login, the initial time window is no longer active.

If this setting is not specified at all, there is an inbuilt default value of 6.

Controls the maximum number of events' variation allowable between a DIGIPASS application and the host system during login. This only applies to event-based DIGIPASS

Applications. It always applies when verifying a one-time password but for signature validation, it depends on the online signature level setting whether the event window is used or not.

If this setting is not specified at all, there is an inbuilt default value of 20.

Specifies the number of consecutive failed authentication attempts allowed before the

DIGIPASS Application is locked from future authentication attempts. Once the DIGIPASS

Application is locked, the Reset Appl Lock command is required to unlock it for further authentication.

This locking mechanism is separate from the User Lock Threshold and is normally not necessary. It only applies when a single DIGIPASS Application can be used for a login, either because the user only has one DIGIPASS with one Application, or because the policy restrictions narrow the list down to one DIGIPASS Application. If policy restrictions are used in this way, the Identification Threshold can be used to lock a user out of one kind of login (e.g. a VPN) while still permitting them to use another kind (e.g. a web application).

If this setting is not specified at all, this feature is not used.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

104

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 58: DIGIPASS Control Parameters (continued)

Signature Threshold

Field Name Description

Specifies the number of consecutive failed Signature validation attempts allowed before the DIGIPASS Application is set to be locked from future signature validation attempts.

Once the DIGIPASS Application is locked, the Reset Appl Lock command is required to unlock it for further signature validation.

This locking mechanism is separate from the User Lock Threshold and is normally not necessary. It only applies when a single DIGIPASS Application can be used for a signature validation, either because the user only has one DIGIPASS with one signature-capable application, or because the policy restrictions narrow the list down to one DIGIPASS

Application. If policy restrictions are used in this way, the Signature Threshold can be used to lock a user out of one kind of signature validation while still permitting them to use another kind.

Max. Days Since Last Use

Challenge Check Mode

If this setting is not specified at all, this feature is not used.

This setting specifies the maximum number of days for which a DIGIPASS Application can go unused for authentication or signature validation. After this limit, authentication and signature validation will be rejected until an administrator performs a Reset Application operation.

If this setting is not specified at all, this feature is not used.

This setting is for advanced control over time-based Challenge/Response authentication.

The value 1 should be used for standard RADIUS Challenge/Response. This is the builtin default value if the setting is not specified at all.

Possible values: n n n n n

0 . No check is made. This is necessary for 1-step Challenge/Response.

1 . The challenge presented for verification must be the last one that was generated specifically for that DIGIPASS. This is the normal mode of operation in

2-step Challenge/Response.

2 . The challenge presented for verification is ignored; the last one that was generated specifically for that DIGIPASS is used.

3 . Only one verification is permitted per time step. This option only applies to time-based Challenge/Response. This is a method of avoiding a potential replay of a captured response if the same challenge comes up again in the same time step.

4 . If the same challenge and response are presented for verification twice in a row during the same time step, they are rejected. This is an advanced method of avoiding a potential replay of a capture Challenge/Response.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

105

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 58: DIGIPASS Control Parameters (continued)

Field Name

Online Signature Level

Description

This setting is for advanced control of Signature validation.

The value 0 can be used for DIGIPASS Application that are neither time- nor eventbased. This is the built-in default value if the setting is not specified at all.

Possible values: n

0 . The signature is validated in offline mode. This is useful when the signatures may not be validated in the same sequence as they were generated by the user. It is also useful when there may be some delay after the signature is generated by the user, before the signature is validated.

For time-based DIGIPASS Applications: This mode is typically used with a large time step. When this mode is used, no clock synchronization occurs between the DIGIPASS and the IDENTIKEY Appliance. The IDENTIKEY Appliance will not reject an older signature than the most recently validated signature, provided it is still within the Signature Time Window.

For event- based DIGIPASS Applications: When this mode is used, the

IDENTIKEY Appliance will not reject an older signature than the most recently validated signature, provided it is still within the Event Window.

1 . The signature is validated in online mode. This is useful when the signatures are expected or required to be validated immediately after they are generated.

For time-based DIGIPASS Applications: This mode is typically used with a small time step. When this mode is used, clock synchronization occurs between the DIGIPASS and the IDENTIKEY Appliance. The IDENTIKEY Appliance will reject an older signature than the most recently validated signature.

A newer signature must be within the Signature Time Window.

This mode will allow more than one signature to be validated in the same time step, provided that the same exact signature is not repeated twice in a row.

For event- based DIGIPASS Applications: When this mode is used, the

IDENTIKEY Appliance will reject an older signature than the most recently validated signature. A newer signature must be within the Event Window.

2 . The signature is validated in strict online mode. This is useful for timebased signatures when you want to prevent more than one signature from the same time step from being validated. Otherwise, this mode is the same as online mode.

3 . The signature is validated using the Deferred Event Count. This mode only applies to event-based signatures. For each signature validation request, the

Deferred Event Count must be supplied as a parameter.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

106

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 59: Offline Authentication

Field Name

Offline Authentication Enabled

Offline Time Window (days)

Offline Event Window

Description

Controls whether or not to enable Offline Authentication.

n n n

Default . Use the setting of the parent policy.

No . Disables this option.

Yes . Enables this option.

To have offline authentication data created for DIGIPASS Authentication for Windows

Logon, you also need to set Back-End Authentication to Always .

The number of days offline authentication data is valid, if the offline authentication data is time-based.

Possible values: 1 – 99

The number of times offline authentication data can be used before it expires.

Possible values: 1 – 2999

Table 60: Password Randomization

Field Name

Enabled

Back-End Password Length

Description

Controls whether or not to enable Password Randomization n n n

Default . Use the setting of the parent policy.

No . Disables this option.

Yes . Enables this option.

Specifies the length of the password that is to be generated when using Password

Randomization.

Valid values range from 7 to 127. The default is 16.

Table 61: Dynamic Component Registration

Field Name

Enabled

Description

Controls whether or not to enable Dynamic Component Registration.

n n n

Default . Use the setting of the parent policy.

No . Disables this option.

Yes . Enables this option.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

107

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 61: Dynamic Component Registration (continued)

Field Name Description

Windows Group Check Specifies whether and how the Windows Group Check feature should be used for

Dynamic Component Registration.

Possible values: n

Default . Use the setting of the parent policy.

Group List n

No check . Every new Client record is registered dynamically.

Accept requests for clients listed in groups . Group Membership for the client component will be checked before it is created. The client component will only be created if the client component is in the group mode list.

