IDENTIKEY
®
Appliance
Administrator Guide
3.11.12
Disclaimer of Warranties and Limitations of Liabilities
Intellectual Property
VASCO Software, documents and related materials (“Materials”) made available on the Site contain proprietary and confidential information. All title, rights and interest in VASCO Software and Materials, updates and upgrades thereof, including software rights, copyrights, patent rights, trade secret rights, sui generis database rights, and all other intellectual and industrial property rights, vest exclusively in
VASCO or its licensors. No VASCO Software or Materials published in this Site may be downloaded, copied, transferred, disclosed, reproduced, redistributed, or transmitted in any form or by any means, electronic, mechanical or otherwise, for any commercial or production purpose, except as otherwise marked or when expressly permitted by VASCO in writing.
Disclaimer
VASCO accepts no liability for the accuracy, completeness, or timeliness of Site content, or for the reliability of links to and content of external or third party websites.
VASCO shall have no liability under any circumstances for any loss, damage, or expense incurred by you, your company, or any third party arising from the use or inability to use VASCO Software or Materials, or any third party material available or downloadable from the Site. VASCO will not be liable in relation to any loss/damage caused by modification of these Legal Notices or Site content.
Reservation
VASCO reserves the right to modify these Notices and the content at any time. VASCO likewise reserves the right to withdraw or revoke consent or otherwise prohibit use of the VASCO Software or Materials if such use does not conform to the terms of any written agreement between VASCO and you, or other applicable terms that VASCO publishes from time to time.
Copyright
Copyright © 2008–2016 VASCO Data Security, Inc., VASCO Data Security International GmbH. All rights reserved.
Trademarks
VASCO
®
, VACMAN
®
, IDENTIKEY
®
, aXsGuard
®
, DIGIPASS
®
, CertiID
®
, CRONTO™, MYDIGIPASS.COM™, the MYDIGIPASS.COM MD Lock logo, the DP+ logo, the VASCO ‘V’ logo, and the CRONTO logo are registered or unregistered trademarks of VASCO Data Security, Inc. and/or VASCO Data Security International GmbH in the U.S. and other countries.
VASCO reserves all rights to the trademarks, service marks and logos of VASCO and its subsidiaries.
Date last modified: 12/2/2016
Table of Contents
Table of Contents
1. Introduction
1.1. IDENTIKEY Appliance Documentation Set
2. Administration Interfaces for IDENTIKEY Appliance
2.1. Administration Interfaces
16
16
17
17
2.2. Accessing the Configuration Tool and the Administration Web Interface 17
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration
Web Interface 18
3. Manual Settings in the Configuration Tool 22
3.1. Enabling Services
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
4.1. Client Component Records
4.2. Client Component Types
22
24
24
25
4.3. User Records
4.4. DIGIPASS Records and Assignment
4.5. DIGIPASS Licensing and Activation
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
5.1. Working with the User Dashboard
5.2. View Audit Message Page
5.3. Generating Reports via the Reports Tab
5.4. Configuring the User Dashboard
6. System Administrator Accounts
6.1. Disabling the Default sysadmin User Account
6.2. Creating Additional Administrator Accounts
7. Typical DIGIPASS Authentication Module Setup
7.1. Create a Client Component
41
41
42
45
45
35
38
39
39
27
29
31
35
IDENTIKEY Appliance 3.11.12 - Administrator Guide
iii
8. Typical RADIUS Setup
8.1. RADIUS Client Configuration
9. DIGIPASS Authentication for Windows Logon
9.1. IDENTIKEY Appliance Configuration
9.2. Configuration of Windows Group Check in the Administration Web Interface
9.3. Password Randomization
9.4. Export Server Certificate (Optional)
9.5. Client Installation and Configuration
10. LDAP User Synchronization
10.1. Overview
10.2. LDAP Synchronization Profiles
10.3. Microsoft Active Directory Synchronization
10.4. NetIQ eDirectory Synchronization
10.5. Other LDAP Server Synchronizations
11. Back-End Authentication
11.1. RADIUS Back-End Authentication
11.2. NetIQ eDirectory Back-End Authentication
11.3. Microsoft Active Directory Back-End Authentication
11.4. IBM Security Directory Server Back-End Authentication
12. Replication
12.1. Replication Wizard
13. Secure Sockets Layer (SSL)
13.1. Managing Certificates
13.2. Using Server Certificates
13.3. Using CA Certificates for Client Verification
14. Setting Up Signing and Provisioning
IDENTIKEY Appliance 3.11.12 - Administrator Guide
Table of Contents
73
78
79
79
67
69
70
72
87
87
89
91
94
61
62
64
66
58
60
60
61
49
49
52
52
55
iv
14.1. SOAP Communication Protocol
14.2. Enabling Signing and Provisioning Services
14.3. Configuring Signature and Provisioning Setups
15. Setting Up Virtual DIGIPASS
15.1. Importing Virtual DIGIPASS Records
15.2. Setting Up Message Delivery Component (MDC)
15.3. Setting Up IDENTIKEY Appliance Policies for Virtual DIGIPASS
15.4. Testing Virtual DIGIPASS
15.5. Assigning Policies to Clients for Using Virtual DIGIPASS
16. Reporting
16.1. Working With Reports
16.2. Creating Reports Using the Report Definition Wizard
16.3. PDF and HTML Report Customization
16.4. Report Retrieval
17. Configuring RADIUS Environments
17.1. Stand-Alone IDENTIKEY Appliance in RADIUS Environment
17.2. IDENTIKEY Appliance as RADIUS Proxy Target
17.3. IDENTIKEY Appliance as Intermediate Server
17.4. Wireless RADIUS
17.5. Customizing the RADIUS Attributes Dictionary
18. IDENTIKEY Authentication Server Discovery
18.1. Registering IDENTIKEY Appliance with DNS Server
18.2. Server Discovery
19. Test Policy Settings
19.1. Basic Testing Procedure - Prerequisites and Configurations
19.2. Test Local Authentication
IDENTIKEY Appliance 3.11.12 - Administrator Guide
Table of Contents
114
116
121
123
110
111
111
112
123
123
126
126
128
103
103
106
107
95
98
101
102
94
94
94
95
95
v
19.3. Test RADIUS Back-End Authentication
19.4. Test Management Features
20. Administration Tasks
20.1. Scheduled Task Management
20.2. Changing Task Schedules
20.3. Deleting Scheduled Tasks
21. Monitoring
21.1. Overview
21.2. Disk Use
21.3. Logging
21.4. Auditing
21.5. Tracing
21.6. Configuring SNMP
21.7. Downloading VASCO MIB Files
22. Performance Monitoring
22.1. Filters
22.2. Plugins
23. System Monitoring
23.1. Configuring System Monitoring for System OS Events
23.2. Configuring System Monitoring for IDENTIKEY Appliance Configuration Tool Events
23.3. Configuring System Monitoring for IDENTIKEY Authentication Server Events
23.4. Configuring SNMP Trap Handlers
23.5. Best Practices for SNMP Targets
24. Troubleshooting
24.1. Connection Problems
24.2. Dynamic Component Registration Problems
Table of Contents
168
168
170
173
163
165
165
167
174
175
177
177
177
139
145
155
159
137
138
138
138
129
132
137
137
137
IDENTIKEY Appliance 3.11.12 - Administrator Guide
vi
24.3. Administration Web Interface Connectivity
24.4. DIGIPASS User Account Locking
24.5. DIGIPASS Event Counter Out of Sync
24.6. Wireless RADIUS Authentication Failures
24.7. LDAP User Synchronization Issues
24.8. LDAP Back-End Authentication Setup Issues
25. Support
25.1. Support Procedure
25.2. Allowing Remote Support Connections
Table of Contents
178
178
180
182
183
184
186
186
186
IDENTIKEY Appliance 3.11.12 - Administrator Guide
vii
Table of Contents
Illustration Index
Image 1: IDENTIKEY Appliance Configuration Tool SSL Certificate Warning
Image 2: Login Pages - IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
Image 3: IDENTIKEY Authentication Server Administration Web Interface Home Page
Image 4: IDENTIKEY Appliance Configuration Tool Home Page
Image 5: Enabling or Disabling Services in IDENTIKEY Appliance Configuration Tool
Image 6: Adding a Client Component in IDENTIKEY Authentication Server Administration Web Interface
Image 7: Adding a Client Component in IDENTIKEY Authentication Server Administration Web Interface
Image 8: Adding a Client Component in IDENTIKEY Authentication Server Administration Web Interface
Image 9: DIGIPASS Assignment
Image 10: Disabling the User Account sysadmin
Image 11: Creating User Account (1) – Completing User Details
Image 12: Creating User Account (2) – Editing Administration Privileges
Image 13: Registering Clients in the IDENTIKEY Authentication Server Administration Web Interface
Image 14: Create a New Administration Program Client in the IDENTIKEY Authentication Server Administration Web Interface
Image 15: Stand-Alone IDENTIKEY Appliance in a RADIUS Environment
Image 16: Registering Clients in the IDENTIKEY Authentication ServerAdministration Web Interface
Image 17: Create a New RADIUS Client in the IDENTIKEY Authentication Server Administration Web Interface
Image 18: Configuration of IP-to-Name Resolving in the IDENTIKEY Appliance Configuration Tool
Image 19: Selecting Clients in the IDENTIKEY Authentication Server Administration Web Interface
Image 20: Create a New RADIUS Client in the IDENTIKEY Authentication ServerAdministration Web Interface
Image 21: Restricting Dynamic Component Registration with Windows Group Check - Select Policy
Image 22: Restricting Dynamic Component Registration with Windows Group Check - Editing the Settings
Image 23: Restricting Dynamic Component Registration with Windows Group Check - Editing DCR
Image 24: Configuring Password Randomization
Image 25: Creating LDAP Synchronization Profiles in the Configuration Tool
Image 26: Configuring the LDAP Synchronization Profile
Image 27: Example Filter and Attribute Mappings for Microsoft Active Directory 2003/2008
Image 28: Properties of an Example Object in Microsoft Active Directory
62
63
65
57
58
59
66
51
53
54
55
56
47
49
50
30
41
43
44
46
25
28
29
18
19
20
21
23
IDENTIKEY Appliance 3.11.12 - Administrator Guide
viii
Image 29: Example Filter and Attribute Mappings for NetIQ eDirectory
Image 30: IDENTIKEY Appliance as Intermediate Server for OTP only
Image 31: Authentication Back-Ends
Image 32: Editing RADIUS Back-End Policy
Image 33: Manual Configuration of the Simple Password
Image 34: Configuring Active Directory Domain Controller for IDENTIKEY Appliance
Image 35: Global Catalog Server Settings for IDENTIKEY Appliance
Image 36: Replication Wizard Step 1 - Welcome Screen
Image 37: Replication Wizard Step 2 - Remote IP Address
Image 38: Replication Wizard Step 3 - Set Up Replication
Image 39: Replication Wizard Step 3 - Set Up Processing
Image 40: Replication Setup Processing Screen Feedback
Image 41: Replication Status in the IDENTIKEY Appliance Configuration Tool
Image 42: Replication Status in the IDENTIKEY Authentication Server Administration Web Interface
Image 43: Remove Replication Wizard Welcome Screen
Image 44: Remove Replication Wizard - Removal Processing
Image 45: Server Certificate Configuration (SEAL)
Image 46: Client Certificate Configuration (SEAL)
Image 47: Customized report data flow
Image 48: Wireless RADIUS Components
Image 49: Uploading a Custom RADIUS Dictionary
Image 50: Configuration Tool IDENTIKEY Authentication Server Discovery without Authentication Type
Image 51: Configuration Tool IDENTIKEY Authentication Server Discovery with TSIG as Authentication Type
Image 52: IDENTIKEY ApplianceConfiguration Tool Disk Use Overview
Image 53: Configuring Logging
Image 54: Configuring Remote Logging
Image 55: Live Log Viewer
Image 56: Viewing Logs
Image 57: Simple Log Filter Entry and Result
IDENTIKEY Appliance 3.11.12 - Administrator Guide
Table of Contents
141
142
142
125
139
140
143
93
108
116
121
124
86
86
91
81
82
83
84
85
77
80
81
67
69
70
71
73
75
ix
Image 58: Using the Advanced Filter
Image 59: Advanced Log Filter Fields
Image 60: Downloading System Log Files
Image 61: Configuring IDENTIKEY Authentication Server Audit Settings in the Configuration Tool
Image 62: Live Audit Viewer
Image 63: Viewing the Live Audit Viewer
Image 64: Simple Audit Filter Entry and Result
Image 65: Using the Advanced Filter
Image 66: Advanced Audit Filter Fields
Image 67: Exporting from the Audit Viewer
Image 68: Exporting Audit Files
Image 69: Downloading Audit Files
Image 70: Configuring Tracing for IDENTIKEY Authentication Server
Image 71: Configuring Tracing for Message Delivery Component (MDC)
Image 72: Configuring Tracing for LDAP User Synchronization
Image 73: Managing Trace Files
Image 74: Configuring SNMP v2c
Image 75: Configuring SNMP v3
Image 76: Downloading VASCO MIB Files
Image 77: Adding Filter in Performance Monitoring
Image 78: Configuring Notification Settings
Image 79: Configuring Support Connections
Image 80: Selecting Support Certificate
Table of Contents
161
164
166
158
159
161
171
187
187
151
151
153
149
149
150
156
157
143
144
145
146
148
148
IDENTIKEY Appliance 3.11.12 - Administrator Guide
x
Table Index
Table 1: Dashboard Used Clients - Displayed Fields
Table 2: Report Definition Criteria
Table 3: Field Values for Installation
Table 4: Microsoft Active Directory 2003/2008 Filter Settings
Table 5: NetIQ eDirectory Filter Settings
Table 6: Certificate Restrictions
Table 7: Paper-Size Values (for customized PDF/HTML reports)
Table 8: Required Wireless Access Point Settings
Table 9: Component Record Settings for Each Wireless Access Point
Table 10: Policy and Component Record Details when allowing roaming Wireless Connections
Table 11: Log Filter Fields
Table 12: Audit Filter Fields
Table 13: Audit Export Fields
Table 14: Processes Monitored Via SNMP Traps
Table of Contents
118
119
144
90
109
117
150
152
168
36
39
48
64
66
IDENTIKEY Appliance 3.11.12 - Administrator Guide
xi
Table of Contents
Procedure Index
Procedure 1: Logging on to the administration interfaces
Procedure 2: Enabling or disabling services
Procedure 3: Registering client records in IDENTIKEY Authentication Server
Procedure 4: Creating a user record manually
Procedure 5: Inspecting recent user activity
Procedure 6: Inspecting recent DIGIPASS activity
Procedure 7: Configuring the recent activity settings
Procedure 8: Disabling the default sysadmin user account
Procedure 9: Creating an administrator account
Procedure 10: Creating a Client Component: DIGIPASS Authentication Module
Procedure 11: Deleting the temporarily created Client Component
Procedure 12: Creating a Client Component: RADIUS client
Procedure 13: Changing the default Client Component
Procedure 14: Restricting Dynamic Component Registration with Windows Group Check
Procedure 15: Enabling randomized passwords for Windows Logon and setting the password length
Procedure 16: Creating an LDAP synchronization profile
Procedure 17: Viewing user account attributes on your Microsoft Active Directory
Procedure 18: Configuring back-end authentication
Procedure 19: Enabling RADIUS back-end authentication
Procedure 20: Adding a RADIUS back-end server record
Procedure 21: Adjusting authentication policy settings
Procedure 22: Creating a client record and assign the policy
Procedure 23: Enabling NetIQ eDirectory back-end authentication
Procedure 24: Adding a NetIQ eDirectory back-end server record
Procedure 25: Exporting a CA certificate
Procedure 26: Enabling Microsoft Active Directory back-end authentication
Procedure 27: Configuring the AD domain controller (with the DNS server role) as the DNS server for IDENTIKEY Appliance
Procedure 28: Adding an Active Directory back-end server record in the IDENTIKEY Authentication Server Administration Web Interface
74
74
75
72
72
72
75
65
69
70
70
71
55
59
62
42
45
48
50
54
38
40
41
18
22
24
28
37
IDENTIKEY Appliance 3.11.12 - Administrator Guide
xii
Procedure 29: Configuring the global catalog server on IDENTIKEY Appliance
Procedure 30: Enabling IBM Security Directory Server back-end authentication
Procedure 31: Adding an IBM Security Directory Server back-end server record
Procedure 32: Setting up replication
Procedure 33: Removing replications
Procedure 34: Editing a server or CA certificate
Procedure 35: Downloading a server or CA certificate
Procedure 36: Deleting a server or CA certificate
Procedure 37: Adding a server certificate
Procedure 38: Adding a trusted root certification authority (CA) bundle
Procedure 39: Selecting a server certificate for a communicator component
Procedure 40: Selecting a CA certificate/bundle for a communicator component
Procedure 41: Setting up an SMS gateway for Message Delivery Component (MDC)
Procedure 42: Setting up an email gateway for Message Delivery Component (MDC)
Procedure 43: Setting up a voice gateway for Message Delivery Component (MDC)
Procedure 44: Importing a gateway definition
Procedure 45: Setting up a policy for Primary Virtual DIGIPASS
Procedure 46: Setting up a policy for Backup Virtual DIGIPASS (Permitted, Not Mandatory)
Procedure 47: Setting up a policy for Backup Virtual DIGIPASS (Permitted, Not Mandatory, Time-Limited)
Procedure 48: Setting up a policy for Backup Virtual DIGIPASS (Mandatory)
Procedure 49: Testing Primary Virtual DIGIPASS
Procedure 50: Testing Backup Virtual DIGIPASS
Procedure 51: Assigning a policy to a client for using Virtual DIGIPASS
Procedure 52: Running an existing report
Procedure 53: Changing the report owner
Procedure 54: Editing a report
Procedure 55: Deleting a report
Procedure 56: Creating a report
Procedure 57: Viewing a report's corresponding XSLT script
IDENTIKEY Appliance 3.11.12 - Administrator Guide
Table of Contents
105
105
106
102
103
105
110
100
100
100
101
101
97
98
99
89
91
92
96
97
88
88
88
77
78
78
80
85
87
xiii
Procedure 58: Linking a custom template to a report
Procedure 59: Deploying Stand-Alone IDENTIKEY Appliance in RADIUS Environment
Procedure 60: Deploying IDENTIKEY Appliance as a RADIUS proxy server
Procedure 61: Deploying IDENTIKEY Appliance as an intermediate server
Procedure 62: Uploading a custom RADIUS dictionary
Procedure 63: Enabling Server Discovery in DIGIPASS Windows Logon
Procedure 64: Registering DNS service without authentication type
Procedure 65: Registering DNS service with TSIG as the authentication type
Procedure 66: Creating a test policy
Procedure 67: Testing directly logging on the RADIUS server
Procedure 68: Create new back-end server record
Procedure 69: To edit a task
Procedure 70: To delete an existing task
Procedure 71: Configuring the type of logging
Procedure 72: Configuring remote logging
Procedure 73: Viewing and filtering log files
Procedure 74: Downloading and deleting log files
Procedure 75: Viewing and filtering audit files
Procedure 76: Exporting audit files
Procedure 77: Downloading and deleting audit files
Procedure 78: Using the Secure Auditing Verification Tool
Procedure 79: Configuring tracing for IDENTIKEY Authentication Server
Procedure 80: Configuring tracing for Message Delivery Component (MDC)
Procedure 81: Configuring Tracing for LDAP user synchronization
Procedure 82: Managing Trace Files
Procedure 83: Configuring SNMP Settings
Procedure 84: Downloading VASCO MIB files
Procedure 85: Configuring system monitoring targets for system OS events
Procedure 86: Configuring system monitoring targets for IDENTIKEY Appliance Configuration Tool events
IDENTIKEY Appliance 3.11.12 - Administrator Guide
Table of Contents
160
163
169
156
157
158
171
148
151
152
140
142
144
154
155
130
131
137
124
124
126
137
140
110
111
113
115
121
123
xiv
Procedure 87: Adding a system monitoring filter for IDENTIKEY Appliance Configuration Tool events
Procedure 88: Configuring system monitoring targets for IDENTIKEY Authentication Server events
Procedure 89: Configuring an SNMP trap handler
Procedure 90: Unlocking a locked DIGIPASS user account manually
Procedure 91: Resetting the error count manually (ODBC)
Procedure 92: Resetting the error count manually (AD)
Procedure 93: Re-importing a DIGIPASS authenticator
Procedure 94: Allowing remote support connections
Table of Contents
172
173
174
179
180
180
181
186
IDENTIKEY Appliance 3.11.12 - Administrator Guide
xv
1. Introduction
1. Introduction
IDENTIKEY Appliance Administrator Guide is part of the documentation set about IDENTIKEY Appliance. It provides in-depth guidance for performing common or complicated tasks on IDENTIKEY Appliance and IDENTIKEY Authentication Server.
If not stated otherwise, the information in this guide also applies to IDENTIKEY Virtual Appliance.
1.1. IDENTIKEY Appliance Documentation Set
The following IDENTIKEY Appliance guides are available: n n n n n n n n
IDENTIKEY Appliance Administrator Guide . Explains the steps needed for administration tasks, including monitoring and troubleshooting.
IDENTIKEY Appliance Administrator Reference . Provides field explanations and other organized reference material for technical experts using IDENTIKEY Appliance intended for reference only.
IDENTIKEY Appliance Installation and Maintenance Guide . Explains the steps required to connect the
IDENTIKEY Appliance to your network, first-time configuration and maintenance procedures, such as updating and re-licensing.
IDENTIKEY Appliance Product Guide . Describes the structure of the product, the concepts underpinning authentication and how IDENTIKEY Appliance can support authentication within an existing infrastructure.
IDENTIKEY Authentication Server SDK Programmer Guide . Provides in-depth information required for development work using the SDK. This document is relevant to SOAP Authentication, electronic signatures and provisioning using the IDENTIKEY Appliance.
Documents about DIGIPASS Authentication for Windows Logon. Provide information about the concepts, installation and configuration, setup, and procedures to test DIGIPASS Authentication for Windows Logon.
Two Password Synchronization Manager guides for installation and usage information.
Filter guides for each available filter for installation and usage information.
Access to the IDENTIKEY Appliance documentation is provided via the IDENTIKEY Appliance Configuration Tool.
Manuals for IDENTIKEY Appliance add-ons are provided on the CD-ROM delivered with the appliance.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
16
2. Administration Interfaces for IDENTIKEY Appliance
2. Administration Interfaces for IDENTIKEY Appliance
2.1. Administration Interfaces
IDENTIKEY Appliance provides three administration interfaces: n n n
The Rescue Tool, which is used to manage limited settings (for more information, refer to the IDENTIKEY
Appliance Installation and Maintenance Guide ).
The IDENTIKEY Appliance Configuration Tool, which is used for installation, licensing, and maintenance of the IDENTIKEY Appliance.
The Administration Web Interface, used for daily administration of the system after licensing IDENTIKEY
Appliance.
2.2. Accessing the Configuration Tool and the Administration Web Interface
Warning
Using the default user account sysadmin for accessing the Configuration Tool is less secure than using a new user account which requires DIGIPASS one-time password authentication. VASCO therefore recommends using the administrator user account created via the IDENTIKEY Authentication Server Setup Wizard, and disabling the system administrator account as soon as possible.
The IDENTIKEY Appliance Configuration Tool and Administration Web Interface are accessed using a standard web browser. Access is secured by SSL (Secure Socket Layer) encryption via the HTTPS protocol.
Note
The URL used to access the administration interfaces for IDENTIKEY Appliance is :
https://<appliance_ip_address>/
This URL will point to the IDENTIKEY Appliance Welcome Page – from the Welcome Page you access both the
IDENTIKEY Appliance Configuration Tool and the Administration Web Interface.
The IDENTIKEY Appliance Welcome Page offers you two links leading to the IDENTIKEY Appliance Configuration
Tool to further configure IDENTIKEY Appliance, and to the IDENTIKEY Authentication Server Administration Web Interface, allowing daily management. Until first-time configuration, licensing, and the IDENTIKEY Authentication Server
Setup Wizard configuration have been completed, only the link to the IDENTIKEY Appliance Configuration Tool is active. After licensing, the link to the IDENTIKEY Authentication Server Administration Web Interface is also enabled.
For more information about configuring IDENTIKEY Authentication Server and the administration interface access, refer to the IDENTIKEY Appliance Installation and Maintenance Guide .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
17
2. Administration Interfaces for IDENTIKEY Appliance
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server
Administration Web Interface
Logging on to the administration interfaces consists of several steps:
Procedure 1: Logging on to the administration interfaces
1. Enter the URL for the interface in the browser. As you are accessing a web site secured with a self-signed certificate, the browser presents a warning, asking you to accept the certificate to continue.
Note
The procedure for accepting a certificate varies between browsers. Internet Explorer is used in the example below.
Image 1: IDENTIKEY Appliance Configuration Tool SSL Certificate Warning
Accept the certificate according to your browser's instructions.
2. After the certificate has been accepted, access the required interface by clicking on the interface title on the Welcome Page. This will open the corresponding login page of the interface you are accessing.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
18
2. Administration Interfaces for IDENTIKEY Appliance
Image 2: Login Pages - IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server
Administration Web Interface
3. Log on using administrator login credentials. The default administrative user name and factory default password is: n n
User: sysadmin
Password: sysadmin
Be aware that the password may have already been changed by a network administrator, and that new administrative user accounts may have been created; also, the default user sysadmin may have been disabled.
Note
The IDENTIKEY Authentication ServerSetup Wizard must be completed (as described in the IDENTIKEY
Appliance Installation and Maintenance Guide ) before the IDENTIKEY Authentication Server Administration Web Interface can be accessed.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
19
2. Administration Interfaces for IDENTIKEY Appliance
Image 3: IDENTIKEY Authentication Server Administration Web Interface Home Page
IDENTIKEY Appliance 3.11.12 - Administrator Guide
20
2. Administration Interfaces for IDENTIKEY Appliance
Image 4: IDENTIKEY Appliance Configuration Tool Home Page
IDENTIKEY Appliance 3.11.12 - Administrator Guide
21
3. Manual Settings in the Configuration Tool
3. Manual Settings in the Configuration Tool
After first-time installation has been completed, manual configurations in the IDENTIKEY Appliance Configuration
Tool are possible. This allows you to n n alter settings which were entered during the Configuration Wizard configure additional settings, such as for Virtual DIGIPASS (Message Delivery Component).
For more information about manual configuration without the wizard, refer to the section on installation configurations in the IDENTIKEY Appliance Product Guide , and the section on configuration tool field listings in the
IDENTIKEY Appliance Administrator Reference .
To adjust the settings manually, log on to the Configuration Tool (see
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
). Navigate to Configuration Tool
> Settings , select the relevant item from the Settings menu, and enter or adjust the settings as required.
3.1. Enabling Services
IDENTIKEY Appliance includes the following services: n n n
Authentication
Provisioning
Signatures
These services are enabled by default but can be manually disabled or enabled:
Procedure 2: Enabling or disabling services
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
)..
IDENTIKEY Appliance 3.11.12 - Administrator Guide
22
3. Manual Settings in the Configuration Tool
2. Navigate to Authentication Server > Scenarios .
3. Enable or disable services by selection the corresponding check box.
Image 5: Enabling or Disabling Services in IDENTIKEY Appliance Configuration Tool
For more information about the different service and screen fields, refer to the IDENTIKEY Appliance Product Guide and the IDENTIKEY Appliance Administrator Reference .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
23
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
This section explains how to perform basic configuration tasks in the IDENTIKEY Authentication Server Administration Web Interface of IDENTIKEY Appliance. All the instructions described in this section need to be completed in the IDENTIKEY Authentication Server Administration Web Interface.
For more information on the concepts introduced in this section and how they operate during an authentication attempt, refer to the section on the user authentication process in the IDENTIKEY Appliance Product Guide .
Three further configurations are essential to support authentication, electronic signatures, or provisioning: n n n
Client Components need to be registered for authentication (or other) services on IDENTIKEY Appliance
User records need to be registered on IDENTIKEY Appliance
DIGIPASS authenticators need to be registered on IDENTIKEY Applianceand assigned to user accounts
In the following sections, we provide instructions for these configurations.
4.1. Client Component Records
A Client Component record is required for each service that is to be run on IDENTIKEY Authentication Server, such as RADIUS, or SEAL.
Each service (for example authentication) in the network, which needs to access IDENTIKEY Authentication Server services, must be registered on IDENTIKEY Authentication Server as a Client Component for access to be allowed and policies to be applied. For further conceptual information, refer to the sections on Client Components and policies of the IDENTIKEY Appliance Product Guide ; for a list and explanation of the relevant fields, refer to the
IDENTIKEY Appliance Administrator Reference .
Client records are registered in IDENTIKEY Authentication Server under the Clients tab of the IDENTIKEY Authentication Server Administration Web Interface.
Procedure 3: Registering client records in IDENTIKEY Authentication Server
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > Register .
3. Identify the client type.
4. Enter a policy ID.
5. Identify the protocol ID.
6. Enter optional settings if required, e.g. a RADIUS Shared Secret or Character Encoding
7. Select the Enabled check box to enable the new client.
8. Click on Create .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
24
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
Image 6: Adding a Client Component in IDENTIKEY Authentication Server Administration Web Interface
4.2. Client Component Types
This section describes the different client components used by IDENTIKEY Appliance.
4.2.1. SOAP Client Programs
SOAP client programs are not called 'SOAP clients'. The program itself specifies the type as a parameter to each request. A client component record must exist for this type at the location (IP address) where the application runs.
The policy in the component record will be used for all processing of requests from this client.
4.2.2. Administration Program
Creating a component record for a VASCO administration program (e.g. Administration Web Interface or Audit
Viewer) allows a policy to be set for connections from that program.
A component record must exist for each Administration Web Interface or any other administration program using
SOAP and SEAL.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
25
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
4.2.3. IDENTIKEY User Websites
IDENTIKEY User Websites is a pre-defined SOAP-based Client Component used for IDENTIKEY User Websites clients. The client component record will be checked whenever the IDENTIKEY User Websites client sends request to
IDENTIKEY Appliance.
One client component record must exist for each IDENTIKEY User Websites client installed at different locations
(IP address). Each client component record requires a valid license key.
4.2.4. RADIUS Client
A RADIUS Client Component record is required when clients will be sending authentication requests to IDENTIKEY
Appliance using the RADIUS protocol. The IDENTIKEY Appliance will check the component record to find: n n the shared secret to use for communicating with the RADIUS client the policy to apply to the authentication request
A default RADIUS client component record is automatically created during installation of IDENTIKEY Appliance. This can be deleted and specific records created for each location.
Note
The default RADIUS client created during installation will be given a shared secret by default.
For information about a typical setup of a RADIUS client, see
8. Typical RADIUS Setup
.
4.2.5. DIGIPASS Authentication Module
A component record is required for any DIGIPASS Authentication Module used with IDENTIKEY Appliance. The component record will be checked whenever the DIGIPASS Authentication Module sends an authentication request to the IDENTIKEY Appliance. The IDENTIKEY Appliance will check: n n that the component record contains a valid license key for a client module which policy to apply to the authentication request
The following client types fall into this category: n n n n n n n n
Citrix Web Interface (DIGIPASS Authentication for Citrix Web Interface)
Outlook Web Access (DIGIPASS Authentication for OWA Basic and DIGIPASS Authentication for OWA Forms)
IIS6 Module (DIGIPASS Authentication for IIS Basic)
Windows Remote Desktop Web (DIGIPASS Authentication for Remote Desktop Web Access)
SBR Plug-In (DIGIPASS Authentication for Steel-Belted RADIUS Server)
Citrix Storefront (DIGIPASS Authentication for Citrix StoreFront)
Microsoft ADFS (DIGIPASS Authentication for Microsoft ADFS)
Epic Hyperspace (DIGIPASS Authentication for Epic Hyperspace)
IDENTIKEY Appliance 3.11.12 - Administrator Guide
26
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
For information about a typical setup of a DIGIPASS Authentication Module, see
7. Typical DIGIPASS Authentication Module Setup
.
4.2.6. DIGIPASS Authentication for Windows Logon
A client component record is required for DIGIPASS Authentication for Windows Logon for each user for each IP address they are using to log on to Windows. DIGIPASS Authentication for Windows Logon uses Dynamic Client
Registration to ensure that the correct client component record is available when required.
4.2.7. Dynamic Client Registration
Dynamic Client Registration must be enabled on the Windows Logon policy. It performs the following: n n checks to see if a client component already exists for the user at that IP address creates a client component if it does not exist
Refer to the DIGIPASS Authentication for Windows Logon Product Guide for further details on the functionality of and settings for Dynamic Client Registration.
4.2.8. IDENTIKEY Federation Server
An IDENTIKEY Federation Server client component record for IDENTIKEY Authentication Server is required when
IDENTIKEY Federation Server is used for authentication to different Web applications. IDENTIKEY Federation Server communicates with IDENTIKEY Authentication Server via the SEAL protocol. For more information about the functionalities of and settings for IDENTIKEY Federation Server, refer to the IDENTIKEY Federation Server Product Guide .
Note
If you register IDENTIKEY Federation Server as a client, IDENTIKEY Authentication Server will require you to upload a valid IDENTIKEY Federation Server license.
4.3. User Records
IDENTIKEY Authentication Server offers the following methods of registering users: n n
Creating users manually when required. User records are registered on IDENTIKEY Authentication Server under the Users tab of the server's Administration Web Interface (see
Procedure 4: Creating a user record manually
).
Import a user file which contains one or more user records through the User Import screen of the
IDENTIKEY Authentication Server Administration Web Interface. The user file should be a comma-separated variable ( csv ) text file, which can be uploaded to import users. For more information, refer to the
IDENTIKEY Appliance 3.11.12 - Administrator Guide
27
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration n n
IDENTIKEY Appliance Administrator Reference , Section "Importing Users". An example .csv
file is provided with the IDENTIKEY Appliance delivery package.
Configure Dynamic User Registration (DUR) as a policy setting in IDENTIKEY Authentication Server Administration Web Interface, under Policies > User. DUR allows registering users automatically at the first time they log on. For more information about DUR, refer to the IDENTIKEY Appliance Product Guide .
Configure LDAP synchronization with a directory server in the Configuration Tool (see
10. LDAP User Synchronization
.
Procedure 4: Creating a user record manually
1. In the IDENTIKEY Authentication Server Administration Web Interface, navigate to Users > Create .
2. Add a user ID (mandatory).
3. Select a domain (mandatory).
4. If required, enter data in the other fields - optional.
5. Click Create .
Image 7: Adding a Client Component in IDENTIKEY Authentication Server Administration Web Interface
IDENTIKEY Appliance 3.11.12 - Administrator Guide
28
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
4.4. DIGIPASS Records and Assignment
DIGIPASS records can only be imported into the IDENTIKEY Authentication Server from a .dpx
file issued by your supplier for your specific DIGIPASS authenticator or authenticators. The file can be uploaded in the IDENTIKEY
Authentication Server Administration Web Interface, under DIGIPASS > Import .
Image 8: Adding a Client Component in IDENTIKEY Authentication Server Administration Web Interface
DIGIPASS records can be assigned to user accounts in the IDENTIKEY Authentication Server Administration Web
Interface in three ways:
1. View an unassigned DIGIPASS or user record, click on ASSIGN and complete the ASSIGN wizard. The specific DIGIPASS authenticator for the record must be supplied to the user.
2. Auto-assignment - the user does not have a DIGIPASS authenticator assigned, and the applicable policy permits auto-assignment. An unassigned DIGIPASS record is searched for and automatically allocated to the user upon logging in for the first-time. The specific DIGIPASS authenticator for the record must be supplied to the user.
3. Self-assignment: the DIGIPASS authenticator is in the user's possession, and the applicable policy permits self-assignment. The user completes a self-assignment process.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
29
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
Image 9: DIGIPASS Assignment
For more information, please refer to the IDENTIKEY Appliance Product Guide.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
30
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
4.5. DIGIPASS Licensing and Activation
4.5.1. Standard Licensing and Activation
The standard licensing model applies to models of the DIGIPASS authenticatorthat are pre-provisioned ex factory, and software DIGIPASS using standard one-step activation.
The standard activation process involves generating an activation code and sending it to a software DIGIPASS separately or as part of the full activation data.
4.5.2. DIGIPASS Multi-Device Licensing and Activation
As of version 3.7, IDENTIKEY Authentication Server supports a new model for licensing and activating a
DIGIPASS authenticator: Multi-Device Licensing and Multi-Device Activation.
This new licensing and activation model applies to the following models of the DIGIPASS authenticator: n n
E-signature DIGIPASS: DIGIPASS 760
Software DIGIPASS: DIGIPASS for Mobile and DIGIPASS for APPS
Note
The new functionalities introduced in the context of Multi-Device Licensing, Multi-Device Activation, and the
Secure Channel feature are aimed at the banking security market only. This implies that certain of these functionalities will not be available for typical enterprise security deployments.
Warning
The Multi-Device Licensing and Multi-Device Activation functionality using the Secure Channel feature requires a
SOAP provisioning and / or SOAP signature license!
With the Multi-Device Licensing model and its one-to-one relationship between a user account and a DIGIPASS serial number license, a user account can optionally be bound to several DIGIPASS instances. Multi-Device Activation, which is an activation process in two steps, guarantees that only the intended end user can perform the device activation.
4.5.3. Multi-Device Licensing
With the Multi-Device Licensing model, each DIGIPASS serial number corresponds to a unique DIGIPASS license; consequently, for each DIGIPASS device compliant with the Multi-Device Licensing model, the corresponding
.dpx
file contains one DIGIPASS master activation application for each DIGIPASS license. These DIGIPASS instances are represented in IDENTIKEY Authentication Server as DIGIPASS with a single DIGIPASS master activation application.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
31
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
One DIGIPASS license allows to instantiate several DIGIPASS instances bound to the same DIGIPASS license.
DIGIPASS instances are not different from DIGIPASS activated in the standard process with regard to the representation of DIGIPASS applications. IDENTIKEY Authentication Server creates the DIGIPASS instance(s) for a particular license during the Multi-Device Activation process.
The number of instances that can be activated for each DIGIPASS license is limited to a predefined threshold which is configured by VASCO at the time of order. A maximum number of 99 instances can be configured, and each
DIGIPASS instance can have from 1 to 8 DIGIPASS authentication or e-signature application(s). These DIGIPASS instances are represented in IDENTIKEY Authentication Server as DIGIPASS with the same base serial number as the bound DIGIPASS license, appended with the instance sequence number.
4.5.4. Multi-Device Activation
In the Multi-Device Activation process, two separate activation messages are used for activating the device(s). This serves to guarantee that only the intended end user, and not an adversary who has intercepted one of the messages, can perform the activation. Multi-Device Activation is a different process from the standard software
DIGIPASS activation and requires DIGIPASS devices and .dpx
files compliant with the Multi-Device Licensing model.
When a compliant DIGIPASS device is activated, settings and secrets are written into the device.
4.5.4.1. Master activation applications and activation messages
The Multi-Device Activation process uses the master activation application which contains an individual master activation key for each DIGIPASS license. Every DIGIPASS license must be linked to a single user account. Two separate activation messages are used in the activation process; the first activation message (Activation Message 1) allows activating a DIGIPASS license in the device, the second activation message (Activation Message 2) allows activating a DIGIPASS instance of a license in the device.
Note
Both activation messages should be delivered to the end user via authentic channels. For instance, Activation
Message 1 should be delivered via a secure letter or e-mail and Activation Message 2 should be delivered via the online banking application.
Activation Message 1 may be used several times to allow activation of multiple DIGIPASS instances (of one
DIGIPASS license) on multiple DIGIPASS devices, if necessary. The validity period for Activation Message 1 is configurable in your IDENTIKEY Authentication Server policy. On the other hand, Activation Message 2 can be used for effective activation for one DIGIPASS instance only.
Note
Each DIGIPASS license will be used several times for activation of several DIGIPASS instances (in several DIGIPASS devices) for one user account; however, only one license will be consumed for the activation of the different
DIGIPASS instances for one user account.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
32
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration
4.5.4.2. DIGIPASS instance sequence number
With each activation of a new DIGIPASS instance, IDENTIKEY Authentication Server will generate new DIGIPASS applications. A sequence number will be incremented for each new DIGIPASS instance issued from the same license. The number of instances which can be issued from a license will be limited to a pre-defined threshold between 1 and 99 (configured by VASCO at the time of order). The different DIGIPASS instances of one user share the base serial number (the serial number of the DIGIPASS license), but will be appended with a unique sequence number for the DIGIPASS instance. The keys of the DIGIPASS instance applications will be different for each instance.
4.5.5. Secure Channel Feature
Secure Channel is an optional feature applicable to DIGIPASS devices compliant with the Multi-Device Activation process (in the context of Multi-Device Licensing). The optional use of the secure channel feature after activation of a DIGIPASS instance allows protecting the messages that are exchanged between the server- and the clientside.
Note
The secure channel will be usable only if the Secure Channel feature has been ordered from and configured by
VASCO at the time of order.
The Secure Channel feature applies a new protocol that uses payload keys to protect the confidentiality and authenticity of the message's payload. A single master payload key is shared among all DIGIPASS instances linked to a certain DIGIPASS license, enabling the end user to transparently use multiple DIGIPASS devices to answer the transaction request message.
The Secure Channel feature requires the mandatory provisioning of a payload key represented on the server-side by a payload key BLOB. In this case, first a payload key will have to be generated once for each DIGIPASS license.
The different DIGIPASS instances activated from one DIGIPASS license must share the same payload key. After the activation, the payload key will protect the request and deactivation messages for exchange between the server and the client devices that have been activated using a particular DIGIPASS license (for a particular user account).
The parameters used to generate the request body for Secure Channel messages can be configured via the Secure
Channel tab in the policy properties page of the Administration Web Interface.
If the Secure Channel feature has not been ordered, IDENTIKEY Authentication Server will not generate and provision any payload key.
4.5.5.1. Secure Channel-Based Authentication Process
For authentication transactions via the Secure Channel feature, IDENTIKEY Authentication Server generates a request message, based on the transaction details provided via the client application or a custom request body, and delivers it to the client application. The request message is generated by IDENTIKEY Authentication Server upon the
Get Secure Challenge
and
Get Signing Request
commands, and is bound to the
DIGIPASS authenticator selected for the relevant transaction. The client application then generates either a QR
IDENTIKEY Appliance 3.11.12 - Administrator Guide
33
4. IDENTIKEY Appliance Administration Web Interface Basic Configuration code or a CRONTO image, which represents this request message, and delivers it to the end user, who scans this image, using a DIGIPASS authenticator that is compliant with the Secure Channel feature. The
DIGIPASS authenticator generates a response for this request message which the end user enters into the client application; IDENTIKEY Authentication Server validates this response and returns the result to the client application which completes the signature authentication process.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
34
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
The User Dashboard of the IDENTIKEY Authentication Server Administration Web Interface allows you to easily manage, monitor, and troubleshoot DIGIPASS user accounts, with the Dashboard tab providing an overview of the most important user settings in one place. The information shown in this tab includes general user settings, a list of recent user and DIGIPASS activities, used clients, and assigned DIGIPASS authenticator for a selected user. To edit these settings or view full details, switch to the corresponding tabs in the Administration Web Interface. For more information, refer to
5.1. Working with the User Dashboard .
In addition, the User Dashboard facilitates user-specific report creation and provides easy access to audit messages for a single user or DIGIPASS activity record. For more information, refer to
5.1.7. Generating Reports via the
Dashboard Tab ,
5.3. Generating Reports via the Reports Tab , and
5.2. View Audit Message Page
.
5.1. Working with the User Dashboard
The Dashboard tab of the User Properties page in the Administration Web Interface provides an overview of the most important settings for the selected user such as user information, assigned DIGIPASS, used clients, and recent activity.
5.1.1. Account Overview
This section lists information about the user account: n n n n n
Last authentication
Account status
Expires
Static password
Administration privileges
To view all user account settings or to change settings, switch to the User Account tab of the User Properties page.
5.1.2. Policy Overrides
This section lists the policy override settings for the user: n n n n n
Local authentication
Back-end authentication
Offline authentication
Virtual DIGIPASS
Virtual signature
IDENTIKEY Appliance 3.11.12 - Administrator Guide
35
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
To change the policy override settings, switch to the Policy Overrides tab of the User Properties page.
5.1.3. User Info
This section contains general user information: n n n n n
User name
Phone
Mobile
Email address
Description
To view all user info settings or to change settings, switch to the User Account tab of the User Properties page.
5.1.4. Assigned DIGIPASS
This section contains information about the five last used DIGIPASS assigned to the selected user, and includes the following: n n n n n
Serial number
DIGIPASS type
Status
Active applications
Virtual DIGIPASS (VDP)
For a complete list of assigned DIGIPASS, switch to the Assigned DIGIPASS tab of the User Properties page.
5.1.5. Recent Activity
This section shows the most recent activity records for the user.
To view all recent activity records, switch to the Recent Activity tab of the User Properties page.
5.1.6. Used Clients
This section lists the five last client components used by the selected user, and includes the following:
Table 1: Dashboard Used Clients - Displayed Fields
Field
Time
Contents
The time at which the last activity for the relevant used client was recorded.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
36
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
Table 1: Dashboard Used Clients - Displayed Fields (continued)
Field Contents
Client Type States which type the used client is.
Policy ID
Click the client identifier to go to the Client Properties page for this client.
The policy related to the used client.
Click the policy ID to go to the Policy Properties page for this policy.
To view all recently used clients, switch to the Recent Activity tab of the User Properties page.
5.1.7. Generating Reports via the Dashboard Tab
The QUICK REPORT button in the User Dashboard of the selected user allows an administrator to quickly generate a user-specific report. By default, IDENTIKEY Authentication Server generates a Detailed Activity Summary report.
Once IDENTIKEY Authentication Server has successfully generated the report, the Administration Web Interface takes you to the Summary page of the Run Report wizard. Here you can open the generated report, or you can generate a new report with changed settings. To change the settings, navigate to the corresponding tab in the wizard.
For more information about generating user-specific reports via the Reports tab in the User Properties page, refer to
5.3. Generating Reports via the Reports Tab
.
5.1.8. Inspecting Recent User and DIGIPASS Activity
Depending on the global configuration settings and your administrative privileges, you can use the User Dashboard to view information about recent user and DIGIPASS activities, including authentication, signature, provisioning, and administration actions.
The list of recent activities contains detailed information for each record, such as a description of the action, the category it belongs to, the time it was audited, used client and DIGIPASS (in case of recent user activity), and the associated policy. Each record has an icon which indicates whether the action was successful, and provides additional troubleshooting information in case of failure.
To be able to view the list of recent user activities, you need the View Recent User Activity administrative privilege.
For the list of recent DIGIPASS activities, you need the View Recent DIGIPASS Activity administrative privilege.
Procedure 5: Inspecting recent user activity
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Do either of the following: n
To view a summary of the most recent user activities, switch to the USERS > Dashboard tab.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
37
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard n
To view the complete list of recent user activities, switch to the USERS > Recent Activity tab.
You can click on the DIGIPASS, client, or policy ID entry of each record to view the respective
DIGIPASS Properties , Client Properties , or Policy Properties page. If you have the View Audit
Information administrative privilege, you can also click on the audit message code to view the respective View Audit Message page(see
5.2. View Audit Message Page
).
Procedure 6: Inspecting recent DIGIPASS activity
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Switch to the DIGIPASS > Recent Activity tab.
You can click on the client or policy ID entry of each record to view the respective Client Properties or Policy
Properties page. If you have the View Audit Information administrative privilege, you can also click on the audit message code to view the respective View Audit Message page (see
5.2. View Audit Message Page
).
For a list of DIGIPASS operations and IDENTIKEY Authentication Server events included in recent user and DIGIPASS activities, refer to the IDENTIKEY Authentication Server Product Guide , Section "Recent User Activities" and "Recent
DIGIPASS Activities".
For more information about configuring the User Dashboard, see
5.4. Configuring the User Dashboard
.
5.2. View Audit Message Page
The View Audit Message page displays the details of a single audit message for the user or DIGIPASS recent activity on a single page and provides access to all relevant audit message fields. To view this page, the administrator must have the View Audit Information administration privilege; if this applies, they can access the View Audit Message page by selecting the relevant audit message code displayed in the Recent Activity page.
The number of displayed audit records for recent user or DIGIPASS activity can be restricted by time and number.
This means that audit records older than a certain time threshold are excluded from the result. Furthermore, only a total number of records are returned. The number of records displayed is limited on application level and can be configured via the Administration Web Interface configuration file, in the global server configuration. This means that the configured limits apply to all IDENTIKEY Authentication Server instances within a replicated environment.
When an administrator accesses audit records through the recent activity commands, this administration action is recorded; all enabled auditing methods are used for this.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
38
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
5.3. Generating Reports via the Reports Tab
The Reports tab of the User Properties page provides a list of reports that can be run via this tab. This list is a subset of the global list of reports in IDENTIKEY Authentication Server where the selected user's identifying information has been automatically entered into the run-time query definition. For a complete list of reports that are by default available in this tab, refer to the IDENTIKEY Appliance Administrator Reference , Section "Administration Web Interface Field Listings".
The relevant report sub-set can be retrieved from the global report set by filtering the reports according to different sets of definition criteria:
Table 2: Report Definition Criteria
Group Level
User
DIGIPASS
Possible Report Type n n n
List Analysis
Detailed Analysis
Distribution Analysis
Data Source
Organizational Unit
Organizational Unit n
List Analysis
Users + audit
DIGIPASS + audit
Using these criteria to create a customized report allows you to also include this report in the results list.
5.3.1. Running a Report
The IDENTIKEY Authentication Server Administration Web Interface offers the following options in the Reports tab for running selected reports: n n
Clicking RUN starts the Run Report wizard for the selected report and takes the administrator to step 2 of the wizard, Report Settings . Also, the default values are pre-filled and the custom query for the specific user is added. The time zone is by default that of the Administration Web Interface client, and the valid period is six months.
Clicking RUN WITH DEFAULTS starts the generation of the selected report immediately. The report is generated for the selected user with the default values applied. This is the default option for this feature.
5.4. Configuring the User Dashboard
You can configure the User Dashboard by restricting the available views and returned data result sets.
Restricting the available view means that certain tabs of the User Dashboard can be hidden using administrative privileges . Different help desk administrators may have different privileges to view only recent user or recent
DIGIPASS activity, or both.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
39
5. IDENTIKEY Appliance Administration Web Interface: User Dashboard
The number of recent user and DIGIPASS activity records displayed can be restricted by time and number. This means that activity records older than a certain time threshold are excluded from the result. Furthermore, only a total number of records are returned.
Procedure 7: Configuring the recent activity settings
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Switch to SERVERS > Global Configuration tab.
3. Configure the recent activity settings via the Auditing tab.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
40
6. System Administrator Accounts
6. System Administrator Accounts
A new administrator account is created after running the IDENTIKEY Authentication Server Setup Wizard (see
IDENTIKEY Appliance Installation and Maintenance Guide ).
6.1. Disabling the Default
sysadmin
User Account
VASCO recommends to disable the built-in sysadmin account after the new administrator account has been created. The new administrator account can then be used to log in to the IDENTIKEY Appliance Configuration Tool and
Administration Web Interface.
Procedure 8: Disabling the default
sysadmin
user account
1. Log on to the Configuration Tool with the new system administrator user account (see
2.3. Logging On to
IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ).
2. Navigate to Settings > Authentication .
3. To disable the sysadmin user account, clear Enabled .
Select Enabled again to enable the sysadmin user account. When enabling the sysadmin user account you will be prompted to type and confirm a new password.
Image 10: Disabling the User Account sysadmin
IDENTIKEY Appliance 3.11.12 - Administrator Guide
41
6. System Administrator Accounts
6.2. Creating Additional Administrator Accounts
Further administrator accounts may be required. Typically, administrator accounts are created in the master domain; the administrative privileges of such accounts apply throughout all domains if they also have the access data in the administrative privileges for all relevant domains. It is also possible to create an administrator account for a specific domain only. The administrative privileges of such accounts will only apply to the domain in which they are created.