Accept requests for clients listed in groups . Group Membership for the client component will be checked. If the client component is found in a

Group Membership list then the client component will not be created.

The Group Check only works with Active Directory domain groups. It will not work with Windows local groups as these groups do not support the concept of hosts and computers. For Linux, the only available option is No check.

This lists the names of the Windows Groups to be checked according to the Windows Group Check radio button setting.

For groups to appear for an Active Directory back end, the Active Directory back end must exist in IDENTIKEY Appliance.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

108

Table 62: RADIUS

Field Name

Supported Protocols

Wireless Session Lifetime

TLS Session Lifetime

Max. Fast Reconnect Count

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Description

List of RADIUS protocols which may be used with this policy.

Default

Any

Secure

Custom

Use the setting of the parent policy.

Use any RADIUS protocol suggested by the client.

Enable all of the following EAP or PEAP protocols: n n n

EAP-TTLSv0

PEAPv0

PEAPv1

Select one or more of the following protocols.

n n n n n n n n

EAP-TTLSv0

PEAP v0

PEAP v1

PAP

CHAP

MSCHAP

MSCHAP2

VASCO-specific

For more information on these protocols, refer to the Supported RADIUS Protocols section of the IDENTIKEY Authentication Server Administrator Guide .

The length of time a machine may be connected before a fast-reconnect is required.

Two RADIUS return attributes are returned to the WAP with an Access-Accept: n n

Session-Timeout (value: Wireless Session Lifetime)

Terminate-Action (value: RADIUS-Request)

Note: The WAP in use may not support the use of these attributes, and may use its own configured defaults.

Default value: 3600 seconds (1 hour)

The length of time allowable between full (OTP) authentications.

Default value: 86400 seconds (24 hours)

Number of Fast Reconnects which may be made before a full (OTP) authentication is forced.

Note: If roaming wireless connections will be in use, the Max. Fast Reconnect Count setting should be set higher than if static wireless connections are used.

Default value: 48

IDENTIKEY Appliance 3.11.12 - Administrator Reference

109

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.10. Pre-Loaded Policies

Pre-loaded policies are created for IDENTIKEY Appliance during installation and provide useful policy examples for typical environments.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

110

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 63: Pre-Loaded Policies

Policy Name Parent Policy

Base Policy -

Description Fields with settings which are different from the parent policy

Globally applicable settings. In general, all other Policies should inherit from this, directly or indirectly.

User Lock Threshold=3

PIN Change Allowed=Yes

Challenge Request Method=Keyword

Primary VDP Request Method=Password

Backup VDP Request Method=Keyword

Password Backup VDP Request Keyword=otp

Identification Time Window=20

Check Challenge Mode=1

Event Window=20

Sync Window=6

Online Signature Level= 0

Identification Threshold=0

Local Authentication=None

Back-End Authentication=None

DUR=No

Password Autolearn=No

Stored Password Proxy=No

Group Check Mode=No

Check Assignment Mode=Neither

Search Up OU Path=No

Application Types=No Restriction

1-Step Challenge/Response=No

1-Step Challenge Check Digit=No

Backup VDP Enabled=No

IDENTIKEY Appliance 3.11.12 - Administrator Reference

111

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 63: Pre-Loaded Policies (continued)

Policy Name Parent Policy

IDENTIKEY Administration

Logon

IDENTIKEY Local Authentication

IDENTIKEY Windows Password Replacement

Base Policy

IDENTIKEY Local

Authentication

IDENTIKEY Microsoft AD Password Replacement

IDENTIKEY Local

Authentication

Description

Settings for an administration logon including Audit Viewer live connection. Separated from the main authentication policies to avoid accidental interference.

Locking is off to reduce the chance of a lock-out.

Settings applicable to all

IDENTIKEY Appliance authentication Policies, including local authentication. In general, all other IDENTIKEY Appliance

Policies using local authentication should inherit from this, directly or indirectly.

IDENTIKEY Appliance model for password replacement and

Dynamic User Registration, using Windows back-end authentication.

Fields with settings which are different from the parent policy

Local Authentication=DIGIPASS/Password during Grace Period

User Lock Threshold=0

Local Authentication=DIGIPASS/Password during Grace Period

IDENTIKEY Appliance model for password replacement with

Microsoft Active Directory (LDAP connection).

Back-End Authentication=Always

Back-End Protocol=Windows

DUR=Yes

Assignment Mode=Neither

Password Autolearn=Yes

Stored Password Proxy=Yes

Local Auth=Default

Backend Auth=Always

Backend Protocol=Microsoft AD

DUR=Yes

Password Autolearn=Yes

Stored Password Proxy=Yes

IDENTIKEY Appliance 3.11.12 - Administrator Reference

112

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 63: Pre-Loaded Policies (continued)

Policy Name

IDENTIKEY Novell eDirectory

Password Replacement

IDENTIKEY Windows Auto-

Assignment

IDENTIKEY Microsoft AD Auto

Assignment

IDENTIKEY Windows Self-

Assignment

IDENTIKEY Microsoft AD Self

Assignment

IDENTIKEY Novell eDirectory

Self-Assignment

Parent Policy

IDENTIKEY Local

Authentication

IDENTIKEY Windows Password

Replacement

IDENTIKEY Local

Authentication

IDENTIKEY Windows Password

Replacement

IDENTIKEY Novell eDirectory Password Replacement

Description Fields with settings which are different from the parent policy

IDENTIKEY Appliance model for password replacement with

NetIQ eDirectory (formerly Novell eDirectory) (LDAP connection).

IDENTIKEY Appliance model for

Auto-Assignment based on the

Windows password replacement model.

IDENTIKEY Appliance model for

Auto Assignment for Microsoft

Active Directory

IDENTIKEY Appliance model for

Self-Assignment based on the

Windows password replacement model.

IDENTIKEY Appliance model for

Self-Assignment for AD Password Replacement

IDENTIKEY Appliance model for self-assignment for NetIQ eDirectory (formerly Novell eDirectory).

Local Auth=Default

Backend Auth=Always

Backend Protocol=Novell eDirectory

DUR=Yes

Password Autolearn=Yes

Stored Password Proxy=Yes

Assignment Mode=Auto-Assignment

Search Up OU Path=Yes

Grace Period=7

Local Auth=Default

Backend Auth=If Needed

Backend Protocol=Microsoft AD

Assignment Mode=Auto-Assignment

Search-Up-OU-Path=Yes

Assignment Mode=Self-Assignment

Search Up OU Path=Yes

Self Assignment Separator=|

Local Auth = Default

Backend Auth = Always

Backend Protocol = Microsoft AD

Assignment Mode = Self-Assignment

Search-Up-OU-Path = Yes

Local Auth = Default

Backend Auth = Always

Backend Protocol = Novell eDirectory

Assignment Mode = Self-Assignment

Search-Up-OU-Path = Yes

IDENTIKEY Appliance 3.11.12 - Administrator Reference

113

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 63: Pre-Loaded Policies (continued)

Policy Name Parent Policy

IDENTIKEY RADIUS Password Replacement

IDENTIKEY RADIUS Auto-

Assignment

IDENTIKEY Local

Authentication

IDENTIKEY Local

Authentication

Description

IDENTIKEY Appliance model for password replacement and

Dynamic Component Registration using a RADIUS server for back-end authentication.

IDENTIKEY Appliance model for

Auto-Assignment based on the

RADIUS password replacement model.

Fields with settings which are different from the parent policy

Backend Authentication=Always

Backend Protocol=RADIUS

Password Autolearn=Yes

Stored Password Proxy=Yes

Grace Period=7

Search Up OU Path=Yes

Assignment Mode=Self-Assignment

IDENTIKEY RADIUS Self-

Assignment

IDENTIKEY Back End

Authentication

IDENTIKEY DP110 Provisioning 1

IDENTIKEY DP110 Provisioning 2

IDENTIKEY DP4Mobile Provisioning 1

IDENTIKEY Local

Authentication

Base Policy

IDENTIKEY Appliance model for

Self-Assignment based on the

RADIUS password replacement model.

IDENTIKEY Appliance model for only back-end authentication.

Change the back-end protocol to the one required.

DIGIPASS for Web provisioning model scenario 1 - Activation codes are encrypted with preloaded static passwords.

Search Up OU Path=Yes

Assignment Mode=Self-Assignment

Self Assignment Separator=|

Backend Protocol=RADIUS

Backend Authentication=Always

IDENTIKEY DP110 Provisioning model scenario 2 - Dynamic

Registration using back-end system. Change the back-end protocol to the one required.

Local Auth = DIGIPASS/Password during

Grace Period

Back-End Authentication = Always

1-Step Challenge/Response=Yes – Any challenge

IDENTIKEY DIGIPASS for Mobileprovisioning model scenario 1

Local Auth=DIGIPASS/Password during

Grace Period

1-Step Challenge/Response=Yes-Any challenge

IDENTIKEY Appliance 3.11.12 - Administrator Reference

114

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 63: Pre-Loaded Policies (continued)

Policy Name Parent Policy

IDENTIKEY DP4Mobile Provsioning 2

IDENTIKEY DP4Mobile Provsioning 3

IDENTIKEY DP4Web Provisioning 1

IDENTIKEY DP4Web Provisioning 2

IDENTIKEY DP4Web Provisioning 3

IDENTIKEY Deferred Time signature Verfication

Base Policy

IDENTIKEY Real-Time signature verfication 1

Base Policy

IDENTIKEY Real-Time signature verfication 2

Base Policy

Description Fields with settings which are different from the parent policy

IDENTIKEY DIGIPASS for Mobileprovisioning model scenario 2

IDENTIKEY DIGIPASS for Mobileprovisioning model scenario 3

Local Authentication = DIGIPASS/Password during Grace Period

Backend authentication= NONE

DIGIPASS type:

'Mob30'

Local Authentication = DIGIPASS/Password during Grace Period

Backend authentication= IF NEEDED

DIGIPASS type:

'Mob30'

IDENTIKEY DIGIPASS for WebProvisioning model scenario 1 -

Activation codes are encrypted with pre-loaded static passwords.

IDENTIKEY DIGIPASS for WebProvisioning model scenario 2 - preloaded user accounts and static passwords.

Local Auth = DIGIPASS/Password during

Grace Period

IDENTIKEY DIGIPASS for WebProvisioning model scenario 3 -

Dynamic Registration using back-end system. Change the back-end protocol to the one required.

Local Auth = DIGIPASS/Password during

Grace Period

DUR=Yes

Deferred time signature verification settings: Time based.

Signature Time Window = 24

Online signature level = 1 - Multiple Signatures allowed in same Time Step

Real-time signature verification settings: Time-based, several signatures are allowed in the same timestep but 2 identical successive signatures will be rejected.

Real-time signature verification settings: Time-based, one signature allowed per timestep.

Online signature level = 2 - Only 1 Signature/Time Step allowed

IDENTIKEY Appliance 3.11.12 - Administrator Reference

115

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 63: Pre-Loaded Policies (continued)

Policy Name

IDENTIKEY Real-Time signature verfication 3

Windows logon online authentication - Windows Back-End

Windows logon online authentication - LDAP AD Back-End

Windows logon online and offline authentication – Windows Back-End

Parent Policy

Base Policy

IDENTIKEY Local

Authentication

IDENTIKEY Local

Authentication

Windows logon online authentication - Windows Back-End

Windows logon online and offline authentication – LDAP AD

Back-End

Windows logon online authentication - LDAP AD

Back-End

Description Fields with settings which are different from the parent policy

Signature Time Window = 24 Deferred time signature verification settings: Event based, off-line mode.

Windows Logon with Windows back end

Windows Logon for LDAP AD back end

Windows logon online and offline authentication for Windows back end

Windows logon online and offline authentication settings for LDAP

AD back end

Back-End Authentication = Always

Back-End Protocol = Windows

Dynamic Component Registration = Yes

Enable Random Password = No

Client Group List =

Client Group Mode = No check

Offline Authentication = No

Back-End Authentication = Always

Back-End Protocol = Microsoft AD

Dynamic Component Registration = Yes

Enable Random Password = No

Client Group List =

Client Group Mode = No check

Offline Authentication = No

OfflineOffline Authentication = Yes

Offline Time Window (days) = 21

Offline Event Window = 300

Offline Authentication = Yes

Offline Time Window (days) = 21

Offline Event Window = 300

5.11. Client Properties

Note

Changes to client records (add, change, delete) will not take effect immediately on all IDENTIKEY Authentication

IDENTIKEY Appliance 3.11.12 - Administrator Reference

116

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Server instances unless replication is used to synchronize them. Where replication is not used, changes to client records will take effect when each IDENTIKEY Authentication Server instance is restarted, once the client change is available to it in its data store. Alternatively, if there is no restart, the cache of client records will refresh from the data store approximately every 15 minutes.

Table 64: Client Fields

Field Name Description

Enabled

Client Type

Location

Protocol ID

Policy ID

Created

Modified

If selected, this client component is enabled and accepted to communicate with IDENTIKEY Authentication Server.