Procedure 9: Creating an administrator account
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Users > Create .
3. Type a user ID for the administrator.
4. Type the name of the master domain.
5. Type a static password twice to prevent typing errors.
6. Click Create .
7. Select Click here to manage .
8. Switch to the Admin Privileges page.
9. Click Edit .
10. Assign the necessary user and DIGIPASS administrative privileges by selecting the respective privilege name.
To access the Configuration Tool, assign the Appliance Administration privilege. Note that this is the only privilege required to access the Configuration Tool, all other privileges are used to configure access to
IDENTIKEY Authentication Server.
11. Click Save .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
42
6. System Administrator Accounts
Image 11: Creating User Account (1) – Completing User Details
IDENTIKEY Appliance 3.11.12 - Administrator Guide
43
6. System Administrator Accounts
Image 12: Creating User Account (2) – Editing Administration Privileges
IDENTIKEY Appliance 3.11.12 - Administrator Guide
44
7. Typical DIGIPASS Authentication Module Setup
7. Typical DIGIPASS Authentication Module Setup
In this section, we explain how to configure a typical DIGIPASS Authentication Module (DAM) setup - the following
DAM are supported: n n n n n n n n
Citrix Web Interface (DIGIPASS Authentication for Citrix Web Interface)
Outlook Web Access (DIGIPASS Authentication for OWA Basic and DIGIPASS Authentication for OWA Forms)
IIS6 Module (DIGIPASS Authentication for IIS Basic)
Windows Remote Desktop Web (DIGIPASS Authentication for Remote Desktop Web Access)
SBR Plug-In (DIGIPASS Authentication for Steel-Belted RADIUS Server)
Citrix Storefront (DIGIPASS Authentication for Citrix StoreFront)
Microsoft ADFS (DIGIPASS Authentication for Microsoft ADFS)
Epic Hyperspace (DIGIPASS Authentication for Epic Hyperspace)
Before installing the DAM with IDENTIKEY Appliance, you must have: n n
An instance of IDENTIKEY Appliance, which has already been installed (refer to the IDENTIKEY Appliance
Installation and Maintenance Guide ).
Module software on the Citrix, OWA, IIS, or SBR server, which is available in the IDENTIKEY Appliance delivery package.
Installing a DAM with IDENTIKEY Appliance requires the following steps: n n n
Acquire a module license
Create a Client Component in the IDENTIKEY Authentication Server Administration Web Interface
Install the module on the Citrix , OWA, IIS, or SBR Server.
Note
The IDENTIKEY Appliance Authentication service must be enabled before a DIGIPASS Authentication Module setup is configured. For more information about enabling the Authentication service / scenario, see Chapter
3.
Manual Settings in the Configuration Tool
.
7.1. Create a Client Component
An Administration Program Client Component must be created in IDENTIKEY Authentication Server to allow a module client to create a Client Component in IDENTIKEY Appliance.
Procedure 10: Creating a Client Component: DIGIPASS Authentication Module
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
45
7. Typical DIGIPASS Authentication Module Setup
2. Navigate to Clients > Register to create a new Client Component.
Image 13: Registering Clients in the IDENTIKEY Authentication Server Administration Web Interface
3. Enter the required data: n
Client Type: Select Administration Program n n n n
Location: Enter the IP address of the server where the module is installed.
Policy ID: Select the policy you want to use for this client.
Protocol ID: Select SEAL .
Shared Secret: Enter the shared secret used by the client.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
46
4. Click CREATE .
7. Typical DIGIPASS Authentication Module Setup
Image 14: Create a New Administration Program Client in the IDENTIKEY Authentication Server Administration Web Interface
Tip
This temporary administration program Client Component can be deleted after the IIS module client has created a Client Component on the IDENTIKEY Authentication Server Administration Web Interface.
7.1.1. Installing a DIGIPASS Authentication Module
For detailed installation instructions of the DIGIPASS Authentication Module refer to the installation sections of the relevant DIGIPASS Authentication Module Administrator Guide. The module software and the relevant guides are provided in the IDENTIKEY Appliance delivery package.
In the Installation Wizard, enter the values in the relevant fields as specified in
Table 3: Field Values for Installation ,
and upload the client license key for the relevant module.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
47
7. Typical DIGIPASS Authentication Module Setup
Table 3: Field Values for Installation
Field Name
Authentication Server IP Address
Port
Select the option to create the component record Automatically , and enter user credentials for an administrative user
Value
IP address of your instance of IDENTIKEY Appliance.
Retain the default setting.
Default settings: the administrator user credentials that were provided during processing of the IDENTIKEY Authentication Server Setup Wizard.
During installation a valid Client Component is created for module authentication, with a valid policy. Remove the temporarily created Client Component in the IDENTIKEY Authentication Server Administration Web Interface.
Procedure 11: Deleting the temporarily created Client Component
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > List .
3. Select the check box for Client Component type Administration Program with the SEAL protocol.
4. Click DELETE .
7.1.2. Policies and Settings
During installation a new Client Component is created, for which the policy can be modified.
For more information on the possible policy settings, refer to the section on policies in the IDENTIKEY Appliance
Product Guide .
Warning back-end authentication is always needed because of the nature of module setup. Please see the IDENTIKEY
Appliance Product Guide for more information.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
48
8. Typical RADIUS Setup
8. Typical RADIUS Setup
IDENTIKEY Appliance can be used in a RADIUS environment in a number of ways; in the following sections, the configuration of a typical RADIUS setup is explained.
Image 15: Stand-Alone IDENTIKEY Appliance in a RADIUS Environment
In the illustrated example, a RADIUS client is configured for DIGIPASS authentication only towards IDENTIKEY Appliance. A RADIUS client can be one of the following: n n n n
Dial-up Network Access Server (NAS)
Firewall or VPN appliance
Wireless Access Point
Any another device which uses the RADIUS protocol for user authentication.
Note
The IDENTIKEY Appliance Authentication service must be enabled before a RADIUS setup is configured. For more information about enabling the Authentication service/scenario, see
3. Manual Settings in the Configuration
Tool .
8.1. RADIUS Client Configuration
Configure your RADIUS client to send requests to the IDENTIKEY Appliance IP address, using the default RADIUS port: n n for authentication requests, the default RADIUS port is UDP 1812 for accounting requests, the default RADIUS port is UDP 1813
Tip
The port can be changed on IDENTIKEY Appliance, if necessary: navigate to IDENTIKEY Authentication Server >
RADIUS Communicator.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
49
Procedure 12: Creating a Client Component: RADIUS client
1. Log in to the IDENTIKEY Authentication Server Administration Web Interface.
2. Navigate to Clients > Register to create a new Client Component.
8. Typical RADIUS Setup
Image 16: Registering Clients in the IDENTIKEY Authentication ServerAdministration Web Interface
3. Enter the required data: n
Client Type: Select RADIUS Client n n n
Location: Enter the IP address of this RADIUS client
Policy ID: Select the policy you want to use for this client
Protocol ID:Select RADIUS n
Shared Secret: Enter the shared secret used by this client
IDENTIKEY Appliance 3.11.12 - Administrator Guide
50
4. Click CREATE .
8. Typical RADIUS Setup
Image 17: Create a New RADIUS Client in the IDENTIKEY Authentication Server Administration Web Interface
8.1.1. Optionally Modifying Policies and Settings using the Administration Web Interface
The example illustrated above configures DIGIPASS authentication only in the assigned policy. Other authentication settings (e.g. local or back-end authentication) and authentication options (e.g. grace period, assignment methods) can also be configured. For more information on the possible policy settings, refer to the Policies section of the IDENTIKEY Appliance Product Guide . For a list and explanation of the pre-loaded default policies, refer to the
IDENTIKEY Appliance Administrator Reference .
Different policy options are also explained with examples of practical setups using a RADIUS simulator client in Section
19. Test Policy Settings .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
51
9. DIGIPASS Authentication for Windows Logon
9. DIGIPASS Authentication for Windows Logon
This section explains how to setup DIGIPASS Authentication for Windows Logon (Windows Logon), which requires the following steps: n n
Configuration of IDENTIKEY Appliance: authentication attempts from Windows Logon clients are only allowed if a Client Component exists on IDENTIKEY Appliance. If the Dynamic Client Component feature is used, only one default Client Component is required for all Windows Logon clients in the network. Windows Group Check, however, can restrict automatic creation of a copy of the Client Component to predefined groups.
installation and configuration of the DIGIPASS Authentication for Windows Logon software on the Windows clients.
It is possible to optionally configure an _SRV record in the network's DNS server, thus providing automatic detection of the available instances of IDENTIKEY Appliance and fail-over functionality to the Windows Logon clients in
the network. This optional configuration is explained in Chapter 18. IDENTIKEY Authentication Server Discovery
.
For an introduction to DIGIPASS Authentication for Windows Logon with IDENTIKEY Appliance, refer to the
IDENTIKEY Appliance Product Guide . For more detailed information on DIGIPASS Authentication for Windows Logon, refer to the DIGIPASS Authentication for Windows Logon Guides provided on the IDENTIKEY Appliance delivery package.
Note
The IDENTIKEY Appliance Authentication service must be enabled before a Windows Logon setup is configured.
For more information about enabling the authentication service/scenario, see
3. Manual Settings in the Configuration Tool .
9.1. IDENTIKEY Appliance Configuration
9.1.1. DNS Setup
Client components for Windows Logon are created with DNS names in the Location field (refer to the section on
Windows Logon in IDENTIKEY Appliance Product Guide for more information). Since authentication attempts are received from IP addresses, IDENTIKEY Appliance needs to resolve the IP addresses to DNS names to identify the correct Client Components. This IP-to-name information needs to be present in the DNS server , configured in the
IDENTIKEY Appliance Configuration Tool, under Settings > Network.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
52
9. DIGIPASS Authentication for Windows Logon
Image 18: Configuration of IP-to-Name Resolving in the IDENTIKEY Appliance Configuration Tool
Tip
The required IP-to-name information is already available if a reverse DNS zone is present in the DNS server of an
Active Directory setup. In such a setup, VASCO recommends configuring the IP address of the DNS server as the
IDENTIKEY Appliance DNS server. Refer to the relevant Microsoft documentation for more information on configuring a DNS server and reverse zones.
9.1.2. Configuration of Microsoft Active Directory Back-End Authentication
An LDAP Active Directory back-end authentication record is required by IDENTIKEY Appliance for this setup. Refer to the IDENTIKEY Appliance Product Guide for more information.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
53
9. DIGIPASS Authentication for Windows Logon
For more information about activating Active Directory back-end authentication and creating back-end server records, see
11. Back-End Authentication
. Steps for adjusting a policy and creating a client component are not required; these aspects are explained in the following sections.
Procedure 13: Changing the default Client Component
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > List .
Image 19: Selecting Clients in the IDENTIKEY Authentication Server Administration Web Interface
3. Select the IDENTIKEY Windows Logon Client check box and click CHANGE POLICY .
4. From the Policy ID list menu, select either Windows Logon Online Authentication - LDAP AD Back-end or
IDENTIKEY Appliance 3.11.12 - Administrator Guide
54
9. DIGIPASS Authentication for Windows Logon
Windows Logon Online and Offline Auth - LDAP AD Back-end policy , as required.
5. Click OK .
Image 20: Create a New RADIUS Client in the IDENTIKEY Authentication ServerAdministration Web Interface
For more information on offline authentication, refer to the IDENTIKEY Appliance Product Guide .
9.2. Configuration of Windows Group Check in the Administration Web Interface
Procedure 14: Restricting Dynamic Component Registration with Windows Group Check
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .Administration Web Interface.
2. Open the Policies tab, and select the relevant policy, e.g.
Windows Logon Online Authentication -
LDAP AD Back-end .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
55
9. DIGIPASS Authentication for Windows Logon
Image 21: Restricting Dynamic Component Registration with Windows Group Check - Select Policy
IDENTIKEY Appliance 3.11.12 - Administrator Guide
56
3. Open the DCR tab and click Edit .
9. DIGIPASS Authentication for Windows Logon
Image 22: Restricting Dynamic Component Registration with Windows Group Check - Editing the Settings
4. Select Yes to enable dynamic component registrations.
5. Select Accept requests for clients listed in groups .
6. Click ADD NEW to add Windows groups available . With this, available windows groups will be listed.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
57
9. DIGIPASS Authentication for Windows Logon
Image 23: Restricting Dynamic Component Registration with Windows Group Check - Editing DCR
For more information on the relevant fields, refer to the IDENTIKEY Appliance Administrator Reference or the
IDENTIKEY Authentication Server Administration Web Interface Online Help . For more information on the Windows
Group Check in general, refer to the IDENTIKEY Appliance Product Guide .
9.3. Password Randomization
Windows Logon can be configured to provide password randomization. Password randomization replaces the static password used to authenticate the Windows client to the Windows domain with a random password, thereby always forcing the user to use DIGIPASS OTP authentication.
After a successful authentication towards IDENTIKEY Appliance, the static password is changed to a randomized password in the Microsoft Active Directory infrastructure. Randomized passwords have strict formatting rules, and
IDENTIKEY Appliance 3.11.12 - Administrator Guide
58
9. DIGIPASS Authentication for Windows Logon only the length of the password can be set. For more information on password randomization, refer to the
IDENTIKEY Appliance Product Guide .
Procedure 15: Enabling randomized passwords for Windows Logon and setting the password length
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Policies and select the relevant policy, e.g.
Windows Logon Online Authentication -
LDAP AD Back-end .
3. Open the Password Randomization tab.
4. Select Yes from the Enabled list menu.
5. Enter the value for the password length in the Back-End Password Length field.
Image 24: Configuring Password Randomization
Note
If the Password Randomization feature of IDENTIKEY Authentication Server is used, the policy used in
IDENTIKEY Authentication Server must not apply password proxying for the
changeBackendPassword
SOAP command because this would lead to a user with a randomized password being able to
IDENTIKEY Appliance 3.11.12 - Administrator Guide
59
9. DIGIPASS Authentication for Windows Logon change their password.
9.4. Export Server Certificate (Optional)
If Windows Logon is configured to verify the server certificate, the certificate must be registered in the certificate store on the client workstation. This requires the certificate to be exported using the IDENTIKEY
Appliance Configuration Tool and imported to the client workstations.
For information about exporting server certificates using the IDENTIKEY Appliance Configuration Tool, refer to
13. Secure Sockets Layer (SSL)
.
The server certificate can be imported in two ways: n n
Locally on each client workstation using the Microsoft Management Console (MMC). This is only practical for small installations.
Using a group policy, which is recommended for larger installations.
For more information, refer to the guides listed in the following section.
9.5. Client Installation and Configuration
For information on installation and configuration of the client software, refer to the following guides provided as part of the delivery package of your IDENTIKEY Appliance: n n n n
DIGIPASS Windows Logon Product Guide , which explains concepts related to Windows Logon
DIGIPASS Windows Logon Installation Guide , which provides instructions for installation
DIGIPASS Windows Logon User Manual , which provides some conceptual information and also client configuration instructions
DIGIPASS Windows Logon Getting Started Guide , which provides quick guidelines on how to configure Windows Logon.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
60
10. LDAP User Synchronization
10. LDAP User Synchronization
10.1. Overview
LDAP user synchronization is the process of synchronizing records from an LDAP Server, not the process of authenticating with an LDAP back-end server.
Replication is the process of replicating data between separate instances of IDENTIKEY Appliance (see
12. Replication
).
LDAP user synchronization can be configured in the Configuration Tool and supports automatic creation and updating of user accounts on the IDENTIKEY Appliance from records stored on an LDAP server. Other methods of creating user accounts using the Administration Web Interface include creating user accounts manually, importing user accounts, and Dynamic User Registration(refer to the section on DIGIPASS user accounts in the IDENTIKEY Appliance Product Guide for further information).
LDAP user synchronization is the process of synchronizing records from an LDAP Server, not the process of authenticating with an LDAP back-end server. For information about LDAP back-end authentication, see
11. Back-End
Authentication
.
LDAP user synchronization is not server-specific and must be configured particularly for different LDAP servers, e.g.
for Microsoft Active Directory 2008 or for NetIQ eDirectory. To set up an LDAP synchronization requires manual configuration of a synchronization profile in the Configuration Tool. Once the appropriate settings and mappings have been configured, synchronization between the LDAP server and the IDENTIKEY Appliance is carried out automatically.
Accessing and logging onto the IDENTIKEY Appliance Configuration Tool is explained in
2. Administration Interfaces for IDENTIKEY Appliance .
In the following sections, we explain: n n n n
How to create a synchronization profile in IDENTIKEY Appliance
How to configure synchronization for Microsoft Active Directory, with: n
Example filter settings n n
Example attribute settings, and
Instructions on how to find LDAP server attribute names with Active Directory
How to configure synchronization for NetIQ eDirectory, with: n
Example filter settings n n
Example attribute settings, and
Instructions on how to find LDAP server attribute names with NetIQ eDirectory
How to configure synchronization for other LDAP servers.
For more information about of the concepts of LDAP synchronization, refer to the IDENTIKEY Appliance Product
Guide , Section "LDAP Synchronization".
Note
1. User account settings are called Source Attributes in the LDAP server and destination properties in the
IDENTIKEY Appliance 3.11.12 - Administrator Guide
61
10. LDAP User Synchronization
IDENTIKEY Appliance.
2. Authentication with LDAP server credentials for user accounts which have been synchronized requires a back-end server record to be configured. Back-end passwords are not usually synchronized due to LDAP server security restrictions. For further information, refer to the LDAP Synchronization section in the
IDENTIKEY Appliance Product Guide . For more information about configuring a back-end server record, see
11. Back-End Authentication
.
Tip
For more information about specific issues which may arise with LDAP user synchronization, see
24.7. LDAP User
Synchronization Issues
.
10.2. LDAP Synchronization Profiles
LDAP user synchronization and the synchronization profiles are set up in the Configuration Tool. For more information about synchronization profiles, refer to IDENTIKEY Appliance Product Guide .
Procedure 16: Creating an LDAP synchronization profile
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > LDAP User Synchronization .
Image 25: Creating LDAP Synchronization Profiles in the Configuration Tool
IDENTIKEY Appliance 3.11.12 - Administrator Guide
62
10. LDAP User Synchronization
3. Click Add to open a screen for configuring an LDAP synchronization profile:
Image 26: Configuring the LDAP Synchronization Profile
4. Configure the fields (example settings are also shown in the image below). There are four types of settings: n n
Server settings provide details of the source LDAP server .
User management, search base, and filter settings define the location, depth, and accounts to be n synchronized from the source directory.
Attribute mapping synchronizes specific properties in IDENTIKEY Appliance to values from LDAP n source parameters. Destination properties can be defined as a constant or the value of a specified source parameter. If nothing is specified, a default value is used.
Hierarchy mappings (Create missing OU's, Mirror OU structure, Include LDAP Children, and Return
DIGIPASS to Parent OU on Move/Delete ) define whether the destination structure mirrors the source structure and whether existing accounts should be updated (see Example below).
5. Click Save to finish.
For more information on the concepts of LDAP user synchronization in general, refer to the section on LDAP user synchronization in the IDENTIKEY Appliance Product Guide ; for more information on theLDAP user synchronization settings, refer to the Configuration Tool: Field Listings section in the IDENTIKEY Appliance Administrator Reference .
Example
These examples match Profiles 1 and 3 in the IDENTIKEY Appliance Product Guide , Managing Source and Destination Hierarchies section.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
63
10. LDAP User Synchronization
Example Profile 1: The LDAP source hierarchy has users in organizational units below the search base domain.
The Mirror OU Structure and Create Missing OU'soptions are not selected, although the option to synchronize all user accounts at and below the search base is configured. Users are all synchronized to the single (flat name) destination address in the IDENTIKEY Appliance hierarchy. No sub-organizational units are created.
Example Profile 3: The LDAP source hierarchy has users in organizational units below the search base domain.
The Mirror OU Structure and Create Missing OU's options to synchronize all user accounts at and below the search base are selected. The structure of the LDAP server is replicated in IDENTIKEY Appliance.
Tip
The Enable box must be checked for the synchronization profile to become operational.
Note
1. At least one attribute must always be mapped to the IDENTIKEY Appliance user ID property.
2. Some IDENTIKEY Appliance user properties cannot be retrieved from an LDAP server, e.g. local authentication, back-end authentication, and password. These properties can only be synchronized to a constant value. The Type constant needs to be selected for the attribute mapping entry and the value inserted in the Source/Attribute Value column. If the values are omitted, default values are used. For possible and default values of these properties, refer to the IDENTIKEY Appliance Administrator Reference ,
User Properties section.
3. Only one mapping can be configured for each IDENTIKEY Appliance user property.
10.3. Microsoft Active Directory Synchronization
For Microsoft Active Directory (tested with versions 2003 and 2008), the filter entries in the table (and image) below retrieve all users from the search base, without retrieving other objects such as groups, contacts, or computers etc.
Table 4: Microsoft Active Directory 2003/2008 Filter Settings
Microsoft Active Directory 2003/2008 Attribute
Value sAMAccountName givenName objectClass
*
* person
Example mappings of commonly used Microsoft Active Directory 2003/2008 attributes to their IDENTIKEY Appliance properties are shown in
Image 27: Example Filter and Attribute Mappings for Microsoft Active Directory 2003/2008
:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
64
10. LDAP User Synchronization
Image 27: Example Filter and Attribute Mappings for Microsoft Active Directory 2003/2008
10.3.1. Finding Attribute Names
The previous examples can also be adapted to your organization's needs, for example if a more refined filter is required or if other LDAP server attribute values need to be synchronized to a certain IDENTIKEY Appliance user property.
To add filter or mapping entries, you need to know the attribute name in Active Directory.
Note
The method for finding Attribute names explained here may not apply to your particular version of Active Directory. If this is the case, refer to the Help files or product documentation for your Active Directory (see also section
10.5. Other LDAP Server Synchronizations
).
Procedure 17: Viewing user account attributes on your Microsoft Active Directory
1. Log on to Microsoft Active Directory.
2. Run the
adsiedit.msc
program.
3. Navigate to a source user account .
4. Right-click on the user account in the left window and select Properties .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
65
10. LDAP User Synchronization
Image 28: Properties of an Example Object in Microsoft Active Directory
For an alternative method of finding LDAP server attribute names, see
10.5. Other LDAP Server Synchronizations
.
10.4. NetIQ eDirectory Synchronization
10.4.1. Example Filtering and Mapping
For NetIQ eDirectory (tested with version 8.8 SP2), the filter entry in the table (and image) below retrieves all users from the search base.
Table 5: NetIQ eDirectory Filter Settings
NetIQ eDirectory Attribute
Value objectClass person
Example mappings of commonly used NetIQ eDirectory attributes to their IDENTIKEY Appliance properties are shown in the image below.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
66
10. LDAP User Synchronization
Image 29: Example Filter and Attribute Mappings for NetIQ eDirectory
10.4.2. Finding Attribute Names
The previous examples can also be adapted to your organization's needs, for example if a more refined filter is required or if other LDAP server attribute values need to be synchronized to a certain IDENTIKEY Appliance user property.
To add filter or mapping entries, you need to know the attribute name in NetIQ eDirectory which can be found in the NetIQ eDirectory product documentation.
10.5. Other LDAP Server Synchronizations
To create a synchronization profile for your LDAP server, you will need to know the names of the LDAP attributes used to identify users. Two methods for finding attribute names are: n
Viewing the attribute list for a specific user account using an LDAP search tool (e.g. ldapsearch from
OpenLDAP.org) or an LDAP browser. This method has the disadvantage that some attributes may not be
IDENTIKEY Appliance 3.11.12 - Administrator Guide
67
10. LDAP User Synchronization n listed for the specific user account viewed, if they are not mandatory for all user accounts.
Viewing the LDAP schema from the LDAP server. This may be available in the LDAP server documentation or can be retrieved as explained in the example below.
Example
Retrieving an LDAP schema with a command line LDAP search tool
1. Retrieve the location of the schema object in the LDAP server. For this LDAP request, the search base should be the root DN of your LDAP server, the scope should be set to
base
, and the requested attribute should be the word
subschemaSubentry
. e.g. using ldapsearch:
ldapsearch -H ldap://ldapserver -b dc=example,dc=com -s base subschemaSubentry
2. Send an LDAP request with the resulting value for
subschemaSubentry
acquired in Step 1 as search base, the scope again set to
base
, and the requested attribute to
objectClasses
. e.g. using ldapsearch:
ldapsearch - H ldap://ldapserver - b cn=Subschema - s base objectClasses
3. In the LDAP schema, look for the attributes of the relevant object class, which is likely to be person
, organizationalPerson
, inetOrgPerson
, or user
.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
68
11. Back-End Authentication
11. Back-End Authentication
back-end authentication is a term used to describe the process of checking user credentials with another system.
In this section, we explain standard back-end authentication set-ups with: n n n n
RADIUS
NetIQ eDirectory
Microsoft Active Directory
IBM Security Directory Server
Note
SSL is available for Active Directory and IBM Security Directory Server back-end authentication.
Image 30: IDENTIKEY Appliance as Intermediate Server for OTP only
Procedure 18: Configuring back-end authentication
1. Enable back-end authentication in the IDENTIKEY Appliance Configuration Tool.
2. Create a back-end record in the IDENTIKEY Authentication Server Administration Web Interface.
3. Edit a policy for back-end authentication in the IDENTIKEY Authentication Server Administration Web Interface.
4. Create a client component and assign the policy to it in the IDENTIKEY Authentication Server Administration Web Interface.
For more information about back-end authentication, refer to the IDENTIKEY Appliance Product Guide , Section
Back-End Authentication.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
69
11. Back-End Authentication
11.1. RADIUS Back-End Authentication
Procedure 19: Enabling RADIUS back-end authentication
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > Authentication Back-Ends .
Image 31: Authentication Back-Ends
3. Select Enabled for the RADIUS back end.
4. Click SAVE .
Procedure 20: Adding a RADIUS back-end server record
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Open the Back-End tab and select Register RADIUS Back-End .