The type of client component represented by the record. For SOAP clients, the type needs to match the component type parameter passed in the SOAP requests. Each application can identify itself as a different type of client.

The IP address or name of the machine represented by the record.

For RADIUS clients, the location must be the NAS-IP-Address or NAS-Identifier values that are sent in the RADIUS requests. A RADIUS client with Location set to default can be used to accept RADIUS requests from all IP addresses, using the same shared secret. However, where a RADIUS client record with the exact location exists, its shared secret will be used in preference to the default RADIUS client's shared secret.

For Windows Logon clients, the location can either be the FQDN , or, if the client has been created via

Dynamic Component Registration, it can be a host name or a NetBIOS name. A Windows Logon client with Location set to default can be used as a template to dynamically create components for new clients.

For all other client types the location must be the source IP address of requests which originate from that client component.

The protocol by which requests will be received from the client.

SOAP The standard SOAP protocol over HTTPS. This is used by programs using the SOAP interface from the SDK, the Administration Web Interface, and IDENTIKEY User Websites.

RADIUS

SEAL

The standard RADIUS protocol. This is used by various remote network access hardware and software systems. It can also be used as a simple authentication programming interface.

A proprietary TCP/IP based protocol used by and VACMAN Middleware 3.x. It is used by the IIS6 Module, Tcl Command-Line

Administration and for replication between IDENTIKEY Authentication Server instances.

The name of the policy that should be used for authentication, provisioning and signature validation requests from the client component.

The date and time that the client component was created. Read-only.

The date and time that the client component was last modified. Read-only.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

117

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 65: License Fields

Field Name Description

License Key IDENTIKEY Authentication Server requires you to upload a corresponding valid license for any of the following client types: n n n

Any SEAL authentication client (DIGIPASS Authentication Module)

IDENTIKEY Federation Server

IDENTIKEY User Websites

The license consists of a set of parameters followed by a signature.

For more information, refer to the IDENTIKEY ApplianceAdministrator Guide Section "Licensing".

Table 66: RADIUS Fields

Field Name

Shared Secret

Confirm Shared Secret

Character Encoding

Description

The RADIUS shared secret between the and the RADIUS client.

Allows confirmation of a new shared secret.

Encoding/locale format required by the RADIUS server.

If your RADIUS server requires the password field to be in any specific encoding/locale format other than

UTF-8, set this field to convert all RADIUS packets accordingly, otherwise authentication requests will be rejected.

Default setting: UTF-8

Table 67: SOAP Fields

Field Name Description

Trusted for Request Forwarding If selected, the client is considered to be trusted to forward SOAP requests from other clients. This setting is required to allow intermediary servers, such as HTTP proxy servers or load balancers, to forward SOAP requests and still identify the originating client.

In this case, IDENTIKEY Authentication Server evaluates the X-Forwarded-For (XFF) field of the HTTP header to identify the IP address of the originating client. More than one proxy server may appear in the list, each one verified to be trusted. If any of the servers in the XFF field is not trusted to forward requests, the initial client is considered to be the originating SOAP client, i.e. the proxy server or load balancer directly sending the request to IDENTIKEY Authentication Server.

Note that this option does not work, if you are using a load balancer with SSL tunneling. For more information, refer to the IDENTIKEY Authentication Server Performance and Deployment Guide , Section "Load Balancing".

IDENTIKEY Appliance 3.11.12 - Administrator Reference

118

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.12. Back-End Server Properties

Table 68: RADIUS Back-End Server Fields

Field Name Description

Back-End Server ID

Domain Name

Priority

Authentication IP Address

Authentication Port

Accounting IP Address

Accounting Port

Shared Secret

Confirm Shared Secret

Timeout

Retries

Mandatory. The name to uniquely identify the back-end server.

The name of the AD domain to be used.

The priority in the case that there are multiple back-end servers. The highest priority server is tried first, then the next highest one, etc.

Possible values: 0 – 100

The IP address on which the RADIUS server receives authentication requests.

The UDP port on which the RADIUS server receives authentication requests.

Possible values: 0 – 65535

The IP address on which the RADIUS server receives accounting requests.

The UDP port on which the RADIUS server receives accounting requests.

Possible values: 0 – 65535

The shared secret between IDENTIKEY Authentication Server and the RADIUS server.

Allows confirmation of a new shared secret.

The number of seconds to wait for a response from the back-end server before either retrying or trying another back-end server.

Possible values: 1 – 999

The number of times to retry if no response is received from the RADIUS server.

Possible values: 0 – 9

Table 69: Microsoft Active Directory Back-End Server Fields

Field Name Description

Back-End Server ID

Domain Name

Priority

Mandatory. The name to uniquely identify the back-end server.

The name of the AD domain to be used.

The priority in the case that there are multiple back-end servers. The highest priority server is tried first, then the next highest one, etc.

Possible values: 0 – 100

IDENTIKEY Appliance 3.11.12 - Administrator Reference

119

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 69: Microsoft Active Directory Back-End Server Fields (continued)

Field Name Description

Enable SSL

Location

Port

Timeout

Search Base DN

Security Principal ID

Specifies whether to encrypt the connection using SSL.

The fully qualified domain name (FQDN) or host name of the Active Directory domain controller.

The port on which the server receives authentication requests.

Possible values: 0 – 65535

The number of seconds to wait for a response from the back-end server before either retrying or trying another back-end server.

Possible values: 1 – 999

The distinguished name (DN) where the search for user accounts starts.

The user ID of the user account required for back-end authentication requests. Specify the ID of the account being used to log in to Active Directory.

If this is an encrypted connection, the format of the security principal ID will be the DN.

If this is not an encrypted connection, the format of the security principal ID is the SAM account name.

Warning

The built-in Active Directory administrator account CANNOT be used as the security principal ID. An administrator must be created to be used as the security principal ID.

Security Principal Password

Attribute Mapping

User Name Attribute Name

Phone Attribute Name

Mobile Attribute Name

Email Attribute Name

The password for the user account required for back-end authentication requests.

The LDAP attribute name to use as user's display name for DUR user information synchronization.

The LDAP attribute name to use as user's landline phone number for DUR user information synchronization

The LDAP attribute name to use as user's mobile phone number for DUR user information synchronization.

The LDAP attribute name to use as user's email address for DUR user information synchronization.

Table 70: NetIQ eDirectory Back-End Server Fields

Field Name Description

Back-End Server ID

Domain Name

Mandatory. The name to uniquely identify the back-end server.

The name of the domain to be used.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

120

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 70: NetIQ eDirectory Back-End Server Fields (continued)

Field Name Description

Priority

IP Address

Port

Timeout

Search Base DN

Security Principal DN

The priority in the case that there are multiple back-end servers. The highest priority server is tried first, then the next highest one, etc.

Possible values: 0 – 100

The IP address of the LDAP server.

The port on which the server receives authentication requests.

Possible values: 0 – 65535

The number of seconds to wait for a response from the back-end server before either retrying or trying another back-end server.

Possible values: 1 – 999

The distinguished name (DN) where the search for user accounts starts.

The distinguished name (DN) of the user account required for back-end authentication requests. The distinguished name must have permission to perform searches for users on the LDAP server. When a distinguished name is not supplied, the LDAP server must allow anonymous searches.

The password for the user account required for back-end authentication requests.

Security Principal Password

Attribute Mapping

User Name Attribute Name

Phone Attribute Name

Mobile Attribute Name

Email Attribute Name

Field Name

Back-End Server ID

Domain Name

Priority

Enable SSL

Location

The LDAP attribute name to use as user's display name for DUR user information synchronization.

The LDAP attribute name to use as user's landline phone number for DUR user information synchronization

The LDAP attribute name to use as user's mobile phone number for DUR user information synchronization.

The LDAP attribute name to use as user's email address for DUR user information synchronization.

Description

Mandatory. The name to uniquely identify the back-end server.

The name of the domain to be used.

The priority in the case that there are multiple back-end servers. The highest priority server is tried first, then the next highest one, etc.

Possible values: 0 – 100

Specifies whether to encrypt the connection using SSL.

Mandatory. The IP address of the LDAP server

IDENTIKEY Appliance 3.11.12 - Administrator Reference

121

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 70: NetIQ eDirectory Back-End Server Fields (continued)

Field Name Description

Port

Timeout

Search Base DN

User Object Class Name

User ID Attribute Name

Security Principal ID

The port on which the server receives authentication requests.

Possible values: 0 – 65535

Number of seconds to wait for a response from the back-end server before either retrying or trying another back-end server.

Possible values: 1 – 999

The distinguished name (DN) where the search for user accounts starts.

Mandatory. The name of the user object class to search within.

Mandatory. The name of the user attribute which is to be used for the search.

The password to be used for the security principal ID Security Principal Password

Attribute Mapping

User Name Attribute Name

Phone Attribute Name

Mobile Attribute Name

Email Attribute Name

The LDAP attribute name to use as user's display name for DUR user information synchronization.

The LDAP attribute name to use as user's landline phone number for DUR user information synchronization

The LDAP attribute name to use as user's mobile phone number for DUR user information synchronization.

The LDAP attribute name to use as user's email address for DUR user information synchronization.

Table 71: Back-End Server Settings Fields

Field Name Description

Microsoft Active Directory

The options in this section specify default values for all Microsoft Active Directory back-end servers, unless specified otherwise in the individual back-end server records.

If the global catalog is configured and no back-end servers have been defined, domain discovery via the global catalog will be used to search for the user. If domain discovery via the global catalog is to be used, users must be set up in the same domain in Microsoft Active Directory as they are in IDENTIKEY Authentication Server.

Enable SSL

Global Catalog Location

Specifies whether to encrypt the connection using SSL.

The location of the Active Directory global catalog.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

122

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 71: Back-End Server Settings Fields (continued)

Field Name Description

Global Catalog Port

Timeout

Security Principal ID

The port to be used for the Active Directory global catalog.

Possible values: 0 – 65535

Number of seconds to wait for a response from the back-end server before either retrying or trying another back-end server.

Possible values: 0 – 32767

The user ID of the user account required for back-end authentication requests. Specify the ID of the account being used to log in to Active Directory.

If this is an encrypted connection, the format of the security principal ID will be the DN.

If this is not an encrypted connection, the format of the security principal ID is the SAM account name.

Warning

The built-in Active Directory administrator account CANNOT be used as the security principal ID. An administrator must be created to be used as the security principal ID.

Security Principal Password

NetIQ eDirectory

The password for the user account required for back-end authentication requests.

The options in this section specify default values for all NetIQ eDirectory back-end servers, unless specified otherwise in the individual backend server records.

If anonymous binding is disabled on the NetIQ eDirectory server the security principal DN has to be a valid NetIQ eDirectory account with the necessary permissions to search the directory for the user accounts to be authenticated.

Search Base DN

Security Principal DN

The DN where the search for user accounts starts.

Security Principal Password

IBM Security Directory Server

The password for the user account required for back-end authentication requests.

The options in this section specify default values for all IBM Security Directory Server back-end servers, unless specified otherwise in the individual back-end server records.

Search Base DN The distinguished name (DN) where the search for user accounts starts.

Security Principal ID

Security Principal Password

The password to be used for the security principal ID

IDENTIKEY Appliance 3.11.12 - Administrator Reference

123

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 71: Back-End Server Settings Fields (continued)

Field Name Description

Attribute Mapping

The options in this section specify default values for all LDAP back-end servers, unless specified otherwise in the individual back-end server records.

User Name Attribute Name The LDAP attribute name to use as user's display name for DUR user information synchronization.

Phone Attribute Name

Mobile Attribute Name

The LDAP attribute name to use as user's landline phone number for DUR user information synchronization

The LDAP attribute name to use as user's mobile phone number for DUR user information synchronization.

Email Attribute Name The LDAP attribute name to use as user's email address for DUR user information synchronization.

5.13. Organizational Unit Property Sheet

IDENTIKEY Appliance 3.11.12 - Administrator Reference

124

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 72: Organizational Unit Fields

Field Name in

Administration

Interface

Description

Domain

Description

Parent Organizational Unit

Created

Modified

The domain to which the organizational unit belongs.

Read-only after creation.

A short description for the organizational unit.

The parent organizational unit.

This is used to define a hierarchy of organizational units.

Read-only after creation.

The date and time that the record was created.

Read-only.

The date and time that the record was last modified.

Read-only.

5.14. Reports Properties

Table 73: Report Fields

Field Name

Report Name

Domain Name

Report Type

Description

The name the report was given when it was created.

The domain the report was created in.

The available report types are:

List Analysis Report

Detailed Analysis Report

List analysis reports list items that match the predefined criteria

The detailed analysis report shows detail of the events specified in the report definition.

Distribution Analysis Report

Trend Analysis Report

Distribution analysis reports breakdown the values of certain items over other items.

Trend analysis reports express a trend/evolution over a requested period of time for a set of reported items. The system therefore makes sub-counts at a regular interval of the amount of times an item has occurred.