3. Complete the necessary fields, and note the following points for the relevant fields: n n n
1812
is the default Authentication Port , but you need to use the port that was selected for your installation.
Entries in the Accounting IP Address and Accounting Port fields are only necessary when accounting is required.
1813
is the default accounting port , but you need to use the port that was selected for your installation.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
70
11. Back-End Authentication n n n
Enter the IP address of the back-end RADIUS server in the Authentication IP Address and Account
IP Address fields.
Enter the shared secret used by the back-end RADIUS server in the Shared Secret and Confirm
Shared Secret fields.
Entering a value in the Timeout field is mandatory.
4. Click CREATE to finish.
Procedure 21: Adjusting authentication policy settings
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Policies > List - here, all available policies are listed.
3. Select the policy to be used and click Edit .
4. For local authentication, select Digipass only (local authentication is always used with a
DIGIPASS authenticator).
5. For back-end authentication, select Always (back-end authentication is always used).
6. For Back-End Protocol select RADIUS .
7. Click SAVE to finish.
Image 32: Editing RADIUS Back-End Policy
The example illustrated above configures DIGIPASSonly authentication with RADIUS back-end authentication in the assigned policy. Other authentication settings and authentication options (e.g. grace period, assignment methods) can also be configured.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
71
11. Back-End Authentication
For more information on the possible policy settings, refer to the Policies section of the IDENTIKEY ApplianceProduct Guide , which is also available via the Help button in the Configuration Tool. For a list and explanation of the pre-loaded default policies, refer to the IDENTIKEY ApplianceAdministrator ReferenceReference .
Different policy options are also explained with examples of practical setups using a RADIUS simulator client in Section
19. Test Policy Settings
.
Procedure 22: Creating a client record and assign the policy
1. To create a client record in the IDENTIKEY Authentication Server Administration Web Interface, follow the instructions provided in
4.1. Client Component Records .
2. Assign the policy for which you have adjusted the back-end authentication settings (as instructed above) in the Policy ID field.
11.2. NetIQ eDirectory Back-End Authentication
Procedure 23: Enabling NetIQ eDirectory back-end authentication
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
). Navigate to
Authentication Server > Authentication Back-Ends (see
Image 31: Authentication Back-Ends
).
2. Select Enabled for the NetIQ eDirectory back end.
3. Click SAVE .
Procedure 24: Adding a NetIQ eDirectory back-end server record
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Open the Back-End tab and select Register eDirectory Back-End .
3. Complete the necessary fields, and note that the Timeout field is mandatory.
4. Click CREATE to finish.
Warning
Within NetIQ eDirectory, different password verification mechanisms exist for different services requested.
IDENTIKEY Appliance uses SASL Digest-MD5 LDAP authentication, which is only supported using the simple password mechanism. Successful authentication with eDirectory therefore requires one of two options:
1. Configuring the simple password manually for each user account within eDirectory.
2. Enabling Universal Passwords, to automatically synchronize all password mechanisms within eDirectory. For information on how to configure Universal Passwords, refer to your NetIQ eDirectory product documentation.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
72
11. Back-End Authentication
Image 33: Manual Configuration of the Simple Password
To adjust the authentication policy settings, follow the instructions provided under
Procedure 21: Adjusting authentication policy settings
for adjusting policy settings to configure back-end authentication, using NetIQ eDirectory instead of RADIUS for the back-end protocol field.
To create a client record and assign the policy, follow the instructions under
Procedure 22: Creating a client record and assign the policy
for creating a client record and assigning a policy for NetIQ eDirectory back-end authentication.
11.3. Microsoft Active Directory Back-End Authentication
With Microsoft Active Directory you have two different options: n n
If only a single domain controller with one domain is in use, the back-end server record can be registered on IDENTIKEY Appliance. This record will be used to retrieve the back-end server during user authentications. For more information, see Section
11.3.2. Single Domain with Single Domain Controller .
If multiple domains and / or multiple domain controllers are in use, back-end server records can be searched for using the global catalog server. This requires the global catalog server settings to be configured in IDENTIKEY Appliance. For more information, see
11.3.3. Multiple Domains: Global Catalog Server
Setup .
For more information about the concepts of both setups, refer to the IDENTIKEY Appliance Product Guide .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
73
11. Back-End Authentication
11.3.1. Enable Microsoft Active Directory Back-End Authentication
When the Active Directory back end is to be authenticated via the LDAP protocol, the LDAP back end needs to be configured. After setting up SSL on the LDAP back end, export a certification authority (CA) certificate:
Procedure 25: Exporting a CA certificate
1. Launch the Windows Certification Authority application. This is typically launched via Start > Administrative Tools > Certification Authority on most Windows servers.
2. Select a certification authority, right-click it, and select Properties .
3. In the Properties window, click the View Certificate button.
4. In the Certificate window, select the Details tab and click the Copy to File button. Doing so will launch the
Certificate Export Wizard.
5. In the Certificate Export Wizard, click Next .
6. Select
Base-64 encoded X.509
and click Next .
7. Specify the path and name of the CA Certificate file and click Next .
8. Click Finish to export the certificate.
After exporting the certificate, you will need to enable Microsoft Active Directory back-end authentication and upload the exported certificate.
Procedure 26: Enabling Microsoft Active Directory back-end authentication
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > Authentication Back-Ends (see
Image 31: Authentication Back-Ends ).
3. Select Enabled for the Microsoft Active Directory back end.
4. From the AD SSL Certificate list in the Microsoft Active Directory section, select a certificate authority certificate. This AD SSL Certificate list contains all valid and trusted CA certificates that were imported using the Certificate Management tab.
5. Click SAVE .
11.3.2. Single Domain with Single Domain Controller
A single domain controller setup requires: n n n n n
Activate Microsoft back-end authentication in the Configuration Tool.
Configure the DNS server in the Configuration Tool.
Add a Microsoft Active Directory back-end server record in the IDENTIKEY Authentication Server-
Administration Web Interface.
Adjust the authentication policy settings in the IDENTIKEY Authentication ServerAdministration Web Interface.
Configure a client record and assign the policy in the IDENTIKEY Authentication ServerAdministration Web
Interface.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
74
11. Back-End Authentication
Warning
Although not mandatory, VASCO recommends using the AD domain controller as the DNS server to avoid issues with Microsoft SPN implementation. For more information about aspects requiring attention when configuring this setup, see Section
24.8. LDAP Back-End Authentication Setup Issues .
Additional configuration is needed when the cannot directly connect to the IP address of the AD domain controller
(for example with NAT). For more information, see Section
24. Troubleshooting
.
Procedure 27: Configuring the AD domain controller (with the DNS server role) as the DNS server for IDENTIKEY
Appliance
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Settings > Network.
3. Complete the DNS server(s) fields.
Image 34: Configuring Active Directory Domain Controller for IDENTIKEY Appliance
4. Click SAVE .
Procedure 28: Adding an Active Directory back-end server record in the IDENTIKEY Authentication Server Administration Web Interface
Warning
Security Principal ID:
If Enable SSL is used, the format for the security principal ID is the DN, e.g.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
75
11. Back-End Authentication cn=Administrator, cn=Users, dc=vasco, dc=com
If Enable SSL is not used, the format for the security principal ID is the sAM Account Name , e.g. Administrator.
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Back-End > Register Active Directory Back-End.
3. Complete the necessary fields, and note the following points for the relevant fields: n
Enter the IP address of the Active Directory server in the Location field.
n
Entering a value in the Timeout field is mandatory.
For more information about these settings, refer to the IDENTIKEY Appliance Administrator Reference .
4. Click Create to finish.
To adjust the authentication policy settings, follow the instructions provided under
Procedure 21: Adjusting authentication policy settings
for adjusting policy settings to configure back-end authentication, using
Microsoft Active Directory
instead of
RADIUS
for the back-end protocol field.
To create a client record and assign the policy, follow the instructions under
Procedure 22: Creating a client record and assign the policy
for creating a client record and assigning a policy for Active Directory back-end authentication.
11.3.3. Multiple Domains: Global Catalog Server Setup
In this setup, multiple domain controllers are present. Instead of creating back-end records for each server, a simpler method is used to configure the global catalog server settings in the IDENTIKEY Authentication Server Administration Web Interface. This setup requires n n n n n
Activate Microsoft back-end authentication in the Configuration Tool
Configure the DNS server in the Configuration Tool
Configure the global catalog server settings
Configure the authentication policy settings
Configure a client record and assigning the policy
Note
When using the global server catalog, no back-end server record is required in the IDENTIKEY Authentication
Server Administration Web Interface.
For more information about the global catalog server setup, refer to the IDENTIKEY Appliance Product Guide , Section "Back-End Authentication".
For more information about activating Microsoft Active Directory back-end server authentication in the Configuration Tool, see Section
11.3. Microsoft Active Directory Back-End Authentication
.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
76
11. Back-End Authentication
For more information about configuring AD domain controllers (with the DNS server role) as DNS servers for
IDENTIKEY Appliance in the IDENTIKEY Appliance Configuration Tool, see
Procedure 27: Configuring the AD domain controller (with the DNS server role) as the DNS server for IDENTIKEY Appliance .
Warning
Although not mandatory, VASCO recommends using the AD domain controller as the DNS server to avoid issues with Microsoft SPN implementation. For more information about aspects requiring attention when configuring this setup, see Section
24.8. LDAP Back-End Authentication Setup Issues .
Procedure 29: Configuring the global catalog server on IDENTIKEY Appliance
The following configuration enables IDENTIKEY Appliance to use information in the global catalog server to retrieve the correct domain controller whenever LDAP Active Directory back-end authentication is required.
For further information about setting up a global catalog server, refer to the Microsoft product documentation.
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Back-End > Settings .
3. Complete the necessary fields, and note the following points for the corresponding fields: n the Global Catalog Location is the IP address or DNS name of the domain controller acting as the n global catalog server.
3268
is the default Global Catalog Port ; this value may need adapting to correspond to your n setup.
Principal ID and Principal Password are credentials with read access in the global catalog server.
Image 35: Global Catalog Server Settings for IDENTIKEY Appliance
4. Click Create to finish.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
77
11. Back-End Authentication
To adjust the authentication policy settings, follow the instructions provided under
Procedure 21: Adjusting authentication policy settings
for adjusting policy settings to configure back-end authentication, using
Microsoft Active Directory
instead of
RADIUS
for the back-end protocol field.
To create a client record and assign the policy, follow the instructions under
Procedure 22: Creating a client record and assign the policy
for creating a client record and assigning a policy for Active Directory back-end authentication.
11.4. IBM Security Directory Server Back-End Authentication
Procedure 30: Enabling IBM Security Directory Server back-end authentication
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > Authentication Back-Ends (see
Image 31: Authentication Back-Ends ).
3. Select Enabled for the IBM Security Directory Server back end.
4. Click SAVE .
Procedure 31: Adding an IBM Security Directory Server back-end server record
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Open the Back-End tab and select Register IBM Directory Back-End .
3. Complete the necessary fields, and note the following points for the relevant fields: n
Enable SSL must be selected.
n
Entering a value in the Timeout field is mandatory.
For more information about these settings, refer to the IDENTIKEY Appliance Administrator Reference .
4. Click CREATE to finish.
To adjust the authentication policy settings, follow the instructions provided under
Procedure 21: Adjusting authentication policy settings
for adjusting policy settings to configure back-end authentication, using
IBM Security Directory Server
instead of
RADIUS
for the back-end protocol field.
To create a client record and assign the policy, follow the instructions under
Procedure 22: Creating a client record and assign the policy
for creating a client record and assigning a policy for IBM Security Directory Server back-end authentication.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
78
12. Replication
12. Replication
Multiple instances of IDENTIKEY Appliance can be configured to synchronize by replicating data changes between them. This process is called replication , and can be set up using the Replication Wizard. Following synchronization, all services are identical on both appliances with modified data replicated in both directions. Replication ensures that each database is up-to-date with the latest data changes.
In this section, we explain: n n n
How to set up replication in the Configuration Tool
How to view the replication status in the Configuration Tool and Administration Web Interface
How to remove a replication link in the Configuration Tool
For more information about the concepts of replication, refer to the IDENTIKEY ApplianceProduct Guide , Section
"Replication".
For more information about the fields available for configuring replication, refer to the IDENTIKEY
Appliance Administrator Reference .
12.1. Replication Wizard
12.1.1. Create a Replication Link
We provide here the instructions on how to create a link between multiple instances of IDENTIKEY Appliance. This procedure can be repeated for creating further links. All the instructions for creating a replication link need to be completed in the Configuration Tool.
Replication can only be configured between two instances of IDENTIKEY Appliance for which the first-time configuration and licensing wizards have been completed (see the IDENTIKEY Appliance Installation and Maintenance
Guide ). One instance of IDENTIKEY Appliance is specified as the source, initiating synchronization towards the other, which is the target . After initial synchronization, replication is performed in both directions and both instances of IDENTIKEY Appliance have equivalent roles.
Warning
1. The database on the target IDENTIKEY Appliance is erased during replication, and overwritten by the source IDENTIKEY Appliance database. An instance of IDENTIKEY Appliance already included in a replication setup cannot be configured as a target for a second source IDENTIKEY Appliance. A new instance of IDENTIKEY Appliance being added to a replication setup can only be defined as a target. The wizard auto-detects the existing source IDENTIKEY Appliance.
2. Only Auditing and Administration Web Interface settings are replicated: Configuration Tool settings are not replicated. This allows activation of different services on instances of IDENTIKEY Appliance within a replication setup. However, this also means that some settings, such as enabling LDAP Active Directory back-end authentication (see
11.3. Microsoft Active Directory Back-End Authentication
), need to be configured manually on each replication peer.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
79
12. Replication
3. Replication is not possible between different versions of IDENTIKEY Appliance.
4. Replication links present on the instance of IDENTIKEY Appliance are removed on upgrading.
NOTE: Items 3 and 4 apply only if the IDENTIKEY data models of two instances of IDENTIKEY Appliance differ from one another, which is almost exclusively the case only when upgrading from one version of IDENTIKEY Authentication Server to another (patch upgrades excluded).
Procedure 32: Setting up replication
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > Authentication Server Replication , and click Add . This initiates the Replication Wizard.
3. Follow the guidelines provided in the wizard screens shown below. The Replication Processing screen remains active and listens for connections from the source IDENTIKEY Appliance.
Image 36: Replication Wizard Step 1 - Welcome Screen
IDENTIKEY Appliance 3.11.12 - Administrator Guide
80
12. Replication
Image 37: Replication Wizard Step 2 - Remote IP Address
Image 38: Replication Wizard Step 3 - Set Up Replication
IDENTIKEY Appliance 3.11.12 - Administrator Guide
81
12. Replication
Image 39: Replication Wizard Step 3 - Set Up Processing
4. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
5. Navigate to Authentication Server > Authentication Server Replication , and click Add . This initiates the Replication Wizard.
6. Follow the guidelines provided in the wizard screens shown above, except for selecting Replication
Source instead of Replication Target in Step 2. The Replication Processing screens on both the source and target instances of IDENTIKEY Appliance now show the status of the replication process (see example below).
7. When the Replication Process has finished, close the wizards on the source and target instances of
IDENTIKEY Appliance by clicking on the Finish button. This completes the replication setup.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
82
12. Replication
Image 40: Replication Setup Processing Screen Feedback
Tip
If the source and target instances of IDENTIKEY Appliance are separated by a network firewall, some firewall ports need to be opened. For more information, refer to the IDENTIKEY Appliance Administrator Reference , Section "Firewall Ports".
12.1.2. Replication Status
To verify the replication status via the IDENTIKEY Configuration Tool log on to the tool (see
2.3. Logging On to
IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
). Click the Replication menu topic in the Configuration Tool to see a list of the active replication links. For each instance of
IDENTIKEY Appliance linked to a replication setup, a button is provided to stop the replication link (see image below). Clicking on this button initiates the Replication Removal Wizard (explained below).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
83
12. Replication
Image 41: Replication Status in the IDENTIKEY Appliance Configuration Tool
To verify the replication status via the IDENTIKEY Authentication Server Administration Web Interface log on to the interface (see
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server
Administration Web Interface
). Click the System tab and select Get Replication Status in the Administration Web
Interface to show a list of the instances of IDENTIKEY Appliance for which the Replication Wizard has been successfully completed for a replication setup (see image below). For each instance of IDENTIKEY Appliance referenced, the following data is listed: n n n
Connection status (connected or not)
Time and date of the last update
Number of messages queued, i.e. the number of replication entries yet to be sent in this replication setup.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
84
12. Replication
Image 42: Replication Status in the IDENTIKEY Authentication Server Administration Web Interface
12.1.3. Replication Removal Wizard
To remove a replication setup requires removing both the source and target instances of IDENTIKEY Appliance, using the Replication Removal Wizard in the Configuration Tool.
Procedure 33: Removing replications
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Replication > Identifiers to view the list of IDENTIKEY Appliance instances currently linked to a replication setup.
3. Select the relevant instance to remove it - this initiates the Replication Removal Wizard which has two steps (shown in the images below).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
85
12. Replication
Image 43: Remove Replication Wizard Welcome Screen
Image 44: Remove Replication Wizard - Removal Processing
IDENTIKEY Appliance 3.11.12 - Administrator Guide
86
13. Secure Sockets Layer (SSL)
13. Secure Sockets Layer (SSL)
This section contains information about: n n n
Managing certificates used by IDENTIKEY Appliance
Configuring server certificates for SOAP, SEAL, and RADIUS (self-signed or commercial)
Configuring client certificates for SOAP and SEAL
For more information about the concepts of the server and client certificates and cipher suite security levels, refer to the IDENTIKEY Appliance Product Guide and the IDENTIKEY Appliance Administrator Reference , Section “SSL”.
For more information about the relevant configuration fields, refer to the IDENTIKEY Appliance Administrator Reference .
13.1. Managing Certificates
Using the Certificate Management page in the Configuration Tool you can manage all server and certification authority (CA) certificates used by all components of IDENTIKEY Appliance.
Server certificates
Server certificates contain public and private keys and are usually used to secure connections to a server or a component using SSL, e.g. SEAL communicator, SOAP communicator, Configuration Tool, etc.
Trusted Root Certificate Authorities
Trusted certification authority (CA) certificates are typically used to determine which client certificates to trust.
Trusted CA certificates often come in bundles containing several different trusted root CA's.
IDENTIKEY Appliance Root CA
IDENTIKEY Appliance contains a built-in certification authority (CA) used to sign all automatically generated default certificates. This list contains the root CA certificate for the IDENTIKEY Appliance CA.
13.1.1. Editing Server or CA Certificates
Procedure 34: Editing a server or CA certificate
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Settings > Certificates .
3. Select the certificate in the respective list and click Edit .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
87
13. Secure Sockets Layer (SSL)
The Edit Certificate Dialog appears.
4. Edit the certificate as required and click Update .
If you want to upload the signed certificate for a pending certificate signing request (CSR), you can specify the certificate file in the Upload Signed Certificate box.
13.1.2. Downloading Server or CA Certificates
Procedure 35: Downloading a server or CA certificate
1. Navigate to Settings > Certificates .
2. Select the certificate in the respective list and click Download certificate .
13.1.3. Deleting Server or CA Certificates
Procedure 36: Deleting a server or CA certificate
1. Navigate to Settings > Certificates .
2. Select the certificate in the respective list and click Delete .
13.1.4. Adding Server Certificates
Procedure 37: Adding a server certificate
1. Navigate to Settings > Certificates .
2. Click Add Certificate in the Server Certificates section.
The Add Certificate Wizard appears.
3. Do one of the following: n
If you want to create a new certificate: a. In the Certificate Source page, select Create New Certificate .
b. Specify the certification authority to sign the certificate.
Select Appliance Signs The Certificate , if you want to use the built-in root CA of the
IDENTIKEY Appliance to create a self-signed certificate.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
88
13. Secure Sockets Layer (SSL)
Select Third Party Signs The Certificate , if you want to have a third-party CA to create a certificate.
c. Specify the subject data for the certificate request.
If you chose to use the built-in CA, the certificate is being created and added to the
Server Certificate list.
If you chose to use a third-party CA, a certificate signing request (CSR) is being created and can be downloaded to submit to the respective CA. When the third-party CA has created your certificate, upload the signed certificate using the Edit Certificate Dialog .
n
If you want to upload an existing certificate: a. In the Certificate Source page, select Upload Certificate .
b. Specify the certificate file to upload.
The certificate must be a Base64-encoded X.509 certificate file (usually a .PEM file), containing the certificate and the respective private key file. Certificate chains can be included with the certificate within one single certificate file using the PEM file format.
If required, type the private key password.
4. Click Finish to close the wizard.
13.1.5. Adding Trusted Root Certification Authority (CA) Bundles
Procedure 38: Adding a trusted root certification authority (CA) bundle
1. Navigate to Settings > Certificates .
2. Click Add Authority in the Trusted Root Certificates Authorities section.
The Add Authority Wizard appears.
3. Specify the certificate or certificate bundle to upload.
The certificate must use the PEM file format. Multiple certificate authority signing certificates can be used for validating client certificates, but must be uploaded in a single file.
4. Click Next to add the certificate bundle to the Trusted Root Certificate Authorities list.
5. Click Finish to close the wizard.
13.2. Using Server Certificates
Server certificates are typically used to secure connections to a server or a component using SSL.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
89
13. Secure Sockets Layer (SSL)
IDENTIKEY Appliance uses server certificates to secure the following components: n n n n n n n
SEAL Communicator
SOAP Communicator
RADIUS Communicator
Live Audit
IDENTIKEY Appliance Configuration Tool
Remote Support
Secure Auditing
Whenever you need to specify a server certificate for these components you select the respective certificate from a list containing all valid server certificates created or uploaded using the Certificate Management tab. Whether a certificate is valid and applicable for a particular component depends on the component (see
Table 6: Certificate
Restrictions
).
Table 6: Certificate Restrictions
Component
SEAL Communicator
SOAP Communicator
RADIUS Communicator
Live Audit
IDENTIKEY Appliance Configuration Tool
Remote Support
Secure Auditing
Certificate Restrictions n n n n n n
Not expired
RSA
Not expired
RSA
Not expired
RSA n n
Not expired
RSA n n n n
Not expired
RSA, DSA, or elliptic curve
Not expired
Signed by VASCO n n
Not expired
Elliptic curve prime256v1
By default, some server certificates are created by the built-in CA during installation: n
Certificate for SEAL, SOAP, and RADIUS
This server certificate is used by all components using the SEAL, SOAP, and RADIUS protocols, by default, the SEAL communicator, the SOAP communicator, the RADIUS communicator, and Live Audit.
n
Configtool SSL certificate
This server certificate is used by the IDENTIKEY Appliance Configuration Tool. A new default certificate is automatically created whenever you change the host name. If you upload and select a custom certificate, that custom certificate remains and no new certificate is created, even if the host name is changed.
The following procedure describes exemplarily how to change the server certificate for the communicator components.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
90
13. Secure Sockets Layer (SSL)
Procedure 39: Selecting a server certificate for a communicator component
1. In the IDENTIKEY Appliance Configuration Tool navigate to Authentication Server > SEAL Communicator ,
Authentication Server > SOAP Communicator , or Authentication Server > RADIUS Communicator , depending on what the certificate is being used for.
2. If you are using RADIUS, set the security level ( Very High , High , Medium , or Low ).
For more information about the SSL cipher suite security levels, refer to the IDENTIKEY Appliance Administrator Reference .
3. Select a certificate from the Server Certificate list.
The Server Certificate list contains all valid certificates you have previously created/imported using the Certificate Management tab (see
13.1. Managing Certificates ).
Image 45: Server Certificate Configuration (SEAL)
4. Click Save to finish.
13.3. Using CA Certificates for Client Verification
Client certificates are used when connecting to secure remote services to verify and confirm the identity of those remote services (authenticity), typically by verifying the client certificates using trusted root CA's.
IDENTIKEY Appliance uses CA certificates/bundles to verify client certificates of the following components: n n n
SEAL Communicator
SOAP Communicator
IBM Security Directory Server Back-End Servers
IDENTIKEY Appliance 3.11.12 - Administrator Guide
91
13. Secure Sockets Layer (SSL) n n n n n n
Active Directory (AD) Back-End Servers
Live Audit
Message Delivery Component (MDC) SMS Servers
Message Delivery Component (MDC) SMPP Servers
Message Delivery Component (MDC) SMTP Servers
Message Delivery Component (MDC) Voice Servers
Whenever you need to specify a client certificate for one of these components you select the respective certificate from a list containing all valid and trusted CA certificates imported using the Certificate Management page.
By default, IDENTIKEY Appliance already contains the cURL CA root certificate bundle.
The following procedure describes exemplarily how to change the client certificate for the communicator components.
Procedure 40: Selecting a CA certificate/bundle for a communicator component
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > SEAL Communicator or Authentication Server > SOAP Communicator , depending on the communicator component to configure.
3. Set Require Client Certificate to Optional , Required or Required-signed address only .
4. Select a CA certificate/bundle from the CA Certificate Store list.
The CA Certificate Store list contains all valid and trusted CA certificates you have previously created/imported using the Certificate Management page (see
13.1. Managing Certificates
).
5. If required, select Re-Verify on Re-Negotiation .
This option should be used sparingly and only if really necessary. It performs the SSL handshake each time you reconnect. If you reconnect each time you send a message you should not select this option as it will slow performance.
6. If you are using SEAL, select Automatically Trust Certificates to trust server certificates automatically.
7. Click Save to finish.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
92
Image 46: Client Certificate Configuration (SEAL)
13. Secure Sockets Layer (SSL)
IDENTIKEY Appliance 3.11.12 - Administrator Guide
93
14. Setting Up Signing and Provisioning
14. Setting Up Signing and Provisioning
This section provides information about setting up signature and provisioning services with IDENTIKEY Appliance.
Electronic Signature is used for transaction authentication and integrity checking.
Software DIGIPASS are software versions of DIGIPASS authenticator that provide authentication and Electronic Signature functions for Java-enabled mobile devices and web browsers. Provisioning is the process of safely delivering computer files containing Java programs (MIDlet) and data (secrets and security applications) to the mobile devices or web browser.