The description of the report that was entered when the report was created.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

125

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 73: Report Fields (continued)

Field Name

Data Source

Grouping Level

Time Frequency

Created

Modified

Description

Where the data in the report comes from. The sources can be:

Users The user data will be used to generate the report

Users + Audit

DIGIPASS

DIGIPASS + Audit

User data and audit data will be used to generate the report

DIGIPASS data will be used to generate the report

DIGIPASS and audit data will be used to generate the report.

Audit Only audit data will be used to generate the report.

The grouping level will be used to group the information on the report into the format you require. The grouping levels are:

Client

Domain

The report information will be grouped for each client.

The report information will be grouped for each domain.

Organizational Unit

User

DIGIPASS

The report information will be grouped for each organizational unit.

The report information will be grouped for each user.

The report information will be grouped for each DIGIPASS.

For trend analysis reports. This type of report shows trends over a time period, taking sub-counts at certain time periods. Use this field to specify the sub-count time frequency.

Date the report was created.

Date the report definition was last modified.

5.15. Servers – Global Configuration

The SERVERS > Global Configuration tab contains solution-wide configuration settings applying to all IDENTIKEY

Authentication Server instances in a replicated environment.

The following settings can be configured here: n n

Auditing

Message Delivery Component (MDC) Message Settings: n n

MDC Virtual DIGIPASS

MDC Virtual Signature n n n

MDC Offline Activation Data

MDC DP Activation Delayed

MDC DP Activation Completed

IDENTIKEY Appliance 3.11.12 - Administrator Reference

126

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.15.1. Auditing Settings

Table 74: Global Configuration – Auditing

Field Name Description

Recent Activity Settings

Maximum Days

Maximum Records

The maximum age of audit records included in recent activity queries. A value of 0 returns no data at all.

Possible values: 0 – 90

Default value: 30

The maximum number of most recent audit records included in recent activity queries. A value of 0 returns no data at all.

Possible values: 0 – 100

Default value: 100

5.15.2. MDC Message Settings

Table 75: Global Configuration – MDC Virtual DIGIPASS Message Settings

Field Name Description

SMS Message Template Message template to use in SMS messages for Virtual DIGIPASS.

Voice Message Template

Default value: "Your one-time password is [OTP]."

Message template to read by the voice delivery service for Virtual DIGIPASS.

Default value: "Your one-time password is [OTP]."

Email Message Settings

Message template to use in e-mail messages for Virtual DIGIPASS messages. Contains the following elements:

Email Message Header Name Optional. The name of a custom message header field to set in the message header.

Email Message Header Value

Email Message Subject

Email Message Template

Default value: <empty>

Optional. The value of the custom message header field specified by Email Message Header Name .

Default value: <empty>

The text which should appear in the Subject field when a message is sent for Virtual DIGIPASS.

Default value: " Your One-Time Password"

Message template to use in mail messages for Virtual DIGIPASS.

Default value: "Your one-time password is [OTP]."

IDENTIKEY Appliance 3.11.12 - Administrator Reference

127

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 76: Global Configuration – MDC Virtual Signature Message Settings

Field Name Description

SMS Message Template Message template to use in SMS messages for virtual signatures.

Voice Message Template

Default value: "Your e-signature is [signature]. Signature Data Fields: [datafields]."

Message template to read by the voice delivery service for virtual signatures.

Default value: "Your e-signature is [signature]. Signature Data Fields: [datafields]."

Email Message Settings

Message template to use in e-mail messages for virtual signature messages. Contains the following elements:

Email Message Header Name Optional. The name of a custom message header field to set in the message header.

Email Message Header Value

Email Message Subject

Default value: <empty>

Optional. The value of the custom message header field specified by Email Message Header Name .

Default value: <empty>

The text which should appear in the Subject field when a message is sent for virtual signatures.

Email Message Template

Default value: " Your E-Signature Request"

Message template to use in mail messages for virtual signatures.

Default value: "Your e-signature is [signature]. This e-signature has been generated using the following signature data fields you have provided: [datafields]."

Table 77: Global Configuration – MDC Offline Activation Data Message Settings

Field Name Description

SMS Message Template Message template to use in SMS messages for DIGIPASS for Mobile activation.

Voice Message Template

Default value: "Your offline activation data is [oad]. Serial number: [serialnumber]."

Message template to read by the voice delivery service for DIGIPASS for Mobile activation.

Default value: "Your offline activation data is [oad]. Serial number: [serialnumber]."

Email Message Template

Message template to use in e-mail messages for DIGIPASS for Mobile activation. Contains the following elements:

Email Message Header Name Optional. The name of a custom message header field to set in the message header.

Email Message Header Value

Email Message Subject

Default value: <empty>

Optional. The value of the custom message header field specified by Email Message Header Name .

Default value: <empty>

The text which should appear in the Subject field when a message is sent for DIGIPASS for Mobile activation.

Default value: " Your DIGIPASS Offline Activation Data"

IDENTIKEY Appliance 3.11.12 - Administrator Reference

128

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 77: Global Configuration – MDC Offline Activation Data Message Settings (continued)

Field Name Description

Email Message Template Message template to use in mail messages for DIGIPASS for Mobile activation.

Default value: "Your offline activation data for the DIGIPASS with serial number [serialnumber] is [oad].

QR-code: [oadQR]."

Table 78: Global Configuration – MDC DP Activation Delayed

Field Name Description

SMS

Message Template Message template to use in SMS messages for activation delayed notifications (delayed activation).

Default value: "The activation process (max [delayed_activation_period]h) for your DIGIPASS has been started. Serial number: [serialnumber]."

Voice

Message Template Message template to read by the voice delivery service for activation delayed notifications (delayed activation).

Default value: "The activation process (max [delayed_activation_period]h) for your DIGIPASS has been started. Serial number: [serialnumber]."

Header Name

Header Value

Subject

Message Template

Optional. The name of a custom message header field to set in the message header.

Default value: <empty>

Optional. The value of the custom message header field specified by Email Message Header Name .

Default value: <empty>

The text which should appear in the Subject field when a message is sent for activation delayed notifications (delayed activation).

Default value: "Your DIGIPASS Activation Status"

Message template to use in mail messages for activation delayed notifications (delayed activation).

Default value: "The activation process for your DIGIPASS with serial number [serialnumber] has been started. You will receive additional notification within [delayed_activation_period] hours."

Table 79: Global Configuration – MDC DP Activation Completed

Field Name Description

SMS

Message Template Message template to use in SMS messages for activation completed notifications (delayed activation).