For more information about different services and scenarios, refer to the IDENTIKEY Appliance Product Guide .
14.1. SOAP Communication Protocol
Electronic signatures and provisioning are only supported by the SOAP communication protocol. SOAP setups require SSL, and a server certificate is required for the SSL connection.
For more information about downloading server certificates using the IDENTIKEY Appliance Configuration Tool, see
13. Secure Sockets Layer (SSL) .
14.2. Enabling Signing and Provisioning Services
Signing and provisioning services can be enabled and configured using the Configuration Tool (see
3.1. Enabling
Services ).
For more information about scenario settings, refer to the IDENTIKEY Appliance Administrator Reference .
14.3. Configuring Signature and Provisioning Setups
Configuration for electronic signature and provisioning requires the use of the Software Development Kit (SDK) and is beyond scope of this document. For more information about setting up signing and provisioning, refer to the
IDENTIKEY Authentication Server SDK Programmer's Guide .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
94
15. Setting Up Virtual DIGIPASS
15. Setting Up Virtual DIGIPASS
This section provides information about setting up Virtual DIGIPASS.
Setting up Virtual DIGIPASS requires the following steps: n n n n n
Importing Virtual DIGIPASS records
Setting up Message Delivery Component (MDC)
Preparing a IDENTIKEY Authentication Server policy
Testing Virtual DIGIPASS
Assigning the policy to the appropriate client component
For more information about authenticating using Virtual DIGIPASS, refer to the IDENTIKEY Appliance Product Guide ,
Section "Message Delivery Component (MDC)".
15.1. Importing Virtual DIGIPASS Records
You receive Primary Virtual DIGIPASS records in a DIGIPASS transport file (.dpx), with a DPX file key, as you receive with standard DIGIPASS records. Import them like standard DIGIPASS records (see
4.4. DIGIPASS Records and
Assignment
).
Backup Virtual DIGIPASS do not have records of their own. Information about Backup Virtual DIGIPASS is contained in the record of the DIGIPASS authenticator which is supplemented by Backup Virtual DIGIPASS.
15.2. Setting Up Message Delivery Component (MDC)
All instructions in this section need to be completed using the IDENTIKEY Appliance Configuration Tool.
Message Delivery Component (MDC) is necessary to support Virtual DIGIPASS authentication. MDC interfaces with a gateway service to send a one-time password (OTP) to a user’s mobile phone, email address, or via voice message. It acts as a service, accepting messages from IDENTIKEY Appliance which are then forwarded to an email address or to a text message gateway via the HTTP/HTTPS protocol.
15.2.1. Configuring an SMS Gateway
Since every gateway uses different submission parameters, certain settings are required, which can be configured using the IDENTIKEY Appliance Configuration Tool. Depending on the type of gateway server used, different configurations are possible.
To configure SMS gateway settings with an SMS server, you need to specify the following information in the
IDENTIKEY Appliance Configuration Tool: n
Name. The display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
95
15. Setting Up Virtual DIGIPASS n n n n n n
Profile. The actual name of the MDC profile.
Enabled. If selected, the gateway is enabled.
The URL to access the gateway server.
The user name and password for the gateway account.
The required query string.
The query method (GET or POST) required by the gateway.
To configure SMS gateway settings with an SMPP server, you need to specify the following information in the
IDENTIKEY Appliance Configuration Tool: n n n n n n n n n
Name. The display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.
Profile. The actual name of the MDC profile.
Enabled. If selected, the gateway is enabled.
The URL to access the gateway server.
The port used to connect to the gateway.
The user name and password for the gateway account.
The SMPP system type.
The SMPP source address number and Numbering Plan Indicator (NPI).
The SMPP destination address NPI.
Contact your gateway provider for this information. If you have any issues, contact your supplier.
Procedure 41: Setting up an SMS gateway for Message Delivery Component (MDC)
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Authentication Server > Message Delivery Component .
3. Enable the Message Delivery Component settings.
4. Select the type of server to be used by clicking Add SMS Server or Add SMPP Server .
5. Complete the fields for the selected server with the information gathered before.
6. Click Add to activate the settings.
Result options which can be configured for MDC setup allow messages returned from the gateway to be modified.
Modifications allow more user friendly feedback to be forwarded to the auditing system. For more information about configuring result options, refer to the IDENTIKEY Appliance Administrator Reference .
For more information about auditing, see
21.4. Auditing
and refer to the IDENTIKEY Appliance Product Guide , Section "Auditing". For more information about the particular MDC settings, refer to the IDENTIKEY Appliance Administrator Reference .
15.2.2. Configuring an Email Gateway
To configure email gateway settings, you need to specify the following information in the IDENTIKEY Appliance Configuration Tool: n
Name. The display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
96
15. Setting Up Virtual DIGIPASS n n n n n n
Profile. The actual name of the MDC profile.
Enabled. If selected, the gateway is enabled.
The URL to access the gateway server.
The SMTP relay host, port and connection security ( No SSL/TLS , Use SSL or Use TLS ). If SSL or TLS are used, a certificate is required, which needs to be retrieved from the email gateway. This needs to be uploaded in PEM format.
SMTP authentication (optional).
The from address.
Procedure 42: Setting up an email gateway for Message Delivery Component (MDC)
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Naviagte to Authentication Server > Message Delivery Component .
3. Enable the Message Delivery Component settings.
4. Click Add SMTP Server .
5. Complete the fields for the selected server with the information gathered before.
6. Click Add to activate the settings.
15.2.3. Configuring a Voice Gateway
To configure voice gateway settings, you need to enter into the following information in the IDENTIKEY Appliance
Configuration Tool: n n n n n n n n
Name. The display name of the MDC profile; ad-hoc field used primarily to describe and further identify the profile.
Profile. The actual name of the MDC profile.
Enabled. If selected, the gateway is enabled.
The URL to access the gateway server.
The user name and password for the gateway account.
The phone number prefix for the voice settings.
The required query string.
The query method (GET or POST) required by the gateway.
Procedure 43: Setting up a voice gateway for Message Delivery Component (MDC)
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Naviagte to Authentication Server > Message Delivery Component .
3. Enable the Message Delivery Component settings.
4. Click Add Voice Server .
5. Complete the fields for the selected server with the information gathered before.
6. Click Add to activate the settings.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
97
15. Setting Up Virtual DIGIPASS
15.2.4. Configuring SMS and Email Messages
You can customize the messages sent by MDC using the IDENTIKEY Authentication Server Administration Web Interface (via Servers > Global Configuration ). That page contains three tabs, corresponding to the message types sent by MDC. Switch to the corresponding tab to customize the message settings. To designate where the one-time password appears in the message, use the placeholder string
[OTP]
.
For more information, refer to the IDENTIKEY Appliance Administrator Reference .
15.2.5. Importing and Exporting Gateway Definitions
The IDENTIKEY Appliance Configuration Tool allows you to import and export gateway definitions. This allows you to upload a description file and easily apply gateway settings to Message Delivery Component of different
IDENTIKEY Appliance instances or to import gateway settings from an IDENTIKEY Authentication Server instance to
IDENTIKEY Appliance (and vice versa).
Importing gateway definitions also makes it easier to apply gateway settings for supported third- party
SMS gateway provider services.
Procedure 44: Importing a gateway definition
1. Select Authentication Server > Message Delivery Component in the IDENTIKEY Appliance Configuration
Tool.
2. Enable the required delivery method by selecting the corresponding check box.
3. Click Import gateway .
4. Browse to the gateway description file and click Import .
5. Edit the newly imported file and verify the imported details from the file.
6. Configure load-balancing, failover, and/or failback: a. Specify the order in which the gateway definition appears on the gateway list by dragging the gateway to the required position in the table in the overview screen.
b. Specify the server type ( Primary or Backup ) in the details screen of the relevant gateway.
7. Click Apply .
8. Click OK .
15.3. Setting Up IDENTIKEY Appliance Policies for Virtual DIGIPASS
Policies can be edited to use:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
98
15. Setting Up Virtual DIGIPASS n n n
Primary Virtual DIGIPASS
Backup Virtual DIGIPASS
Both
With Backup Virtual DIGIPASS, restrictions are possible by time or number of uses. For more information about on implementing Virtual DIGIPASS and restrictions, refer to the IDENTIKEY Appliance Product Guide , Section "Virtual
DIGIPASS".
15.3.1. Setting Up Policies for Primary Virtual DIGIPASS
Procedure 45: Setting up a policy for Primary Virtual DIGIPASS
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Select Policies > List .
3. Select the policy in which you wish to enable Virtual DIGIPASS.
4. Switch to the Virtual DIGIPASS tab.
5. Click Edit .
6. Select a delivery method for Virtual DIGIPASS: Email , SMS , or Voice .
7. Select one of the following options as the request method: n n n n n n n
Default . Use the setting of the parent policy.
None . Do not use Primary Virtual DIGIPASS.
Keyword . Use the request keyword, with or without another item. The user needs to type the request keyword into the password field. This is permitted to be blank.
Keyword Only . Only the keyword will be accepted.
Password . Use the static password. The user needs to type the static password into the password field.
KeywordPassword . Use the request keyword followed by the static password. The user needs to type the request keyword followed by the static password into the password field. No separator characters or white spaces are allowed between them.
PasswordKeyword . Use the static password followed by the request keyword. The user needs to type the static password followed by the request keyword into the password field. No separator characters or white spaces are allowed between them.
8. If you have selected an option which includes the use of a request keyword, type it in the PVDP Request
Keyword box.
9. Click Save .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
99
15. Setting Up Virtual DIGIPASS
15.3.2. Setting Up Policies for Backup Virtual DIGIPASS
Procedure 46: Setting up a policy for Backup Virtual DIGIPASS (Permitted, Not Mandatory)
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Select Policies > List .
3. Select the policy in which you wish to enable Virtual DIGIPASS.
4. Switch to the Virtual DIGIPASS tab.
5. Click Edit .
6. Select a delivery method for Virtual DIGIPASS: Email , SMS , or Voice .
7. Select Yes – Permitted from the Enable Backup VDP list.
8. (OPTIONAL) Type the maximum number of uses. This will be calculated for each person using Backup Virtual DIGIPASS.
9. Click Save .
Procedure 47: Setting up a policy for Backup Virtual DIGIPASS (Permitted, Not Mandatory, Time-Limited)
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Select Policies > List .
3. Select the policy in which you wish to enable Virtual DIGIPASS.
4. Switch to the Virtual DIGIPASS tab.
5. Click Edit .
6. Select a delivery method for Virtual DIGIPASS: Email , SMS , or Voice .
7. Select Yes – Time Limited from the Enable Backup VDP list.
8. Type a time limit (in days) in the Time Limit box. When the time period has passed (calculated from the first use), a user will no longer be permitted to use Backup Virtual DIGIPASS.
9. (OPTIONAL) Type the maximum number of uses. This will be calculated for each person using Backup Virtual DIGIPASS.
10. Click Save .
Procedure 48: Setting up a policy for Backup Virtual DIGIPASS (Mandatory)
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .Administration Web Interface
2. Select Policies > List .
3. Select the policy in which you wish to enable Virtual DIGIPASS.
4. Switch to the Virtual DIGIPASS tab.
5. Click Edit .
6. Select a delivery method for Virtual DIGIPASS: Email , SMS , or Voice .
7. Select Yes – Required from the Enable Backup VDP list.
8. (OPTIONAL) Type the maximum number of uses. This will be calculated for each person using Backup Vir-
IDENTIKEY Appliance 3.11.12 - Administrator Guide
100
15. Setting Up Virtual DIGIPASS tual DIGIPASS.
9. Click Save .
Tip
Backup Virtual DIGIPASS may also be enabled for individual users via each DIGIPASS record. Settings in the user record overrule equivalent policy settings.
15.4. Testing Virtual DIGIPASS
15.4.1. Testing Primary Virtual DIGIPASS
Procedure 49: Testing Primary Virtual DIGIPASS
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Select DIGIPASS > List .
3. Select the Virtual DIGIPASS to be tested.
4. Switch to the Application Type tab and click Test VDP .
5. Select a delivery method for Virtual DIGIPASS: Email , SMS , or Voice .
6. Type the mobile phone number or email address to which the one-time password (OTP) should be sent.
7. Click Generate .
The Administration Web Interface will attempt to send an OTP via Message Delivery Component (MDC), which will attempt to forward it to the configured SMS gateway, mail, or voice server.
The result of the delivery attempt will be displayed.
8. When the OTP has been delivered using the requested method, type into the OTP box and click Verify .
9. The result of the verification attempt will be displayed.
15.4.2. Testing Backup Virtual DIGIPASS
Procedure 50: Testing Backup Virtual DIGIPASS
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
101
15. Setting Up Virtual DIGIPASS
2. Select DIGIPASS > List .
3. Select the DIGIPASS record belonging to the Backup Virtual DIGIPASS to be tested.
4. Switch to the Application Type tab and click Test BVDP .
5. Select a delivery method for Virtual DIGIPASS: Email , SMS , or Voice .
6. Type the mobile phone number or email address to which the one-time password (OTP) should be sent.
7. Click Generate .
The Administration Web Interface will attempt to send an OTP via Message Delivery Component (MDC), which will attempt to forward it to the configured SMS gateway, mail, or voice server.
The result of the deliver attempt will be displayed.
8. When the OTP has been delivered using the requested method, type into the OTP box and click Verify .
9. The result of the verification attempt will be displayed.
15.5. Assigning Policies to Clients for Using Virtual DIGIPASS
Procedure 51: Assigning a policy to a client for using Virtual DIGIPASS
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Select Client > List .
3. Select the client for which you wish to enable Virtual DIGIPASS.
4. Click Edit .
5. Select the policy in which you want to enable Virtual DIGIPASS in the Policy list.
6. Click Save .
For more information about creating new client components, see
4.1. Client Component Records .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
102
16. Reporting
16. Reporting
IDENTIKEY Appliance provides a wide range of reporting options, with low-level control of aspects including required fields, run-time query options, permissions, templates, and scheduling.
You can use either predefined standard reports, which can be edited, or you can create your own customized reports.
Reports are managed using the IDENTIKEY Authentication Server Administration Web Interface. You can use the
Administration Web Interface to view, edit, define, delete, or run existing reports. A Report Definition wizard simplifies the task of creating new custom reports.
For more information about reports, refer to the IDENTIKEY Appliance Product Guide .
16.1. Working With Reports
Basic reporting tasks are done using the Report Definition Wizard in the Administration Web Interface.
To view a list of existing reports, Select REPORTS > List in the Administration Web Interface. A full list of available reports appears.
To view details of a single report, click the respective report name. This opens the Report Definition page, with details including: n n n n n
Domain Name
Report Type
Grouping Level
Data Source
Time Frequency
To view additional report details, select the Fields tab, Queries tab, Permissions tab, and Templates tab. For more information, see
16.2. Creating Reports Using the Report Definition Wizard
.
Viewing Finished Reports
If you choose to run a report immediately, you can view the finished PDF or HTML report via Open Report in the Summary page. If you have scheduled a report to run at a later time, you can view the finished report by navigating to SYSTEM > Report Retrieval .
Procedure 52: Running an existing report
1. Select the report to run: a. Select REPORTS > Run report .
b. Select the report to run from the list.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
103
16. Reporting c. Click NEXT , if you want to configure the report before creating it. Continue with the next step.
-OR-
Click RUN WITH DEFAULTS to run the report automatically with default settings. The subsequent wizard pages are not displayed and you are redirected directly to the Summary page.
The RUN and RUN WITH DEFAULTS buttons are also available in the User Properties page and allow the administrator to generate user-specific reports in the context of the User Dashboard of
IDENTIKEY Authentication Server Administration Web Interface (see
5.3. Generating Reports via the Reports Tab ).
-ORa. Select REPORTS > List .
b. Click the report name of the respective report in the list.
c. Click RUN .
-ORa. Click the Quick Report button in the User Dashboard of the selected user. By default, IDENTIKEY
Authentication Server generates a Detailed Activity Summary report but the type of report can be changed and the report settings specified in the Administration Web Interface properties configuration during the installation of IDENTIKEY Authentication Server.
Note
When you configure a different type of report to be generated by clicking QUICK REPORT, its usage must be allowed in all domains by all administrators by adjusting the settings and permissions as follows: n n
Report location: Master Domain
Report usage permission: Public - All administrators in the different domains can update this report
2. Specify the report settings.
Select the report template via Template to use , either HTML , PDF , or XML .
Specify the time period to include in the report. This option is available only if the query definition for this report does not contain an Audit:Timestamp condition.
3. (OPTIONAL) Define any run-time query required.
4. Specify at which time to run the report.
n
Select Run immediately to run the report at once when you click RUN . The Administration Web
Interface is blocked as long as the report is being created.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
104
16. Reporting n
Select Run in background to schedule the report generation. The report is being created in the background and you can continue working with Administration Web Interface. This option is available for PDF reports only!
5. Click RUN .
The Finish page appears displaying any confirmation or error messages.
6. If you chose to run the report immediately, you can open it now via OPEN REPORT .
7. Click FINISH to complete the wizard.
Procedure 53: Changing the report owner
1. Select REPORTS > List in the Administration Web Interface. A full list of available reports appears.
2. Locate the desired report in the list and click the report name.
3. Switch to the Permissions tab and click CHANGE OWNER .
The Change Report Owner wizard appears.
4. Enter available information to specify the new owner, e.g. organizational unit, account status, etc. and click SEARCH .
The Select User page appears showing a list of users whose data matched the search criteria.
5. Select the desired user and click CHANGE OWNER .
Procedure 54: Editing a report
1. Select REPORTS > List in the Administration Web Interface. A full list of available reports appears.
2. Locate the desired report in the list and click the report name.
3. Switch to the appropriate tab and click EDIT to edit the information in the respective tab.
The fields in the respective tab become available for editing.
Alternatively, if you wish to edit field or query definitions use ADD NEW.
4. After editing the report settings as desired, click SAVE .
For more information, see
16.2. Creating Reports Using the Report Definition Wizard
.
Procedure 55: Deleting a report
1. Select REPORTS > List in the Administration Web Interface. A full list of available reports appears.
2. Locate the desired report in the list and click the report name.
3. Click DELETE .
A confirmation message appears.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
105
16. Reporting
4. Click OK to delete the report.
16.2. Creating Reports Using the Report Definition Wizard
If standard IDENTIKEY Appliance reports do not meet your requirements, you can either edit an existing report or create a new custom report using the Report Definition Wizard in the Administration Web Interface.
The Report Definition Wizard guides you through the following series of pages: n n n n n n n n
Describe Report
Options
Define Fields
Define Query
Query Overview
Permissions
Templates
Finish
At any time, you can click Cancel to leave the wizard, or click Help on each page for context-sensitive assistance.
Procedure 56: Creating a report
1. In the Administration Web Interface, mouse over the Reports tab, then click Define Report on the dropdown menu.
Doing so will display the Describe Report page.
2. In the Describe Report page: a. Enter a Report Name . The name must be unique. You can use up to 60 characters.
b. Select the Type of report from the list provided.
c. Enter a Report description. This should explain what the report contains, and what it is to be used for.
d. Click Next to continue.
Doing so will display the Options page.
3. In the Options page: a. Select the Grouping Level from the drop-down list. This will define the way in which data is grouped on the report.
b. Select the Data Source from the drop-down list.
c. Click Next to continue.
4. If you are creating a Detailed Analysis or List Analysis report, and you selected audit data for the Data
Source, then the Define Fields tab will be displayed. If not, ignore this step.
a. If you do not want to create a field-level filter, simply click Next . All field data will be included by default.
b. To create a field-level filter, enter a Display Name and select a Field Name from the available drop-down list. Then select the Operation you wish to perform on the chosen field and click the
Create button.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
106
16. Reporting c. Repeat the above step to create further field data filters if required. When you are done, click
Next .
5. The Define Query page is displayed.
a. To define a query, enter a Query name, select the required Field, and choose a Condition from the drop down list.
b. Some conditions (e.g.
isblank ) do not require an entry in the Value field. Any entry in the value field for these conditions will be ignored. Time values can be expressed in text (e.g. “last six months”).
c. When you are done, click the Add New button.
d. Repeat this step to create additional query filters if required. You can only specify one data field per query, so if you want to specify more than one field you must define more than one query.
e. When you are finished, click Next .
6. The Define New Query page now displays a list of queries that were entered previously. To view details of a query, click on the query name. When you have finished reviewing query details, click Next .
Doing so will display the Permissions page.
7. In the Permissions page, specify who can alter and run the report by selecting the appropriate Usage Permissions and Update Permissions. Note that the owner is the person who created the report (unless reassigned). Click Next to continue.
Doing so will display the Templates page.
8. In the Templates page, select which template to use. If you do not want to use the default XML or PDF templates (this option is selected by default) then provide a new Template Name and browse to the location of the Template Definition file. Click Save to continue.
9. The Finish page displays a summary of report information. Any confirmation or error messages are shown on this page. Click Finish to close the Report Definition Wizard.
You should now be able to see your new report when you view the available report list.
16.3. PDF and HTML Report Customization
You can produce customized IDENTIKEY Appliance reports with your own logo, header, and footer design. To do this, you must: n n
Create a template in either: n n
XML (for PDF reports) or
XSLT (for HTML reports).
Use the Administration Web Interface to upload the custom report template and link it to an IDENTIKEY
Appliance report.
The custom template will be linked with that report thereafter. It can also be linked with other reports. If you delete a custom template, the associated report(s) will revert to the default IDENTIKEY Appliance template.
The following diagram shows how IDENTIKEY Appliance report data is transformed into a finished report.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
107
16. Reporting
Image 47: Customized report data flow
Custom PDF Report Templates
Custom PDF report templates are defined in XML. To create a custom PDF report template, open a text editor
(or code editor) and create a new file, formatted like the following example.
Example
<VASCO>
<PDFTemplate>
<content>
<image src="C:\pictures\blah.jpg"/>
<header align="left">My left-aligned header</header>
<footer align="right">My right-aligned footer</footer>
</content>
<layout>
IDENTIKEY Appliance 3.11.12 - Administrator Guide
108
16. Reporting
<orientation>Portrait</orientation>
<paper-size>A4</paper-size>
</layout>
</PDFTemplate>
</VASCO>
The src attribute of the image tag specifies the location of a header image, and should be an absolute file path.
The align attribute defines the alignment of the headers and footers. Possible values for this attribute are: n n n left center right
The orientation tag defines the PDF report's orientation, and has two possible values: n n
Portrait
Landscape
The paper-size tag defines the size of the PDF report when printed. The following table lists the different paper sizes per value:
Table 7: Paper-Size Values (for customized PDF/HTML reports)
Value Paper Size (in pts)
A0
A1
A2
A3
A4
A5
A6
Letter
Broadsheet
Ledger
Tabloid
Executive
2380x3368
1684x2380
1190x1684
842x1190
595x842
421x595
297x421
612x792
1296x1584
1224x792
792x1224
522x756
IDENTIKEY Appliance 3.11.12 - Administrator Guide
109
16. Reporting
XSLT Templates for HTML Reports
The structure of an XSLT template is considerably more complex than XML. To view the formatting structure, refer to the default XSLT files that are installed with IDENTIKEY Appliance.
Each default report provided by IDENTIKEY Appliance has a corresponding XSLT script for producing HTML output. To view the corresponding XSLT script of a report:
Procedure 57: Viewing a report's corresponding XSLT script
1. Select REPORTS > List in the Administration Web Interface. A full list of available reports appears.
2. Locate the desired report in the list and click the report name.
3. Click the Template tab.
4. Click the HTML link. Doing so will open the XSLT template for that report.
Once you have created a custom template, you can link it to a report as follows:
Procedure 58: Linking a custom template to a report
1. Select REPORTS > List in the Administration Web Interface. A full list of available reports appears.
2. Locate the desired report in the list and click the report name.
3. Click the Template tab.
4. Click Edit . Doing so will provide new options.
5. Click Choose File and locate the new XML or XSLT template file.
6. Enter a Template Name and click Upload .
The new template will be uploaded and associated with that report.
16.4. Report Retrieval
Only reports created in PDF format can be retrieved via the Administration Web Interface. To do so, navigate to System > Report Retrieval in the Administration Web Interface. From there, you can: n n
To Delete, Change Ownership or Take Ownership of one or more reports from this page, select the desired report or reports and click on the appropriate button.
Click on the report name to go to the Manage Reportfile page from where you can Delete, Change Ownership, Take Ownership or Download a report.
If you choose to download the report, you may either Open the report immediately, or save the report to a specified location. For information on how to take/change report ownership, refer to
16.1. Working With Reports .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
110
17. Configuring RADIUS Environments
17. Configuring RADIUS Environments
This section describes how to configure typical RADIUS environments:
For more information about RADIUS environments, refer to the IDENTIKEY Appliance Product Guide , Section
"RADIUS Environments".
17.1. Stand-Alone IDENTIKEY Appliance in RADIUS Environment
This topology is ideal for services where RADIUS attributes are not required and one of the supported password protocols will be in use: n n n n
PAP
CHAP
MSCHAP
MSCHAP2
This deployment will require: n n
IP address of the RADIUS client
Shared secret used by the RADIUS client - or select a secret to use now if the RADIUS client isn't yet equipped with a shared secret
Procedure 59: Deploying Stand-Alone IDENTIKEY Appliance in RADIUS Environment
This procedure is for manual deployment after installation. The following configuration is also available during a
Basic Install configuration phase.
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > Register .
3. Enter the following data: n
Client Type: select RADIUS Client n
Location:
IP address of the RADIUS client
IDENTIKEY Appliance 3.11.12 - Administrator Guide
111
17. Configuring RADIUS Environments n n
Policy ID:
Policy you want to use for this RADIUS client
Protocol ID: select RADIUS n
Shared Secret:
Shared secret used by the RADIUS client
4. Click on Create .
After configuring IDENTIKEY Appliance (either via these steps or via the Basic Install configuration phase), configure your RADIUS client to send authentication request to IDENTIKEY Appliance. Information on the IP/port of the RADIUS communicator is available in the Configuration Utility (specifically, in the RADIUS tab of the Communicators menu).
17.2. IDENTIKEY Appliance as RADIUS Proxy Target
You may wish to use this topology if
The RADIUS server supports the proxying of authentication while returning attributes itself
The RADIUS server can forward the authentication request using one of the supported password protocols: n
PAP n n
CHAP
MSCHAP n
MSCHAP2
The RADIUS server supports an Access-Challenge response from IDENTIKEY Appliance, if required. The Access-
Challenge mechanism is used for Challenge/Response and Virtual DIGIPASS, although it is still possible to use Virtual DIGIPASS without that mechanism.
If the RADIUS server is capable, this scenario allows IDENTIKEY Appliance to operate in an environment that uses certificate-based EAP protocols such as PEAP and EAP-TTLS. To make this work, the RADIUS server decrypts the user credentials into a simpler protocol before forwarding the request to IDENTIKEY Appliance.
This deployment will require:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
112
n n
IP address of the RADIUS server
Shared secret used by the RADIUS server
17. Configuring RADIUS Environments
Procedure 60: Deploying IDENTIKEY Appliance as a RADIUS proxy server
This procedure is for manual deployment after installation. The following configuration is also available during a Basic Install configuration phase.
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > Register .
3. Enter the following data: n n n n
Client Type: select RADIUS Client
Location: IP address of the RADIUS server
Policy ID: Policy you want to use for this RADIUS server
Protocol ID: select RADIUS n
Shared Secret: Shared secret used by the RADIUS server
4. Click on Create .
After configuring IDENTIKEY Appliance (either via these steps or via the Basic Install configuration phase), configure your RADIUS server to send authentication request to IDENTIKEY Appliance. Information on the IP/port of the
RADIUS communicator is available in the Configuration Utility (specifically, in the RADIUS tab of the Communicators menu).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
113
17. Configuring RADIUS Environments
17.3. IDENTIKEY Appliance as Intermediate Server
When used as an intermediate authentication server, IDENTIKEY Appliance can be set up in two basic modes: n
OTP-only : IDENTIKEY Appliance keeps a record of a user's static password and relays it to the back-end server n
OTP-Password : where the user enters an OTP and their password, which is not stored by IDENTIKEY Appliance but is relayed to the back-end server for authentication.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
114
17. Configuring RADIUS Environments
Either mode requires the following information: n n
IP address of both RADIUS client and RADIUS server
Shared secret used by both RADIUS client and RADIUS server
Procedure 61: Deploying IDENTIKEY Appliance as an intermediate server
This procedure is for manual deployment after installation. The following configuration is also available during a Basic Install configuration phase.
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > Register .
3. Enter the following data: n
Client Type: select RADIUS Client n n n n
Location: IP address of the RADIUS client
Policy ID: Policy you want to use for this RADIUS client
Protocol ID: select RADIUS
Shared Secret: Shared secret used by the RADIUS client
4. Click on Create .
5. After configuring IDENTIKEY Appliance (either via these steps or via the Basic Install configuration phase), configure your RADIUS client to send authentication request to IDENTIKEY Appliance. Information on the IP/port of the RADIUS communicator is available in the Configuration Utility (specifically, in the RADIUS tab of the Communicators menu).
6. Next, navigate to Back-end > Register RADIUS Back-End .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
115
17. Configuring RADIUS Environments
7. Enter the following data: n
Back-end server ID: An identifier for the RADIUS server n
Domain name: Master if the RADIUS server should process auth request from all domains, else a n n specific domain
Priority: Use this if you want to define multiple back-end servers for failover reasons - the one with the highest priority will be used first
Authentication IP Address: The IP address that the RADIUS server is using for authentication n n n n n n requests
Authentication port: The port that the RADIUS server is using for authentication requests
Accounting IP Address: The IP address that the RADIUS server is using for accounting requests
Accounting port: The port that the RADIUS server is using for accounting requests
Shared secret: The shared secret of the RADIUS server
Timeout: Timeout on the connection to the RADIUS server
Retries: Number of retries before abandoning attempts to send an authentication request to the
RADIUS server
8. Click on Create .
17.4. Wireless RADIUS
IDENTIKEY Appliance supports authentication over a wireless connection via the RADIUS protocol.
Image 48: Wireless RADIUS Components
17.4.1. Wireless RADIUS Terminology Used
An authentication service using wireless RADIUS has the following components: n n
Supplicant: The machine from which a wireless access request originates.
Authenticator: The machine to which the Wireless Access Point passes authentication requests.
17.4.2. Wireless Network Encryption
The Wireless Access Point must be configured to use one of the following wireless protocols:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
116
17. Configuring RADIUS Environments n n
WPA Enterprise
WPA2 Enterprise
Warning
VASCO does not recommend the use of the TKIP encryption algorithm on wireless networks due to inherent security issues. Configure your WAP(s) to use the AES algorithm.
17.4.3. Configure Wireless Access Points
Each wireless access point must be configured with the following settings:
Table 8: Required Wireless Access Point Settings
Setting Value
Encryption protocol
Encryption algorithm
RADIUS protocol
RADIUS server
Shared Secret
WAP Enterprise or WAP2 Enterprise
AES
One of the supported EAP or PEAP protocols: n n n n n n n n n n
EAP-TTLSv0/PAP
EAP-TTLSv0/CHAP
EAP-TTLSv0/MSCHAP
EAP-TTLSv0/MSCHAP2
EAP-TTLSv0/EAP-MSCHAP2
EAP-TTLSv0/EAP-GTC
PEAPv0/EAP-MSCHAP2
PEAPv0/EAP-GTC
PEAPv1/EAP-MSCHAP2
PEAPv1/EAP-GTC
Enter the IP address and the RADIUS port (default 1812) for IDENTIKEY Authentication Server .
A passphrase used to authenticate the RADIUS Client and IDENTIKEY Authentication Server to each other.
If your Wireless Access Point does not support wireless session settings from the configured RADIUS server, change the default reAuthPeriod configuration setting to the required period before a Fast Reconnect should be attempted. One hour is the recommended period.
Tip
Where possible, configure the supplicant to request authentication details for every full authentication. If this is not configured, each automatic full reconnection attempt (not fast reconnect) will cause a failed authentication.
17.4.4. IDENTIKEY Appliance Configuration for Wireless Networking
When configuring IDENTIKEY Appliance to work with wireless access points, you must first copy the
IDENTIKEY Local Authentication policy record. Then, navigate to the RADIUS tab for the policy and
IDENTIKEY Appliance 3.11.12 - Administrator Guide
117
17. Configuring RADIUS Environments set Supported protocols to Secure .
Afterwards, create a Component record for each Wireless Access Point with the following details:
Table 9: Component Record Settings for Each Wireless Access Point
Setting Value
Component Type
Location
Protocol
Shared Secret
Policy
RADIUS Client
<IP address of the Wireless Access Point>
RADIUS
<as entered in the Wireless Access Point configuration>
If this is the only Wireless Access Point in use, link to the policy created above.
If this will NOT be the only Wireless Access Point in use, refer to for further instructions.
17.4.5. Multiple Wireless Access Points
If multiple Wireless Access Points are in use, you have the option of allowing roaming connections between Wireless Access Points.
The ability of a supplicant to perform a Fast Reconnect with IDENTIKEY Appliance, and roam between Wireless
Access Points, depends on two factors: n n
SSID: If a Wireless Access Point's SSID is identical to that of the Wireless Access Point with which the current session was created, the supplicant will be able to attempt a Fast Reconnect.
Policy: If the Component record for the Wireless Access Point passing on a Fast Reconnect request has the same policy record as the component record for the Wireless Access Point with which the current session was created, IDENTIKEY Appliance will process the Fast Reconnect request.
No roaming Wireless Connections
Having no roaming wireless connections means that a user will be required to perform a full authentication if moving to a new Wireless Access Point. To configure the system this way, set each Wireless Access Point's
SSID to a different value.
Allow roaming Wireless Connections
Where roaming connections will be in use, assign the same SSID to all Wireless Access Points in each zone.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
118
17. Configuring RADIUS Environments
Table 10: Policy and Component Record Details when allowing roaming Wireless Connections
Scenario Record Details
Roaming connections, one zone
Roaming connections, multiple zones
Policy Records
Component Records
Policy Record
Component Records
Create one policy record only.
Link all component records to the policy created earlier.
Create a policy record with the required settings, and copy it to new policy records until you have the same number of policies as roaming zones needed.
Assign each policy to a wireless roaming zone.
Component records for each Wireless Access Point in a roaming zone should be assigned to the same policy.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
119
17. Configuring RADIUS Environments
IDENTIKEY Appliance 3.11.12 - Administrator Guide
120
17. Configuring RADIUS Environments
17.5. Customizing the RADIUS Attributes Dictionary
A RADIUS attributes dictionary is available to use with IDENTIKEY Appliance, to assign RADIUS attributes to users and groups of users. A default dictionary is supplied, but this may be replaced with a custom dictionary. Attributes may be added, modified or removed by editing the dictionary file.
Procedure 62: Uploading a custom RADIUS dictionary
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Authentication Server > Radius Communicator .
3. Select Enable RADIUS Communicator .
4. In the RADIUS Dictionary File section, click Browse and specify the custom dictionary file.
5. Click Save .
Image 49: Uploading a Custom RADIUS Dictionary
Note
The default dictionary remains available for download even after uploading a custom dictionary.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
121
17. Configuring RADIUS Environments
For more information about the format for custom dictionaries, refer to the IDENTIKEY Appliance Administrator
Reference .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
122
18. IDENTIKEY Authentication Server Discovery
18. IDENTIKEY Authentication Server Discovery
Server Discovery is a feature which allows DIGIPASS Authentication for Windows Logon clients to find an IDENTIKEY
Authentication Server by querying a DNS server.
In order for Server Discovery to work, these conditions must exist: n n n
The DIGIPASS Windows Logon client must have Server Discovery enabled
An SRV record for the IDENTIKEY Authentication Server(s) must exist on the DNS server to be queried – see
18.1. Registering IDENTIKEY Appliance with DNS Server
for instructions.
Windows Logon must be enabled both in the IDENTIKEY Authentication Server license key and the authentication scenario. For more information, refer to the Licensing section in the IDENTIKEY ApplianceProduct
Guide .
Procedure 63: Enabling Server Discovery in DIGIPASS Windows Logon
This feature is enabled by default in DIGIPASS Windows Logon. To enable it manually on a specific Windows client machine:
1. Open the Windows Registry Editor.
2. Go to HKEY_LOCAL_MACHINE > SOFTWARE > VASCO Data Security > Client Module .
3. Right-click on the DNS Enabled setting and select Modify .
4. Change the value to
1
.
18.1. Registering IDENTIKEY Appliance with DNS Server
An SRV record may be created on the DNS server using the DNS registration option in the IDENTIKEY Authentication
Server configuration stage (i.e. after installation). For more information, see
18.2. Server Discovery
.
Note
If an IDENTIKEY Authentication Server will be available to client machines in other trusted Active Directory domains, an SRV record must be manually created on the DNS server(s) that service(s) the client domain .
18.2. Server Discovery
Registering IDENTIKEY Authentication Server with a DNS server allows DIGIPASS Windows Logon clients to discover a local instance of IDENTIKEY Authentication Server.
The following two DNS service registration options are available: n n
No authentication type
TSIG as the authentication type
IDENTIKEY Appliance 3.11.12 - Administrator Guide
123
18. IDENTIKEY Authentication Server Discovery
Procedure 64: Registering DNS service without authentication type
For the DNS service registration with a DNS server supporting dynamic DNS anonymously, the authentication type needs to be set to None . Use this method if your DNS Server(s) do not require authentication or SSL for adding SRV records.
1. Select the DNS service registration with a DNS server supporting dynamic DNS option.
2. Enter the name of the DNS domain.
3. Select the priority for connections to the IDENTIKEY Authentication Server - primary or backup server.
Image 50: Configuration Tool IDENTIKEY Authentication Server Discovery without Authentication Type
Procedure 65: Registering DNS service with TSIG as the authentication type
For the DNS service registration with a DNS server supporting dynamic DNS with TSIG authentication, the authentication type needs to be set to TSIG . This service registration method utilizes a shared key file which is shared between IDENTIKEY Authentication Server, the DNS, and the application. Transactions are signed using the shared key file. Use this method if your DNS Server(s) are configured to accept TSIG-authenticated changes only:
1. Select the DNS service registration with a DNS server supporting dynamic DNS with TSIG authentication option.
2. Enter the full path and file name for the shared key file.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
124
18. IDENTIKEY Authentication Server Discovery
3. Enter the name of the DNS domain.
4. Select the priority for connections to the IDENTIKEY Authentication Server - primary or backup server.
Image 51: Configuration Tool IDENTIKEY Authentication Server Discovery with TSIG as Authentication
Type
Warning
Active Directory DNS server does not support dynamic DNS with TSIG authentication: the anonymous option must be used. For instructions on how to configure this, refer to the Active Directory documentation.
Note
If two or more instances of IDENTIKEY Authentication Server are registered with the DNS server and given the same priority, the first available SRV record will be the one used by the DIGIPASS Windows Logon client.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
125
19. Test Policy Settings
19. Test Policy Settings
In this section we provide instructions to test policy settings using a RADIUS Client Simulator for: n n
Local and back-end authentication
DIGIPASS assignment options
To complete these tests, you will need to:
1. Download the RADIUS Client Simulator from the delivery package of IDENTIKEY Appliance.
2. Install the RADIUS Client Simulator on a machine which you will use with IDENTIKEY Appliance to create and configure settings, and test them.
At various points in the process, test logins are recommended to ensure that the previous steps have not caused unexpected problems. This also helps in troubleshooting, as it helps to pinpoint at which step of the process a problem occurred.
19.1. Basic Testing Procedure - Prerequisites and Configurations
The following steps are part of the basic testing procedure and illustrate it:
1. Test direct logins to IDENTIKEY Appliance.
2. Test back-end authentication via IDENTIKEY Appliance.
3. Test management features.
Before testing is possible, a DIGIPASS user account must be created (refer to Section
4.3. User Records
for information how to create such a user account) , for which the following configurations are necessary: n n n n n
A corresponding Windows user account.
A stored static password which is the same as the password for the Windows account.
A DIGIPASS authenticator or Demo DIGIPASS with Response-Only and Challenge/Response applications, assigned to the DIGIPASS user account. Demo DIGIPASS records need to be imported and assigned to the account, as explained in Section
4.4. DIGIPASS Records and Assignment
. The .dpx
files of the Demo
DIGIPASS are part of the delivery package of IDENTIKEY Appliance.
A RADIUS Client Component need to be registered in IDENTIKEY Appliance, as explained in Section
4.1. Client Component Records .
A test policy needs to be created as explained in Section
19.1.1. Create a Test Policy .
19.1.1. Create a Test Policy
Complete the following procedure to create the required test policy.
Procedure 66: Creating a test policy
1. Launch the Administration Web Interface.
2. Navigate to Policies > Create .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
126
19. Test Policy Settings
3. Enter the required information: a. Policy ID: Test b. Inherits from: Identikey Local Authentication
4. Enter a description if desired.
5. Click on Create .
19.1.2. Set Up Client Record
Configure the default RADIUS client record to use the test policy created in
19.1.1. Create a Test Policy
. The
RADIUS Client Simulator will use this component record.
Note
The shared secret for the default RADIUS client record and the RADIUS Client Simulator are set to default.
19.1.3. Modifying the Test Policy
Each scenario will require modification of the test policy created in
19.1.1. Create a Test Policy . Use these instruc-
tions to edit the test policy:
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Policies > List .
3. Find and click the test policy.
4. Click the required tab: a.
Local Authentication and back-end authentication settings can be found under the Policy tab b.
Dynamic User Registration , Password Autolearn , and Stored Password Proxy settings can be found under the User tab.
c.
Application Type , Assignment Mode , Grace Period , Serial No. Separator , and Search Upwards in
Org. Unit Hierarchy settings can be found under the DIGIPASS tab.
d.
Challenge/Response settings can be found under the Challenge tab.
5. Click Edit .
6. Make the required changes.
7. Click Save .
19.1.4. Testing a Login via the RADIUS Client Simulator
In each scenario, you will need to attempt a login, using the RADIUS Client Simulator. Once it is configured correctly, simply follow the directions below to try a login:
1. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window.
2. Enter the ID for the user account you are using for test logins in the user ID field.
3. Enter the password for the user account and (if required) a one-time password from the
DIGIPASS authenticator in the Password field.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
127
19. Test Policy Settings
4. Click on the Login button.
The Status information field will indicate the success or failure of your login.
19.2. Test Local Authentication
This topic covers testing logins handled by IDENTIKEY Appliance with no back-end authentication enabled. Three login methods will be covered: n n n
Static password (does not require a DIGIPASS authenticator)
Response-Only (requires a DIGIPASS authenticator with a Response-Only application)
Challenge/Response (requires a DIGIPASS authenticator with a Challenge/Response application)
19.2.1. Static Password
Modify Test Policy
Make these changes to the test policy (see
19.1.3. Modifying the Test Policy
for instructions): n n n
Set Local Authentication to DIGIPASS/Password during Grace Period .
Set Back-End Authentication to None .
Set Password Autolearn to Yes .
Check Grace Period
Check the record for the DIGIPASS authenticator being used for testing. The grace period should be set for a time in the future. If it is not, the static password login will fail.
Test Login
Run a test login using the RADIUS Client Simulator (see
19.1.4. Testing a Login via the RADIUS Client Simulator
for instructions), using the user ID and static stored password.
19.2.2. Response-Only
Modify Test Policy
Make these changes to the test policy (see
19.1.3. Modifying the Test Policy
for instructions): n n n
Set Application Type to Response-Only .
Set Local Authentication to DIGIPASS/Password during Grace Period .
Set Back-End Authentication to None .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
128
19. Test Policy Settings
Test Login
Run a test login using the RADIUS Client Simulator (see
19.1.4. Testing a Login via the RADIUS Client Simulator
for instructions), using the DIGIPASS user ID and the one-time password from your DIGIPASS authenticator.
19.2.3. Challenge/Response
Modify Test Policy
Make these changes to the test policy (see
19.1.3. Modifying the Test Policy
for instructions): n n n n n
Set Application Type to Challenge/Response .
Set 2-Step Challenge/Response Request Method to Keyword .
Set Keyword to 2StepCR .
Set Local Authentication to DIGIPASS/Password during Grace Period .
Set Back-End Authentication to None .
Test Login
Run a test login using the VASCORADIUS Client Simulator (VRADSIM; see
19.1.4. Testing a Login via the RADIUS Client Simulator
for instructions), using the DIGIPASS user ID and the keyword (2StepCR). Enter the challenge provided by the VRADSIM into your DIGIPASS authenticator. Enter the same DIGIPASS user ID and the response provided by your DIGIPASS authenticator.
19.3. Test RADIUS Back-End Authentication
In this topic, you will be guided through configuring the IDENTIKEY Authentication Server to use a RADIUS back-end server, and testing back-end authentication using that back-end server.
19.3.1. Set up Back-End RADIUS Server
There are some steps you will need to follow in order to set up the RADIUS Server to be used for back-end authentication:
Requirements
To complete the recommended steps, you will need: n n
An installed RADIUS server.
An administrator login for the RADIUS server.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
129
19. Test Policy Settings
Create RADIUS client records
Create a RADIUS client record within the RADIUS server for the machine on which the RADIUS Client Simulator will be running and the machine on which IDENTIKEY Appliance is installed. Without this RADIUS client record, requests from the RADIUS Client Simulator will be rejected.
You will also need to create a RADIUS client record for the machine on which IDENTIKEY Authentication Server is running. Without this RADIUS client record, proxied requests from IDENTIKEY Authentication Server will be rejected
Create a user account
Create a user account in the RADIUS server, or identify an existing account that can be used, if preferred.
Make sure this account has the necessary permissions so that a RADIUS access-request from both the
RADIUS Client Simulator and from IDENTIKEY Appliance will be accepted (given the correct password has been provided). Also, make sure this account has some RADIUS reply attributes .
Enable Tracing
Depending on the RADIUS server product, some facilities will be available for tracing. This may be referred to as logging or debugging instead. If this is enabled, it will help to find out what is happening if the observed behavior is not as expected.
19.3.2. Test Direct Login to RADIUS Server
Once the RADIUS server has been set up, attempt a direct login using the RADIUS Client Simulator and the DIGIPASS user account created for testing.
Procedure 67: Testing directly logging on the RADIUS server
1. Open the RADIUS Client Simulator.
2. Enter the IP address of the RADIUS server.
3. Enter the Authentication and Accounting port numbers if they vary from the default.
4. Enter the Shared Secret that was configured in the RADIUS client record in the RADIUS server for IDENTIKEY
Appliance.
5. Select a Protocol to use.
6. Click on any port icon to attempt a login.
7. Enter the user ID and password and click on Login .
8. The reply attributes set up for that user account should be displayed in the RADIUS Client Simulator.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
130
19. Test Policy Settings
19.3.3. Configure IDENTIKEY Appliance for RADIUS Back-End Authentication
19.3.3.1. Local and Back-End Authentication
Local and back-end authentication means that both IDENTIKEY Appliance and the RADIUS server will authenticate a login. This allows RADIUS reply attributes to be retrieved from the RADIUS server.
In this scenario, the Password Autolearn and Stored Password Proxy features are used. With these features enabled, IDENTIKEY Appliance will learn the user's RADIUS server password, so that the user does not need to log in with both their password and DIGIPASS one-time password (OTP) at each login. However, the first time that the user logs in, they will need to provide their RADIUS server password so that IDENTIKEY Appliance can learn it. In subsequent logins, the user can just log in with their OTP, and IDENTIKEY Appliance will send the stored password to the RADIUS server.
Modify Test Policy
Make these changes to the test policy (see
19.1.3. Modifying the Test Policy
for instructions): n n n n n
Set Local Authentication to DIGIPASS/Password during Grace Period .
Set Back-End Authentication to Always .
Set Back-End Protocol to RADIUS .
Set Password Autolearn to Yes .
Set Stored Password Proxy to Yes .
19.3.3.2. Create Back-End Server Record
IDENTIKEY Appliance needs to be able to locate the RADIUS server. This requires a back-end server record in the data store. To create a new back-end server record:
Procedure 68: Create new back-end server record
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Back-End > Register RADIUS Back-End .
3. Enter a display name for the back-end server in the Back-End Server ID field.
4. Enter the Authentication and Accounting IP Address and Port values.
5. Enter the Shared Secret that was configured in the RADIUS client record in the RADIUS server for IDENTIKEY
Appliance.
6. Enter suitable Timeout and No. of Retries values.
7. Click Create to create the record.
19.3.4. Test Logins with Local and Back-End Authentication
1. Configure the test policy for the login method to be tested – i.e. Response-Only, Challenge/Response.
2. Ensure that the RADIUS Client Simulator client record is using the configured policy.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
131
19. Test Policy Settings
3. In the RADIUS Client Simulator : a. Enter the IP address of IDENTIKEY Appliance.
b. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window.
c. Enter the user ID for the user account you are using for test logins in the User ID field.
d. Enter the user account's RADIUS server password followed by an OTP from the
DIGIPASS authenticator in the Password field. There should be no spaces between the password and the OTP.
e. Click on the Login button.
The Status information field will indicate the success or failure of your logon. Below that you should see the RADIUS reply attributes from the RADIUS server.
f. Enter a new OTP from the DIGIPASS authenticator into the Password field, without the RADIUS server password as the first digits.
g. Click on the Login button.
The Status information field will indicate the success or failure of your logon. Below that you should see the RADIUS reply attributes from the RADIUS server.
19.4. Test Management Features
In this topic, you will be guided through the testing of basic management features in IDENTIKEY Appliance.
19.4.1. Auto-Assignment
Initial Setup
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Clients > List .
3. Click on the client record for the RADIUS Client Simulator.
4. Ensure that the Test Policy is selected in the Policy drop down list.
5. Click on OK .
6. Make these changes to the test policy (see
19.1.3. Modifying the Test Policy
for instructions): n
Set Local Authentication to DIGIPASS/Password during Grace Period .
n n n n
Set Back-End Authentication to Always .
Set Back-End Protocol to RADIUS .
Set Password Auto-learn to Yes .
Set Stored Password Proxy to Yes .
n n n n n
Set Dynamic User Registration to No .
Set Assignment Mode to Neither .
Set Grace Period (days) – 7 days is the standard time period used.
Set Search Upwards in Org. Unit Hierarchy to Yes .
Set Application Type to No Restriction .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
132
19. Test Policy Settings
7. Create or use a user account in the RADIUS server which does not currently have a corresponding DIGIPASS user account.
8. Check that at least one unassigned DIGIPASS authenticator is available in the DIGIPASS Container.
Test Auto-Assignment - 1
In the following test, both Dynamic User Registration and Auto-Assignment should fail, meaning that no DIGIPASS user account will be created, and no DIGIPASS authenticator will be assigned to the user. This shows that the
IDENTIKEY Authentication Server record has been configured successfully.
In the RADIUS Client Simulator:
9. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window.
10. Enter the user ID for the RADIUS server user account you created earlier (refer to
19.4.1. Auto-Assignment
) in the User ID field.
11. Enter the password for the RADIUS server user account.
12. Click on the Login button.
The Status information field will indicate the success or failure of your logon.
Check Test Results
To check whether a DIGIPASS user account has been created, search for the user account record in the Administration Web Interface.
If it does not exist, the test has been successful.
Modify Settings
Make these changes to the test policy (refer to
19.1.3. Modifying the Test Policy
for instructions):
13. Set Dynamic User Registration to Yes.
14. Set Assignment Mode to Auto-Assignment.
Test Auto-Assignment - 2
In the following test, both Dynamic User Registration and Auto-Assignment should succeed, meaning that a
DIGIPASS user account will be created, and an available DIGIPASS authenticator will be assigned to the user.
In the RADIUS Client Simulator:
15. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window.
16. Enter the user ID for the RADIUS server user account you created earlier (refer to
19.4.1. Auto-Assignment
) in the User ID field.
17. Enter the password for the user account.
18. Click on the Login button.
The Status information field will indicate the success or failure of your logon.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
133
19. Test Policy Settings
Check Test Results
To check whether a DIGIPASS user account has been created, search for the user account record in the Administration Web Interface.