Default value: "The activation process for your DIGIPASS has been completed. Serial number: [serialnumber]."

Voice

IDENTIKEY Appliance 3.11.12 - Administrator Reference

129

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 79: Global Configuration – MDC DP Activation Completed (continued)

Field Name Description

Message Template Message template to read by the voice delivery service for activation completed notifications (delayed activation).

Default value: "The activation process for your DIGIPASS has been completed. Serial number: [serialnumber]."

Header Name Optional. The name of a custom message header field to set in the message header.

Header Value

Subject

Message Template

Default value: <empty>

Optional. The value of the custom message header field specified by Email Message Header Name .

Default value: <empty>

The text which should appear in the Subject field when a message is sent for activation completed notifications (delayed activation).

Default value: "Your DIGIPASS Activation Status"

Message template to use in mail messages for activation completed notifications (delayed activation).

Default value: "The activation process for your DIGIPASS with serial number [serialnumber] has been completed."

When configuring message templates, you can use different placeholder strings as variables. The placeholder strings are replaced during run-time with the actual values, if applicable, otherwise the placeholder string will not be replaced.

Table 80: Message Template Placeholders

Placeholder String Description

Generic Placeholders (all message settings)

[domain]

[email]

[mobile]

[phone]

[serialnumber]

[userid]

[username]

The user domain.

The user's email address.

The user's mobile number. In Active Directory, this refers to the Mobile field in the user's list of available

Telephones .

The user's phone number. In Active Directory, this refers to the Telephone number field.

The serial number of the DIGIPASS authenticator.

The user identifier.

The user name.

Authentication Placeholders (MDC Virtual DIGIPASS Message Settings)

[OTP]

The user's requested one-time password.

Virtual Signature Placeholders (MDC Virtual Signature Message Settings)

IDENTIKEY Appliance 3.11.12 - Administrator Reference

130

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

Table 80: Message Template Placeholders (continued)

Placeholder String Description

[datafields]

[signature]

[oadQR]

A comma-separated list of user data fields used to generate the requested signature.

The requested signature.

Activation Placeholders (MDC Offline Activation Data Message Settings)

[oad]

The generated offline activation data, in text format.

The generated offline activation data, presented in QR format.

This field can only be used in email message templates!

Delayed Activation Placeholders (MDC DP Activation Delayed Message Settings, MDC DP Activation Completed Message Settings)

[delayed_activation_ period]

The delayed activation period (in hours), i.e. the time span until the DIGIPASS authenticator becomes active.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

131

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings

5.16. Servers – List

Table 81: Server List – Summary

Field Name Description

Location

Policy

Created

Modified

License Key

The IP address of the IDENTIKEY Authentication Server represented by the record.

The name of the policy that should be used for administration logon requests from the component, including live connections from the Audit Viewer. This policy is used if there is no specific Administration Program Client record for the location of the administration logon.

The date and time that the client was created. Read-only.

The date and time that the client was last modified. Read-only.

For each IDENTIKEY Authentication Server, a License Key is required. This consists of a set of parameters followed by a signature. Refer to the Licensing chapter in the IDENTIKEY Appliance Administrator Guide for more information.

5.17. LDAP Back-End Authentication

5.17.1. Supported LDAP Back Ends back-end authentication using the following LDAP back ends are supported by IDENTIKEY Appliance: n n n

Microsoft Active Directory

NetIQ eDirectory

IBM Security Directory Server

5.17.2. Microsoft Active Directory Back-End Authentication Using LDAP Protocol

When deploying Microsoft Active Directory with IDENTIKEY Appliance for back-end authentication, ensure that: n n n n

The domain controllers must be Windows Server 2008 or higher.

If the global catalog is set up (via Back End > Settings in the Administration Web Interface) and no backend components have been defined, domain discovery via the global catalog will be used to search for the user. If domain discovery via the global catalog is to be used, users must be set up in the same domain on

Active Directory as they are on IDENTIKEY Appliance.

The IDENTIKEY Appliance must be configured to use the DNS server containing the DNS records of the Active Directory server on the host OS.

The user ID that is to be used to log in to the Active Directory back end during authentication must have both search and update permissions for the data that is to be accessed. Also, for ANY group that uses

IDENTIKEY Appliance 3.11.12 - Administrator Reference

132

5. IDENTIKEY Authentication Server Administration Web Interface Field Listings back-end authentication via LDAP and Active Directory, the permission List contents must be granted in the Active Directory Users and Computers Extension to bind to Active Directory.

Table 82: Supported User Logon Format for Microsoft Active Directory

UserID Format Source of UserID

UserID

MYREALM\userid [email protected]

SAMAccountName attribute of the user

Fully qualified domain name + SAMAccountName attribute of the user

SamAccountName attribute of the user + fully qualified domain name

LDAP Configuration

The LDAP back end needs to be configured in order to allow the back end to authenticate via the LDAP protocol.

For instructions on how to do this, refer to the IDENTIKEY Appliance Administrator Guide.

Warning

When using Microsoft Active Directory as the back end and configuring LDAP back-end authentication with SASL-

DIGEST-MD5, the cyrus-sasl-md5 library must be installed to ensure connectivity between IDENTIKEY Authentication Server and Active Directory!

5.17.3. NetIQ eDirectory Back-End Authentication Using LDAP Protocol

The version of NetIQ eDirectory used for LDAP back-end authentication on IDENTIKEY Appliance must be version

8.8. In addition, the following rules must be followed to set up NetIQ eDirectory for LDAP back-end authentication on IDENTIKEY Appliance: n

If anonymous binding is disabled on the NetIQ eDirectory server, the security principal DN has to be a NetIQ n n eDirectory account that has the necessary permissions to search the directory for the user accounts that have to be authenticated.

Each user ID has to be unique below the search base distinguished name in the LDAP structure.

Partitioning is not supported, although exactly the same search base distinguished name may be used on n different servers.

NetIQ eDirectory must be enabled with universal password.

Table 83: Supported User Logon Format for NetIQ eDirectory

User ID Format Source of User ID

UserID

MYREALM\userid [email protected]

User ID of the user

Fully qualified domain name + user ID of the user

User ID attribute of the user + fully qualified domain name

Note

For more information about setting up a back-end server record for NetIQ eDirectory, refer to the Administration

Web Interface Help .

IDENTIKEY Appliance 3.11.12 - Administrator Reference

133

6. Reporting

IDENTIKEY Appliance provides a wide range of reporting options, with low-level control of aspects including desired fields, run-time query options, permissions, templates and scheduling.