To check whether a DIGIPASS authenticator has been assigned to the user:
19. Click on Assigned DIGIPASS .
20. If a DIGIPASS authenticator is listed, the user has been assigned the listed authenticator.
21. Check the grace period end field to see that a grace period of the correct length ( 7 days by default) has been set.
Check Grace Period
22. Password login: Using the RADIUS Client Simulator, attempt a login using the RADIUS server user's ID and password only. If the grace period is still effective, this should be successful.
23. OTP login: Using the RADIUS Client Simulator, attempt a login using the RADIUS Server user's ID and onetime password (OTP). This should be successful.
24. Password login: Using the RADIUS Client Simulator, attempt a login using the RADIUS Server user's ID and password only. As the OTP login from the previous step should have ended the grace period for the
DIGIPASS authenticator, this login should fail.
25. Check the grace period end in the user record. It should contain today's date.
19.4.2. Self-Assignment
To complete this test, you will need to have a DIGIPASS authenticator physically available, and free to be assigned to a test user account.
Initial Setup
1. Make these changes to the test policy (see
19.1.3. Modifying the Test Policy
for instructions): n
Set Dynamic User Registration to No .
n n
Set Assignment Mode to Neither .
Set Search Upwards in Org. Unit Hierarchy to Yes .
n
Set Serial No. Separator to : (colon).
2. Create or use a user account in the RADIUS Server which does not currently have a corresponding
DIGIPASS user account.
3. Check that the desired DIGIPASS authenticator is in the DIGIPASS Container and unassigned.
Test Self-Assignment - 1
In the following test, both Dynamic User Registration and Self-Assignment should fail, meaning that a DIGIPASS user account will not be created, and the selected DIGIPASS authenticator will not be assigned to the user.
In the RADIUS Client Simulator:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
134
19. Test Policy Settings
4. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window.
5. Enter the user ID for the RADIUS server user account you created earlier (refer to
Initial Setup
) in the User ID field.
6. Enter the serial number for the DIGIPASS authenticator, the separator, the RADIUS server user's password, a Server PIN (if required) and a one-time password from the authenticator into the Password field, e.g.
98765432-password12340098787
(see the Login Permutations topic in the IDENTIKEY
Authentication Server Administrator Reference for more information).
7. Click on the Login button.
The Status information field will indicate the success or failure of your logon.
Check Test Results
A successful test should result in a failed login and no new DIGIPASS user account created. To check whether a
DIGIPASS user account has been created, search for the user account record in the Administration Web Interface.
Modify Settings
8. Make these changes to the test policy: n n
Set Dynamic User Registration to Yes .
Set Assignment Mode to Self-Assignment .
Test Self-Assignment - 2
In the following test, both Dynamic User Registration and Self-Assignment should succeed , meaning that a
DIGIPASS user account will be created, and the intended DIGIPASS authenticator will be assigned to the user.
In the RADIUS Client Simulator:
9. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window.
10. Enter the user ID for the RADIUS server user account you created earlier (refer to
Initial Setup
in the User ID field.
11. Enter the serial number for the DIGIPASS authenticator, the separator, the RADIUS server user's password, a Server PIN (if required) and a one-time password from the DIGIPASS into the Password field, e. g.
98765432- password12340098787
(see the Login Permutations topic in the IDENTIKEY
Authentication Server Administrator Reference for more information).
12. Click on the Login button.
The Status information field will indicate the success or failure of your logon.
Check Test Results
To check whether a DIGIPASS user account has been created, search for the user account record in the Administration Web Interface.
To check whether the DIGIPASS authenticator has been assigned to the user:
13. Click on DIGIPASS Assignment .
14. If the authenticator is listed under this tab, it has been assigned to the DIGIPASS user account.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
135
19. Test Policy Settings
Check Grace Period
15. Check that a grace period has not been set.
Password login
16. Using the RADIUS Client Simulator, attempt a login using the RADIUS server user's ID and password only.
This should fail, as a grace period is not set for self-assignment.
OTP login
17. Using the RADIUS Client Simulator, attempt a login using the RADIUS server user's ID and one-time password. This should be successful.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
136
20. Administration Tasks
20. Administration Tasks
20.1. Scheduled Task Management
Certain tasks can be scheduled. Use the following information to manage these scheduled tasks.
To view a list of scheduled tasks, mouse-over the Servers tab in the IDENTIKEY Authentication Server Administration Web Interface and select Task Management from the drop-down list. A full list of scheduled tasks is displayed.
From this page you can edit, run or delete the task by clicking the appropriate button.
20.2. Changing Task Schedules
Procedure 69: To edit a task
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Servers > Task Management .
3. Navigate to Tasks > LIST .
A full list of available tasks is displayed.
4. Click the desired task name.
The Task Definition tab is displayed.
5. Do one of the following: n
If you wish to edit the information in this tab, click Edit . Fields in the task definition tab will n become available for editing.
Alternatively, if you wish to edit field, query, permissions or template data, click the appropriate tab and then click Edit .
6. When you have finished editing data in each tab, click Save .
20.3. Deleting Scheduled Tasks
Procedure 70: To delete an existing task
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Navigate to Servers > Task Management .
3. A full list of available tasks is displayed. Either: n
Select the check box beside the task and click the Delete button at the bottom of the page, or n
Click on the desired task name and then click the Delete button.
4. A confirmation window appears. Click OK to delete the task.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
137
21. Monitoring
21. Monitoring
21.1. Overview
The Log File Management screen in the IDENTIKEY Appliance Configuration Tool provides an overview (explained in Section
21.2. Disk Use
) of disk use by monitoring information generated and stored on IDENTIKEY Appliance.
Three sources of information are available: n n n
Logging: if you encounter a problem with the Configuration Tool, you need to search the logging information. Logged events are presented in a live viewer. We explain how to manage and use log files in Section
21.3. Logging .
Auditing: if you encounter a problem with any actions in the IDENTIKEY Authentication Server Administration Web Interface, or with IDENTIKEY Authentication Server services such as authentication, you need to search the Audit files. Audit records are presented in a live viewer. We explain how to manage and use
Audit files in Section
21.4. Auditing .
Tracing: if you are unable to identify the problem from information provided from Auditing or Logging, you can also use Tracing. Tracing information can be viewed in a text editor, as explained in Section
21.5. Tracing .
For more information on the concepts of logging, auditing and tracing, please refer to the IDENTIKEY Appliance
Product Guide .
In addition to monitoring IDENTIKEY Appliance, it is also possible to enable the Secure Network Management Protocol (SNMP), which is a protocol used in network management systems to monitor devices on the network which may need attention. SNMP thus allows IDENTIKEY Appliance to be monitored by a managing application. How to configure SNMP is explained in section
21.6. Configuring SNMP
.
21.2. Disk Use
For an overview of the disk space used for the three types of monitoring, navigate to Monitoring > Log File Management . The top part of the Log File Management screen shows the disk space used for storage of the three types of data (see image below).
To view n n the number and sizes of audit database parts: select the Databases row (see image below).
the number and sizes of trace files: select the Trace Files row.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
138
n the number and sizes of log files: select the System Logs row.
21. Monitoring
Image 52: IDENTIKEY ApplianceConfiguration Tool Disk Use Overview
Note
Disk space used for a data source, and the combined sizes of database parts, log files, or trace file sizes do not necessarily match due to additional space being used for disk partition.
21.3. Logging
Logging uses information generated about events in the IDENTIKEY Appliance Configuration Tool and includes information about operations such as updating, backup and restore. For example, a log entry might be:
Backup was created successfully
.
Logging is based on the syslog utility which supports local and remote storage and processing of logs. Settings can be configured in the Configuration Tool manually or using the Configuration Wizard ).
Logged events are accumulated in a file to a maximum of 80,000 lines; after this threshold is reached, a new file is opened. A certain number of files are archived, but rotation means that the oldest file is replaced by the latest file.
Log files are therefore automatically cleaned.
Log data can also be sent to a remote syslog-compliant server.
In this section we provide instructions on: n n n n
Configuring logging (see
Procedure 71: Configuring the type of logging
)
Configuring remote logging (see
Procedure 72: Configuring remote logging
Viewing and filtering files in the live log viewer (see
Procedure 73: Viewing and filtering log files
)
Downloading and deleting log files (see
Procedure 74: Downloading and deleting log files
)
IDENTIKEY Appliance 3.11.12 - Administrator Guide
139
21. Monitoring
21.3.1. Configuring Logging
Procedure 71: Configuring the type of logging
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Settings > Logging .
3. Click on the arrow icon to view the drop-down list of Log levels to select the required level (refer to the
IDENTIKEY Appliance Administrator Reference ).
4. Click Save to finish.
Image 53: Configuring Logging
Procedure 72: Configuring remote logging
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Settings > Logging (see
Image 54: Configuring Remote Logging
) and enter the IP address of the syslog-compliant server for viewing log data remotely. Multiple IP addresses can be entered in a comma-separated list.
3. Click on the arrow icon to view the different levels of logging. For an explanation of these levels , refer to the IDENTIKEY Appliance Administrator Reference Guide.
4. Click Save to finish.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
140
21. Monitoring
Image 54: Configuring Remote Logging
For more information about the relevant fields, refer to the IDENTIKEY Appliance Administrator Reference .
21.3.2. Managing Log Files
A live log viewer in the IDENTIKEY Appliance Configuration Tool allows monitoring of Configuration Tool events.
Live log views can be filtered using log levels and / or words ).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
141
21. Monitoring
Image 55: Live Log Viewer
Procedure 73: Viewing and filtering log files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Monitoring> System Logs .
Image 56: Viewing Logs
IDENTIKEY Appliance 3.11.12 - Administrator Guide
142
21. Monitoring
3. Filtering is possible by using simple or advanced filters.
n
To use the simple filter, enter in the Filter field the characters to be searched for in the message part of the log (e.g.
start
in
Image 57: Simple Log Filter Entry and Result
). Only lines with content matching the filter field entry will be listed (see result in the lower part of Image 3: Simple Log Filter Entry and Result ).To clear the filter, click X .
Image 57: Simple Log Filter Entry and Result n
To use the advanced filter, click on the arrow (highlighted in the image below) to the right of the
Filter field to open the Advanced Filter dialog (see
Image 59: Advanced Log Filter Fields
). Refer to
Table 11: Log Filter Fields
for an explanation of how to search using any of the filter fields.
Image 58: Using the Advanced Filter
IDENTIKEY Appliance 3.11.12 - Administrator Guide
143
21. Monitoring
Image 59: Advanced Log Filter Fields
Table 11: Log Filter Fields
Type Description
Start
Date
Click on the icon to select a date from the calendar. Only records after the date specified are displayed.
End Date Click on the icon to select a date from the calendar. Records up to and including the entered date are displayed.
Facility is Click on the drop down menu to select one of the facility types, e.g.
kern , user , or mail . Only logs referencing this facility are displayed.
Level at least
Program contains
Click on the drop down menu to select one of the levels, e.g.
error or warning . Only logs referencing this level are displayed. For a list of the log levels, please refer to the IDENTIKEY Appliance Administrator Reference .
Enter a search string. Only records with a program matching the search string are displayed.
Process
ID
Message contains
Enter the process ID to use as a filter parameter for your search.
Enter a search string. Only records with a message matching the search string are displayed.
Note
It is only possible to access the Advanced Filter when the Simple Filter is clear. To clear the simple filter, click on the X icon by the Filter field.
Procedure 74: Downloading and deleting log files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Monitoring> Log File Management and click on System Logs . Available log files will be listed below.
3. Click on the disk icon to the right of an available log file to download it or the trash can icon to delete it
(see
Image 60: Downloading System Log Files ).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
144
21. Monitoring
Image 60: Downloading System Log Files
Note
Clicking on the trash can to delete the log file will also delete all older log files.
21.4. Auditing
Auditing uses information generated about events in the IDENTIKEY Authentication Server , LDAP Synchronization and Configuration Tool components as well as system and user actions. Auditing can be managed via the
IDENTIKEY Appliance Configuration Tool using the live audit viewer ). It happens in real-time, allowing administrators to view a limited number of recent events and includes amongst others, information about administration events, authentication attempts and RADIUS accounting. For example, an event might be:
User successfully authenticated
.
Note
Auditing information also includes RADIUS accounting data.
Audit records are accumulated to a database part for one month or to a maximum of 500 MB, whichever limit is reached first. IDENTIKEY Appliance detects when audit data is using too much hard disk space and automatically cleans the oldest information.
In this section we provide instructions on: n n n n
Overview of IDENTIKEY Authentication Server audit settings
Viewing, filtering and exporting files in the live Audit Viewer (see
Procedure 75: Viewing and filtering audit files )
Exporting audit files (see
Procedure 76: Exporting audit files )
downloading and deleting audit files (see
Procedure 77: Downloading and deleting audit files
)
IDENTIKEY Appliance 3.11.12 - Administrator Guide
145
21. Monitoring
21.4.1. Audit Settings
To configure the settings for auditing IDENTIKEY Authentication Server, navigate to Authentication Server > Audit
Settings in the IDENTIKEY Appliance Configuration Tool.
Via the IDENTIKEY Authentication Server audit settings, you can: n n n n
Specify which message type is sent to the syslog
Enable the Remote Audit Viewer and its associated settings
Enable SSL connections for the Audit Viewer, select the level of the used SSL cipher suite, download a server certificate and set a password for the certificate
Configure the verification Certificate Authority certificate file for the SSL client certificate and associated settings.
Image 61: Configuring IDENTIKEY Authentication Server Audit Settings in the Configuration Tool
The following sections outline the audit settings for IDENTIKEY Authentication Server in the IDENTIKEY Appliance
Configuration Tool. For a detailed description of these fields, refer to the section on Configuration Tool field listings in the IDENTIKEY Appliance Administrator Reference .
21.4.1.1. Send Audit Messages to Syslog Settings
Here you can select the message types that are to be sent to the syslog. Available message types are:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
146
21. Monitoring n n n n n
Error
Warning
Info
Success
Failure
For a detailed description of the audit message types, refer to the IDENTIKEY Appliance Product Guide .
21.4.1.2. Remote Audit Viewer Settings
Here you can enable the remote Audit Viewer and configure the following settings: n n n
Set the maximum number of Audit Viewer clients connected to IDENTIKEY Authentication Server at the same time
Set the maximum period of time in seconds until an authentication times out
Select the types of audit messages to be sent
For a detailed description of the audit message types, refer to the IDENTIKEY Appliance Product Guide .
Note
If you wish to secure the audit connection with SSL you can do so by enabling SSL connections for the Audit
Viewer. This means that your browser will use an SSL-secured connection (i.e. via HTTPS).
21.4.1.3. SSL Cipher Suite Security Level settings
Select the required cipher suite security level for the Audit Viewer here. IDENTIKEY Authentication Server supports
SSL cipher suites defined under the security levels Very High , High, Medium , and Low . For more information, refer to the section on SSL Cipher Suites in the IDENTIKEY Appliance Administrator Reference .
21.4.1.4. Server Certificate
Here you can select a valid certificate previously created / imported using the Certificate Management tab (see
13.2. Using Server Certificates ).
21.4.1.5. Client Certificate Verification Settings
You can configure the following here: n n n
Set IDENTIKEY Authentication Server to require a client certificate whenever a client attempts a connection.
Select the CA certificate used to authenticate the clients from all valid and trusted CA certificates imported using the Certificate Management tab (see
13.3. Using CA Certificates for Client Verification ).
Configure IDENTIKEY Authentication Server to perform an SSL handshake each time the Audit Viewer is reconnected to IDENTIKEY Authentication Server. Enabling this option may incur a performance penalty, thus this option should only be enabled if absolutely necessary.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
147
21. Monitoring
21.4.2. Managing Audit Files
Individual audit records can be viewed in the live audit viewer (see
Image 62: Live Audit Viewer
), filtered, and exported (see
Procedure 76: Exporting audit files ) in the IDENTIKEY Appliance Configuration Tool.
Events generated by the IDENTIKEY Authentication Server component for auditing are stored in the internal database and moved to an audit database on a monthly basis or until a maximum audit data size of 500 MB is reached.
When this limit is exceeded, new audit data is stored in a new database part.
Parts of the database can be downloaded and deleted via the IDENTIKEY Appliance Configuration Tool. Downloading is the same as the exporting, but uses a format compatible with IDENTIKEY Authentication Server (see
Procedure 76: Exporting audit files
) ).
For more information, refer to the IDENTIKEY Appliance Administrator Guide .
Image 62: Live Audit Viewer
Procedure 75: Viewing and filtering audit files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Monitoring > Audit Logs .
Image 63: Viewing the Live Audit Viewer
IDENTIKEY Appliance 3.11.12 - Administrator Guide
148
21. Monitoring
3. Filtering is possible by using simple or advanced filters.
n
To use the simple filter, enter in the Filter field the characters to be searched for in the message part of the audit information (e.g.
SOAP
in
Image 64: Simple Audit Filter Entry and Result
). Only lines with content matching the filter field entry will be listed (see result in the lower part of
Image
64: Simple Audit Filter Entry and Result ). To clear the filter, click
X .
n
Image 64: Simple Audit Filter Entry and Result
To use the advanced filter, click on the arrow (highlighted in the image below) to the right of the
Filter field to open the Advanced Filter dialog (see
21.4.2. Managing Audit Files ). Refer to 21.4.2.
Managing Audit Files
for an explanation of how to search using any of the filter fields.
Image 65: Using the Advanced Filter
IDENTIKEY Appliance 3.11.12 - Administrator Guide
149
21. Monitoring
Image 66: Advanced Audit Filter Fields
Table 12: Audit Filter Fields
Type Description
Start Date Click on the icon to select a date from the calendar. Only records after the date specified are displayed.
End Date Click on the icon to select a date from the calendar. Records up to and including the entered date are displayed.
Type is
Category contains
Code contains
Click on the drop down menu to select one of the message types described in Section
21.4.1.1. Send Audit
Messages to Syslog Settings . Only records referencing this message type are displayed.
Source contains
Searching on this field is only relevant if you have a replication setup (see section
12.1. Replication Wizard ).
Enter the name of the relevant instance of IDENTIKEY Authentication Server. Only records generated from this server are displayed.
Enter a category type, e.g.
codes, refer to the
Administration
egory entered in this field are displayed.
or
Authentication
. Only records with a category matching the cat-
Enter an error code. Only records with a matching error code are displayed. For a list of possible error
IDENTIKEY Appliance Administrator Reference .
Enter an IP address. Only records with a matching IP address are displayed.
Host contains
Hostname contains
Enter a host name. Only records with a matching host name are displayed.
Description contains
Field .....contains
Enter a string. Only records with a matching string in the Description field are displayed.
Click on the drop down menu to select a field. All possible fields which can be searched on are listed. Select a field, and enter the matching string to be searched for. Only matching records are displayed.
Note
It is only possible to access the Advanced Filter when the Simple Filter is clear. To clear the simple filter, click on
IDENTIKEY Appliance 3.11.12 - Administrator Guide
150
21. Monitoring the X icon by the Filter field.
Procedure 76: Exporting audit files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Naviagte to Monitoring > Audit Logs .
3. Click on
Export
(see highlighted field in
Image 67: Exporting from the Audit Viewer
); a dialog opens (see
Image 68: Exporting Audit Files
). Fields are explained in
Table 13: Audit Export Fields
.
Image 67: Exporting from the Audit Viewer
Image 68: Exporting Audit Files
IDENTIKEY Appliance 3.11.12 - Administrator Guide
151
21. Monitoring
Table 13: Audit Export Fields
Start date
End date
Source
Category
Type
Host
Output Format
Description
Click on the icon to select a date from the calendar. Only records after the date specified are displayed.
Click on the icon to select a date from the calendar. Records up to and including the entered date are displayed.
Searching on this field is only relevant if you have a replication setup (see section
12.1. Replication Wizard ).
Enter the name of the relevant IDENTIKEY Authentication Server. Only records generated from this server are displayed.
Enter a category type, e.g.
Administration
or
Authentication
. Only records with a category matching the category entered in this field are displayed.
Audit records can be exported for all servers, or only the local host.
Export data can be formatted: n n for IDENTIKEY Authentication Server compatibility: this allows the exported data to be imported to an instance of IDENTIKEY Authentication Server acting as a dedicated reporting server in a setup with multiple instances of IDENTIKEY Authentication Servers and / or IDENTIKEY Appliance servers.
Comma-Separated Variable (CSV) compatibility: this commonly used format allows the data to be imported by other auditing systems.
Note
The CSV format option for exporting auditing data creates a file in which the separator character is a tab, not a comma, although still called CSV format.
Procedure 77: Downloading and deleting audit files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to Monitoring > Log File Management and click on
Databases
(see Image 69: Downloading Audit
Files
). Available audit files will be listed below.
3. Click on the download icon to the right of an available audit file to download it or the trash can icon to delete it. The arrow next to the trash can icon indicates that multiple logs are available and will be deleted
(see Image 8: Downloading Audit Files ).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
152
21. Monitoring
Image 69: Downloading Audit Files
Note n n
Downloading is the same as the export functionality described above and uses the IDENTIKEY
Authentication Servercompatible format.
Clicking on the trash can to delete the log file will also delete all older log files.
21.4.3. Secure Auditing
An option is available to enable Secure Auditing during the installation of IDENTIKEY Appliance. Secure Auditing provides the following:
Integrity protection
With Secure Auditing, IDENTIKEY Appliance uses a non-viewable encrypted signature added to each line of an audit file, or each row of an audit data store. This prevents any operator from making untraceable manual changes to the audit file.
Independent verification
Each audit file or data store can be verified using the Verfication Tool provided with Secure Auditing.
Non-repudiation
Secure Auditing verifies audit data by comparing each signed line or row of audit data with the previous and subsequent entries in the audit data.
21.4.3.1. How Secure Auditing Works
Secure Auditing adds a cryptographic signature to each audit line written to the output. The cryptographic signature relates each entry to the previous and subsequent entries. External auditors can cryptographically verify each signature and verify that no lines have been deleted or added from the audit information; the relationship between the entries is verifiable using the Verification Tool. The objective of the encrypted signature is to prevent manual removal or addition of entries. The Verification Tool will verify the entire file and ensure that each entry is related to the previous and subsequent entries.
Each entry belongs to an epoch, which is a period delimited either by time or by number of audit lines. At the end of each epoch the encryption key is changed. A message is written to the audit file to indicate that an epoch has ended, and another message is written to indicate that a new epoch has begun. The length of processing for each epoch is defined during initial configuration. A new epoch always begins at midnight. A message is written to the output to indicate the beginning and end of an epoch. Each epoch message contains information required by the
Verification Tool to decrypt the signatures for that epoch. This information is located at the start of each epoch message.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
153
21. Monitoring
If an HSM is used, Secure Auditing relies on public and private keys on the HSM for encryption. Where an HSM is not used, Secure Auditing uses a Master Audit Keystore, and public and private keys randomly generated for each epoch.
In IDENTIKEY Appliance, you can only configure secure auditing via the IDENTIKEY Authentication Server Setup Wizard. You will need to perform a factory default to configure it again. For instructions on how to configure secure auditing, refer to the IDENTIKEY Appliance Installation and Maintenance Guide .
21.4.3.2. Secure Auditing Verification Tool
Secure Auditing output can be verified using the Secure Auditing Verification Tool. This tool scans the Secure Auditing output and verifies that all the entries are in order, and that nothing has been removed or added. Processing results are produced, and the process is either passed or failed. You can optionally specify a trace file to which
Secure Auditing lines which fail verification will be written.
The Secure Auditing Verification Tool is a command-line utility installed with IDENTIKEY Appliance.
Procedure 78: Using the Secure Auditing Verification Tool
1. Open a command-line prompt.
2. To verify a Secure Auditing audit output file with the Secure Auditing Verification Tool , run the following command:
/usr/bin/auditvt -cert
<certname>
-audit_file
<auditfilename>
-trace_file
<tracefilename>
where: n n n
<certname>
is the absolute path of the Audit Master Public Keypair, in PEM format.
<auditfilename >
is the absolute path of the Secure Auditing output file that you want to verify.
<tracefilename>
is a file to which Secure Auditing file entries that don't pass verification can be written. This parameter is optional.
3. The Secure Auditing Verification Tool will scan the specified file and produce results similar to those shown in the example below. The overall status of the file is shown at the end of the messages. In this case the status is Passed .
Example
The following is sample Secure Auditing Verification Tool output:
===[ Verification Summary ]==============================
Successfully verified epoch headers
Successfully verified epoch footers
Successfully verified audit messages
Non-secure audit messages found
Secure audit failures
: 0
: 0
: 0
: 5
: 0
IDENTIKEY Appliance 3.11.12 - Administrator Guide
154
21. Monitoring
Secure audit warnings
Secure audit messages checked
: 0
: 5
=========================================================
Verification: Passed
21.5. Tracing
IDENTIKEY Appliance trace files contain debugging and troubleshooting information. The content can help VASCO support engineers and experienced end-customers to troubleshoot specific issues.
Tracing tasks include: n n
Configuring tracing for: n
IDENTIKEY Authentication Server (see
21.5.1. Configuring Tracing for IDENTIKEY Authentication
n
Server
)
Message Delivery Component (MDC) (see
21.5.2. Configuring Tracing for Message Delivery Com-
n
ponent (MDC)
)
LDAP User Synchronization (see
21.5.3. Configuring Tracing for LDAP User Synchronization
)
Downloading and deleting trace files (see
21.5.4. Managing Trace Files
)
Note
Enabling and configuring log rotation configures automatic clean up for IDENTIKEY Authentication Server and
Message Delivery Component (MDC) trace files. LDAP trace files are not automatically purged and therefore need to be deleted manually.
21.5.1. Configuring Tracing for IDENTIKEY Authentication Server
IDENTIKEY Authentication Server trace files provide information about IDENTIKEY Authentication Server trace events and are available via the IDENTIKEY Appliance Configuration Tool.
Procedure 79: Configuring tracing for IDENTIKEY Authentication Server
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
)..