You can use either pre-defined standard reports, which can be edited, or you can create your own customized reports.

Reports are managed from the Administration Web Interface.

For more information on reports, refer to the IDENTIKEY Appliance Product Guide .

6.1. Standard Reports

The IDENTIKEY Appliance reporting package will come with standard reports. Standard reports are provided for the most common administration tasks.

The standard reports can be grouped by their use: n n n

Reports produced by the helpdesk to help with troubleshooting functional problems n

Detailed Activity Summary n n n n n n n n

Detailed Authentication

Detailed DIGIPASS Registration

Detailed Provisioning

Detailed Signature Validation

DP Last Authentication List

Expired Users

Inactive DIGIPASS List

Signature Validation History n n

User Authentication History

User Last Authentication List n

Users About To Expire

Reports produced by system administrators to help with troubleshooting system problems n n n n

Authentication Activity by Client

Authentication Activity by User

Failed Operations Summary

Provisioning Activity by Client n n n n n n

Provisioning Activity by User

Succeeded Operations Summary

Transaction Signing Activity by Client

Transaction Signing Activity by User

Reports produced by administrators for system auditing information n

Account Lock Trend

Administration Activity Summary

Authentication Trend n n

DIGIPASS About To Expire

DP Assignment Activity Summary

IDENTIKEY Appliance 3.11.12 - Administrator Reference

134

6. Reporting n n n n n

DP Availability by Type

DP Deployment by Type

DP Deployment Trend

Expired DIGIPASS n n

Provisioning Activity Trend

Transaction Signing Activity Trend n

Unassigned DIGIPASS List

Reports relating to RADIUS clients and users n n n n

RADIUS Client Activity Summary

RADIUS Client Detailed Activity

RADIUS User Activity Summary

RADIUS User Detailed Activity

6.2. Query Definitions

Queries consist of: n n n a Data field, which is a field from the database, an Operator, which is the operation to be performed on the data field, a Value, which is the value the data field will be compared against. A value is not necessary with all operators.

To define a query you must select a data field and an operator. Operators can be selected from the following: n n n n n n n n n n n n n n n n equals does not equal starts with does not start with includes does not include ends with does not end with is null is not null is blank is not blank is greater than is greater than or equal to is less than is less than or equal to

A value is not required for every operator.

Combinations of Data field, Operator and Values can be used to define queries.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

135

6. Reporting

6.3. Query Filters

As mentioned above, queries can be defined from user, DIGIPASS and audit data fields. The fields listed below are available for selection when defining a query.

Any date defined in this list can have the following filter applied to it:

Use the operators is less than or equal to or is greater than or equal to and specify one or more days, weeks or months from now, where now is taken to be the current date.

The filter must be in the format n n n

1 day from now

6 weeks from now

5 years from now with the exact spelling and the exact number of spaces. The number must be a numeric character. The filter is not case sensitive.

The words from now can be replaced with ago. So the term is greater than or equal to 3 years ago will select information 3 years old or older.

Table 84: User Field List

Display Name Type Accepted Values

Domain Link

User:Backend Authentication

User:Created time

User:Description

String

Date

String

Domain of linked user.

n n n n

Default

None

If Needed

Always

Format: yyyy/mm/dd hh:mm:ss

User:Disabled Boolean n n

IDENTIKEY Appliance 3.11.12 - Administrator Reference

136

Table 84: User Field List (continued)

Display Name Type Accepted Values

User:Domain

User:Email

User:Expiration Date

User:Has Digipass

String

Date

String

User:Link

User:Local Authentication

String

Format: yyyy/mm/dd hh:mm:s n n

Assigned

Unassigned

User ID of linked User.

n n n n n

Default

None

Digipass Only

Digipass/Password

DIGIPASS or Password

User:Lock Count

User:Locked

Number

Boolean n n

User:Mobile

User:Modified time

User:Organizational Unit

User:Phone

User:Status

User:User ID

User:User Name

String

Date

String

Format: yyyy/mm/dd hh:mm:ss

The fields specified in the user field list can be referred to in the XSLT templates.

Table 85: DIGIPASS field list

Display Name Type Accepted Values

Digipass:Application Names String

Digipass:Application Types

Digipass:Assigned

String

Date

Comma-separated list of DIGIPASS Application

Names.

Comma-separated list of DIGIPASS Application

Types.

Format: yyyy/mm/dd hh:mm:ss

IDENTIKEY Appliance 3.11.12 - Administrator Reference

6. Reporting

137

Table 85: DIGIPASS field list (continued)

Display Name Type Accepted Values

Digipass:Backup VDP Enabled String

Digipass:Backup VDP Expires Date

Digipass:Backup VDP Uses Left Number

Digipass:Created time

Digipass:Digipass Type

Digipass:Domain

Date

String

Digipass:Grace Period End

Digipass:Modified time

Digipass:Serial Number

Digipass:Status

Date

String

Digipass:User ID

Digipass:Expiration Date

String

Date or

String n n n n

Default

Yes – Permitted

Yes – Required

Format: yyyy/mm/dd hh:mm:ss

5-character code.

Format: yyyy/mm/dd hh:mm:ss

Format: yyyy/mm/dd hh:mm:ss n n

Assigned

Unassigned

User ID of the user to whom the

DIGIPASS authenticator is assigned.

Format: yyyy/mm/dd hh:mm:s

Table 86: Audit field list

Display Name

Audit:Action

Audit:AMID

Audit:Application

Audit:Area

Audit:Category

Audit:Characteristics

Audit:Client Location

Audit:Code

Type

String

Accepted Values

See

for a list of possible codes and messages used by the Audit System.

IDENTIKEY Appliance 3.11.12 - Administrator Reference

6. Reporting

138

Table 86: Audit field list (continued)

Display Name

Audit:Command

Audit:Configuration Details

Audit:Credentials

Audit:Data Source

Audit:Data Source Location

Audit:Description

Audit:Downtime

Audit:Error Code

Audit:Error Details

Audit:Error Message

Audit:Fields

Audit:From

Audit:Input Details

Audit:Message

Audit:Object

Audit:Operation

Audit:Outcome

Audit:Output Details

Audit:Password Protocol

Audit:Policy ID

Audit:Quota

Audit:RADIUS Octets Input

Audit:RADIUS Octets Output

Type Accepted Values

String

String See

for a list of possible codes and messages used by the Audit System.

Number

Number See

for a list of error codes used by IDENTIKEY Appliance.

String See

used by IDENTIKEY Appliance.

for a list of error codes

String See

for a list of error codes used by IDENTIKEY Appliance.

String

String See