2. Select Authentication Server > Tracing Settings .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
155
21. Monitoring
Image 70: Configuring Tracing for IDENTIKEY Authentication Server
3. Select the trace level required.
None disables tracing.
Basic or Full enable tracing with increasing detail levels.
Debug must only be used if instructed to do so by VASCO customer support.
For more information about the different tracing levels, refer to the IDENTIKEY Appliance Administrator
Guide .
4. (OPTIONAL) Enable log rotation by selecting Enable Log Rotation and configure log rotation settings.
Log rotation specifies if and when new logs files are created, based on either the log file age or the log file size. For instance, if you select size and specify 50 MB, trace information will be stored in the file until a size of 50 MB is reached, after which a new file will be created. The number of archived log files specifies how many log files are kept at most, if required the oldest log file will be overridden.
5. Click Save .
21.5.2. Configuring Tracing for Message Delivery Component (MDC)
Message Delivery Component (MDC) trace files provide information related to Virtual DIGIPASS.
Procedure 80: Configuring tracing for Message Delivery Component (MDC)
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
)..
2. Select Authentication Server > Message Delivery Component .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
156
21. Monitoring
Image 71: Configuring Tracing for Message Delivery Component (MDC)
3. Select the trace level required.
None disables tracing.
Basic or Full enable tracing with increasing detail levels.
For more information about the different tracing levels, refer to the IDENTIKEY ApplianceAdministrator
Guide .
4. (OPTIONAL) Enable log rotation by selecting Enable Log Rotation and configure log rotation settings.
Log rotation specifies if and when new logs files are created, based on either the log file age or the log file size. For instance, If you select size and specify 50 MB, trace information will be stored in the file until a size of 50 MB is reached, after which a new file will be created. The number of archived log files specifies how many log files are kept at most, if required the oldest log file will be overridden.
Select Compress Archived Logs to save disk space.
5. Click Save .
21.5.3. Configuring Tracing for LDAP User Synchronization
IDENTIKEY Authentication Server trace files provide information about LDAP user synchronization trace events and are available via the IDENTIKEY Appliance Configuration Tool.
Procedure 81: Configuring Tracing for LDAP user synchronization
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Authentication Server > LDAP User Synchronization .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
157
21. Monitoring
Image 72: Configuring Tracing for LDAP User Synchronization
3. Select the trace level required.
None disables tracing.
Basic or Full enable tracing with increasing detail levels.
For more information about the different tracing levels, refer to the IDENTIKEY ApplianceAdministrator
Guide .
4. Click Save .
Note
LDAP user synchronization trace files cannot be rotated or automatically cleaned up. While tracing is enabled, all
LDAP user synchronization records are stored to a single file on the hard disk.
21.5.4. Managing Trace Files
You can download and delete trace files using the IDENTIKEY Appliance Configuration Tool.
Procedure 82: Managing Trace Files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Monitoring > Logfile Management .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
158
21. Monitoring
Image 73: Managing Trace Files
3. Click Trace Files to get a list of all available trace files for IDENTIKEY Authentication Server, MDC, and LDAP user synchronization in the Trace Files pane below.
4. Do one of the following: n n
If you want to download a trace file, click the disk icon.
If you want to delete a trace file, click the trash can icon.
Downloaded trace files can be viewed with a text editor.
21.6. Configuring SNMP
Simple Network Management Protocol (SNMP) is an Internet standard protocol used to manage components on an
IP network. Its main use is to query the system for information and to monitor components in the network for messages that indicate that components require administrative attention. SNMP can be used to monitor the IDENTIKEY
Appliance system and performance, and can be configured using the IDENTIKEY Appliance Configuration Tool.
Net-SNMP is a software suite to use and deploy SNMP. SNMP typically uses administrative machines which are referred to as managers. They monitor a group of components (machines, other devices) on a computer network.
An agent is operated at all times on a managed network. This agent, which is a piece of software, reports events back to the applicable manager via SNMP.
Note
IDENTIKEY Authentication Server does not ship with a predefined set of events for which notifications can be sent out via SNMP traps (for more information about SNMP traps, see
23. System Monitoring
). Using the IDENTIKEY
Authentication Server Configuration Utility or the IDENTIKEY Authentication Server Administration Web Interface, server administrators can define their own set of events for which they want to send out notifications. These events, raised via SNMP traps, are called security alerts. IDENTIKEY Authentication Server uses a VASCO vendorspecific SNMP trap definition to send out SNMP traps for these security alerts.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
159
21. Monitoring
21.6.1. Monitoring IDENTIKEY Appliance via a Management Application
It is possible to monitor IDENTIKEY Appliance via a management application and an SNMP server. This feature allows you to request information from IDENTIKEY Appliance via SNMP.
Additional information can be added to the SNMP server, when IDENTIKEY Appliance performance monitoring is enabled (see
22. Performance Monitoring ).
21.6.2. Configuring SNMP Settings
In order to being able to monitor the IDENTIKEY Appliance events via SNMP, the SNMP settings need to be configured.
Procedure 83: Configuring SNMP Settings
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Settings > SNMP .
3. Select the appropriate version of SNMP and add the related authentication information to be used when querying the IDENTIKEY Appliance SNMP server: n n
For version 2c or earlier: Type the read community password and the source address ( Allow Query
From ) (see
Image 74: Configuring SNMP v2c
).
For version 3: Type an authentication user name and select the types and passwords for the kind of authentication and privacy (see
Image 75: Configuring SNMP v3
).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
160
21. Monitoring
Image 74: Configuring SNMP v2c
Image 75: Configuring SNMP v3
4. (OPTIONAL) Specify contact and location information for the management application in the Settings section.
5. Click Save to finish.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
161
21. Monitoring
Note
The user name and password with SNMP version 3 for a managing application to authenticate with IDENTIKEY
Appliance can be freely chosen and defined in the monitoring settings. These credentials are not associated with a user account in the Administration Web Interface.
21.6.3. Additional References
For more information about the SNMP server configuration fields, refer to the IDENTIKEY Appliance Administrator
Reference .
21.6.4. Querying the SNMP Server (Examples)
Here are examples outlining how to query the IDENTIKEY Appliance SNMP server via an SNMP tool.
Ensure that all relevant MIB files are correctly found by the Net-SNMP tool you are using. For more information about third-party MIB files, refer to the documentation of the respective software tool. For more information about downloading VASCO MIB files provided for IDENTIKEY Appliance, see
21.7. Downloading VASCO MIB Files
.
Example
Query system information via SNMP version 2c with a MIB translated name system
# snmpwalk -Os -v2c -c mycommunity 192.0.2.1 system sysDescr.0 = STRING: "IDENTIKEY Appliance 3.6.7.99.5" sysObjectID.0 = OID: linux sysUpTimeInstance = Timeticks: (734) 0:00:07.34
sysContact.0 = STRING: "Unknown" sysName.0 = STRING: "qa-auto-test" sysLocation.0 = STRING: "Unknown" sysServices.0 = INTEGER: 76
Example
Query system information using SNMP version 2c and an SNMP OID number
# snmpwalk -Os -v2c -c mycommunity 192.0.2.1 .1.3.6.1.2.1.1
sysDescr.0 = STRING: "IDENTIKEY Appliance 3.6.7.99.5"
IDENTIKEY Appliance 3.11.12 - Administrator Guide
162
21. Monitoring sysObjectID.0 = OID: linux sysUpTimeInstance = Timeticks: (734) 0:00:07.34
sysContact.0 = STRING: "Unknown" sysName.0 = STRING: "qa-auto-test" sysLocation.0 = STRING: "Unknown" sysServices.0 = INTEGER: 76
Example
Query system information using SNMP version 3 and an SNMP OID number
#snmpwalk -Os -v 3 -l authPriv -u my_user -a MD5 -A MyAuthPassword1 -x AES -X MyPrivPassword1 192.0.2.1 .1.3.6.1.2.1.1
sysDescr.0 = STRING: "IDENTIKEY Appliance 3.6.7.99.5" sysObjectID.0 = OID: linux sysUpTimeInstance = Timeticks: (3505) 0:00:35.05
sysContact.0 = STRING: "Unknown" sysName.0 = STRING: "qa-auto-test" sysLocation.0 = STRING: "Unknown" sysServices.0 = INTEGER: 76
21.7. Downloading VASCO MIB Files
A number of MIB files are provided for use with SNMP. You can download these MIB files from IDENTIKEY Appliance.
21.7.1. Downloading VASCO MIB Files
Procedure 84: Downloading VASCO MIB files
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Settings > SNMP .
3. Click Download VASCO MIB files .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
163
21. Monitoring
Image 76: Downloading VASCO MIB Files
21.7.2. Additional Considerations
Generally, when targets are defined as SNMP traps, a
VASCO- AXSGUARD- IDENTIFIER-
MIB::vdsIaAuditNotification trap is sent. The MIB file contains the information about the notification and the variables of the MIB file. For more information, refer to the VASCO-AXSGUARD-IDENTIFIER-MIB file.
You can download this file in the IDENTIKEY Appliance Configuration Tool under Settings > SNMP . The trap will send the event information directly in the notification. For more information about SNMP notifications, see
23.
System Monitoring .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
164
22. Performance Monitoring
22. Performance Monitoring
Performance Monitoring allows you to monitor specific parts of IDENTIKEY Appliance processing to produce useful performance statistics.
Performance Monitoring is disabled, enabled, and managed using the IDENTIKEY Appliance Configuration Tool.
IDENTIKEY Appliance uses Filters to define what to monitor; the different supported plugins are used to control how to deliver that data. Filters are applied to all possible output plugins.
22.1. Filters
The Performance Monitoring tool uses filters to determine which specific parts of IDENTIKEY Appliance processing should be monitored.
A filter must consist of the name of a performance transaction. You can specify a single performance transaction, or you can use the asterisk (*) wildcard to identify a group of transactions.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
165
22. Performance Monitoring
Image 77: Adding Filter in Performance Monitoring
In the IDENTIKEY Authentication ServerConfiguration Utility click Add to define a filter. In the Transaction Filter box , a filter can be added by entering a pattern. This pattern must consist of the name of a performance transaction.
The positioning of the asterisk determines what performance transactions will be filtered. For example: n n n n
*administration.logon
-by placing the asterisk at the beginning , all performance transactions that end in administration.logon
will be monitored
*administration*
-by placing an asterisk at the beginning and at the end, everything related to administration will be monitored identikey.scenario.signature*
-by placing the asterisk at the end, all performance transactions starting with identikey.scenario.signature
will be monitored identikey*logon
-by placing the asterisk in the middle, all performance transactions starting with identikey and ending with logon will be monitored.
You can find a list of available performance transactions in the IDENTIKEY Appliance Administrator Reference .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
166
22. Performance Monitoring
22.2. Plugins
The Performance Monitoring tool uses several plugins in order to define its output.
CSV Plugin
The CSV Plugin allows you to define a comma-separated variable ( .csv
) file to write the results to. To enable the CSV plugin, click Enable CSV Plugin in the Performance Monitoring Tool.
The data will be written to the file specified in the file field. You can use the default file, or specify your own.
File rotation can be applied to the .csv
files. This means that a new file will be created when a trigger point has been reached, but the old file will be retained. The .csv
files can be configured to rotate either when a certain time has elapsed, or when a certain file size is reached. The maximum number of retained files is specified when configuring file rotation.
To download a .csv
file, navigate to the Trace files section in Monitoring > LogFile management .
For more information about the fields used by the .csv
file, refer to the IDENTIKEY Authentication Server Administrator Reference , Section "CSV File Format".
Counter Plugin
To enable the counter plugin, click Enable Counter Plugin in the Performance Monitoring Tool.
The Counter Plugin will generate data relating to the number of times certain transactions have been carried out, and relevant timing information for those transactions. The SNMP server on which the Counter Plugin enters the data is the one running on IDENTIKEY Authentication Server.
The counter data can be viewed using SNMP.
Note
For the counter plugin to work, SNMP must be enabled (see
21.6. Configuring SNMP
).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
167
23. System Monitoring
23. System Monitoring
The purpose of system monitoring is to alert administrators of certain events. These alerts, or targets, can be sent as SNMP traps, short messages (SMS), or e-mails.
We recommend to monitor the following types of events: n n n
System OS events
IDENTIKEY Appliance Configuration Tool events
IDENTIKEY Authentication Server events
23.1. Configuring System Monitoring for System OS Events
Critical system events can be monitored by means of SNMP traps as targets for system OS events.
Such critical events and conditions of these events that trigger sending an SNMP trap are the following: n
Disk space status
The system sends an SNMP trap when less than 10 percent of disk space is available. A full disk would prevent the system from writing audit logs. This disk full warning applies to the following disk partitions: n n n
System logging: /var/log
Database storage: /var/pg
IDENTIKEY file system storage, e.g. for trace, log, and report files: /var/identikey n
Memory status
The system sends an SNMP trap when the memory status is low or if the system is out of memory, i.e.
when less than 128 MB of memory is available.
n
SNMP status
The system sends SNMP traps when the SNMP service starts or stops.
n
Processes
Traps are sent when processes are starting and stopping; the following processes are monitored via SNMP traps (see
Table 14: Processes Monitored Via SNMP Traps ).
Table 14: Processes Monitored Via SNMP Traps
Process
Message Delivery Component (MDC) daemon
LDAP sync daemon
IDENTIKEY Authentication Server daemon
System logging daemon mdcserver ikldapsync ikeyserver syslog-ng
Process Name
IDENTIKEY Appliance 3.11.12 - Administrator Guide
168
23. System Monitoring
Table 14: Processes Monitored Via SNMP Traps (continued)
Process
Timeserver ntpd
Process Name
Note
IDENTIKEY Appliance system monitoring does not take into account the service restart function usage on the
IDENTIKEY Appliance Configuration Tool Status page.
The traps sent by IDENTIKEY Appliance for system OS events consist of the following information: n n n n n n n n
Agent details (address, host name)
Date
Enterprise OID
Trap type and sub-type
Community / Infosec Context
Uptime
Description
PDU attribute / Value pair array . This part of the trap contains the information requested which is necessary to monitor the event.
For more information about traps, refer to the IDENTIKEY Appliance Administrator Reference .
23.1.1. Targets for System OS Events
To monitor system OS events, the only available notification target type is an SNMP trap. These targets cannot be customized but only enabled or disabled for the required SNMP trap version; when enabled, all notifications are sent to the SNMP handler. Only one such SNMP handler can be configured. The system event trap already contains all relevant event information data which will be sent directly in the notification.
23.1.2. Configuring System Monitoring Targets for System OS Events
To configure the settings for system OS event traps, configure your SNMP trap server, and proceed as follows.
Procedure 85: Configuring system monitoring targets for system OS events
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Settings > SNMP and navigate to the SNMP Traps section.
3. Select the required SNMP trap version (v2, v3, or v3 INFORM) to enable the relevant SNMP trap type for the notifications.
4. Specify the target host, i.e. the location to which the SNMP targets are sent.
Note
During configuration, processes can be restarted, and a process-down trap can be triggered.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
169
23. System Monitoring
To receive notifications in the form of SNMP traps you need to configure an SNMP trap server (see
23.4. Configuring SNMP Trap Handlers
).
23.1.3. Best Practices for SNMP Targets for System OS Events
The following emergency alerts sent by IDENTIKEY Appliance need to be attended in any case to ensure system functionality: n n n
The hard disk drive is more than 90 percent full.
A critical service is not running, e.g. IDENTIKEY Authentication Server, Syslog, Postgres.
The swap memory is full.
23.2. Configuring System Monitoring for IDENTIKEY Appliance Configuration Tool Events
IDENTIKEY Appliance Configuration Tool event targets serve to monitor critical Configuration Tool events and can be configured in the IDENTIKEY Appliance Configuration Tool. The source for these targets are audit messages that are generated by the
System Configtool source; in the IDENTIKEY Appliance Configuration Tool navigate to Monitoring > Audit Logs and check the Source column.
23.2.1. Targets for IDENTIKEY Appliance Configuration Tool Events
The following notification target types can be configured to monitor IDENTIKEY Appliance Configuration Tool events: n n n
One or more SNMP traps
One or more SMS
One or more e-mails
Generally, when targets are defined as SNMP traps, a MIB file is also available and can be downloaded. MIB files contain the information about the notification and the variables of the MIB file (see
21.7. Downloading VASCO
MIB Files
).
Note
SNMP traps about IDENTIKEY Appliance Configuration Tool events will only be operational for audit lines which are generated by the IDENTIKEY Appliance Configuration Tool itself.
23.2.2. Configuring System Monitoring Targets for IDENTIKEY Appliance Configuration Tool Events
To allow sending SMS, e-mail or SNMP trap notifications about IDENTIKEY Appliance Configuration Tool events, the notification settings need to be configured.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
170
23. System Monitoring
Procedure 86: Configuring system monitoring targets for IDENTIKEY Appliance Configuration Tool events
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Settings > Notifications .
3. Select Enabled to enable notification about IDENTIKEY Appliance Configuration Tool events.
4. Add one or more notification target types for notification using Add target , and specify the settings for each notification target.
Image 78: Configuring Notification Settings
If SNMP traps are used as targets for IDENTIKEY Appliance Configuration Tool events, the system event trap already contains all relevant event information data which will be sent directly in the notification. Additional information may also be available in the audit messages. To view this information, open the IDENTIKEY Appliance Configuration Tool, select Monitoring > Audit Logs and use the AMID number from the SNMP trap to perform a look-up for additional information.
If you want to configure an SMS notification target, verify if you must use a country code or special characters when entering a mobile number. For more information, refer to the MDC or SMS provider documentation.
For more information about the different notification target settings, refer to the IDENTIKEY Appliance Administrator
Reference .
Note
To receive notifications as SNMP traps you need to configure an SNMP trap server (see
23.4. Configuring
SNMP Trap Handlers ).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
171
23. System Monitoring
23.2.3. Filtering IDENTIKEY Appliance Configuration Tool Events for Notification
You can filter IDENTIKEY Appliance Configuration Tool events you want to be notified about. In defining one or more filters you describe which audit messages need to be filtered. The definition of an audit filter is similar to the definition of an audit filter as part of a report definition.
Procedure 87: Adding a system monitoring filter for IDENTIKEY Appliance Configuration Tool events
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Settings > Notifications .
3. Click Add New in the Targets field. Then, select the required type and fill in the appropriate details.
This new notification target will now be available for all filters of the same source but not for other sources or events; for example, targets added via Settings > Notifications will not be available under Authentication Server > System Monitoring Alerts .
4. Click Add filter to add a new notification filter.
5. Configure the filter in the Notification Filter dialog: a. Select Enabled .
b. Specify a name for the notification filter.
c. Select the notification target to which the filter will be applied.
d. Click Add Filter and fill in the required filter parameters.
Repeat this step until all required filtering rules are added.
e. Click Add .
6. Select Enabled to activate the alert system.
Note
When assigning multiple filters to a notification target, the notification target will only be triggered when the match criteria of all assigned filters are met.
IDENTIKEY Appliance allows you to use a complex system of multiple filters and targets to be notified via different targets in case specific audit messages are generated.
Useful filters are:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
172
23. System Monitoring n
System actions
Code equals S-024002 . This filters for changes regarding login, logout, reboot, shutdown, system update, and administrator password change, license change, support change etc.
n
Configuration change
Code equals S-024001 . This filters all changes to IDENTIKEY Appliance Configuration Tool settings.
For more information about system monitoring filters and targets, refer to the IDENTIKEY Appliance Administrator
Reference .
23.3. Configuring System Monitoring for IDENTIKEY Authentication Server Events
IDENTIKEY Authentication Server event targets serve to monitor critical IDENTIKEY Authentication Server events.
These targets can be configured in the IDENTIKEY Appliance Configuration Tool.
The source for these targets are audit messages that are generated by the
Identikey Server source; in the IDENTIKEY Appliance Configuration Tool, select Monitoring > Audit Logs and check the Source column.
23.3.1. Targets for IDENTIKEY Authentication Server Events
The following notification target types can be configured to monitor IDENTIKEY Authentication Server events: n n n
One or more SNMP traps
One or more SMS
One or more emails
23.3.2. Configuring System Monitoring Targets for IDENTIKEY Authentication Server Events
Procedure 88: Configuring system monitoring targets for IDENTIKEY Authentication Server events
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Select Authentication Server > System Monitoring Alerts .
3. Select Enabled to enable notification about IDENTIKEY Authentication Server events.
4. Add one or more notification target types for notification using Add Target and specify the settings for each notification target.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
173
23. System Monitoring
If SNMP traps are used as targets for IDENTIKEY Authentication Server events, the system event trap already contains all relevant event information data which will be sent directly in the notification. Additional information may also be available in the audit messages. To view this information, select Monitoring > Audit Logs and use the AMID number from the SNMP trap to perform a lookup for additional information.
For more information about the different notification target settings, refer to the IDENTIKEY Appliance
Administrator Reference .
Note
To receive notifications as SNMP traps you need to configure an SNMP trap server (see
23.4. Configuring
SNMP Trap Handlers ).
23.3.3. Filtering IDENTIKEY Authentication Server Events for Notification
You can filter IDENTIKEY Authentication Server events you want to be notified about as these events occur rather than having to search through an extensive list of audit logs to locate potentially critical system events. In defining one or more filters you describe which audit messages need to be filtered.
For more information about filtering events, see
23.2.3. Filtering IDENTIKEY Appliance Configuration Tool Events for Notification
.
Note
SNMP traps about IDENTIKEY Authentication Server events will only be operational for audit lines which are generated by IDENTIKEY Authentication Server itself.
23.4. Configuring SNMP Trap Handlers
To receive notifications as SNMP traps from you need to configure an SNMP trap handler in your network which uses the same SNMP settings as specified in the definition of the SNMP notification target.
23.4.1. Configuring an SNMP Trap Handler
Procedure 89: Configuring an SNMP trap handler
1. Configure the SNMP trap settings: n n n n n
User name
Authentication settings
Privacy settings
Trap type (v2, v3, or v3 INFORM trap)
Engine ID (only when the trap type is v3; for traps of the v3 INFORM type, the Engine ID is not required).
IDENTIKEY Appliance 3.11.12 - Administrator Guide
174
23. System Monitoring
2. Download and use the file VASCO-AXSGUARD-IDENTIFIER-MIB (see
21.7. Downloading VASCO MIB Files
).
3. (OPTIONAL) Configure the action to be taken upon receiving SNMP traps on the corresponding system events.
23.4.2. Additional Considerations
23.4.2.1. Engine ID
The engine ID should only be provided when trap type v3 is used. The system automatically detects when a trap of the INFORM type is used.
The engine ID has to be entered in hexadecimal format in your monitoring software and must adhere to the following parameters: n n n
The ID must start with 80001F8880 (hardcoded prefix)
The string must be in hexadecimal format (characters [0-9a-fA-F])
The string must consist of an even number of characters
Example
80001F88800123456789ABCDEF (valid)
1234567890 (invalid no prefix)
80001F8880A (invalid, odd number of chars)
The entries in these input fields are validated by the system, preventing the user from making invalid data entries.
Note
The engine ID used for type v3 traps sent out by IDENTIKEY Authentication Server event traps will change every time IDENTIKEY Authentication Server is restarted.
23.4.3. Additional References
The configuration of your SNMP trap server depends on the software used. For more information about configuring the SNMP trap server, refer to the documentation of your SNMP product.
23.5. Best Practices for SNMP Targets
When using IDENTIKEY Appliance system monitoring, we recommend to define SNMP notifications for the following events:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
175
23. System Monitoring n
IDENTIKEY Authentication Server errors
For this type of events, we recommend to define an audit filter that extracts all error audit messages.
n
Locked DIGIPASS users
For this type of events, a filter should be defined that extracts all audit messages with the audit code W-
011003.
n
Failed administrative logons
For this type of events, a filter should be defined that extracts all audit messages with the audit code F-
004001.
n
Replication failures
For this type of events a filter should be defined that extracts all audit messages with the audit code F-
003001 or F-003002.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
176
24. Troubleshooting
24. Troubleshooting
This section explains how to resolve: n n n
Specific problems you may encounter.
Possible issues with LDAP user synchronization.
Possible issues with LDAP back-end authentication.
For more information about the information sources for different types of troubleshooting issues, see
21. Monitoring
.
24.1. Connection Problems
24.1.1. Description
A program or web site returns an error message that the connection has been refused or similar when attempting to connect to IDENTIKEY Authentication Server.
24.1.2. Solution
Verify that a Client Component record of the correct type exists in the IDENTIKEY Authentication Server data store for the program or web site trying to access. For example, Administration Web Interface will be unable to manage a IDENTIKEY Authentication Server instance until a Client Component record of type Administration Program has been created for it.
24.2. Dynamic Component Registration Problems
24.2.1. Solutions
Client Lookup
Dynamic User Registration will fail if no PTR record exists on the DNS server for the client machine. A reverse zone must be implemented in order for Dynamic User Registration to function correctly.
ASCII encoding is assumed for the DNS reverse lookup process. If a computer name uses a character set other than ASCII, Dynamic User Registration may fail for that machine.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
177
24. Troubleshooting
Group Check
If Group Check does not seem to be functioning as expected in Dynamic User Registration, check whether the named groups are part of an Active Directory domain.
Group Check works with Active Directory domain groups only. It will not work with local Windows groups.
24.3. Administration Web Interface Connectivity
24.3.1. Possible Cause
Security settings in your browser or firewall may block access to the Administration Web Interface.
24.3.2. Solution
Add the Administration Web Interface location to the Trusted Sites list or add an exception to an access rule in the browser and/or firewall security settings.
For example, it is possible to run into a "Certificate Error" or "Certificate Invalid" warning message when accessing an SSL-secured Administration Web Interface using Windows Internet Explorer. When this occurs, manually import the Administration Web Interface certificate into the browser's Root Trusted CA first.
24.4. DIGIPASS User Account Locking
A user may be unable to log in via IDENTIKEY Appliance, if: n n the DIGIPASS user account has been locked.
the DIGIPASS Application has been locked out from usage by the active policy.
The mechanisms to lock a DIGIPASS user account and a DIGIPASS Application are different. Both mechanisms, however, can be used to enhance security by preventing brute-force hacking.
24.4.1. DIGIPASS User Account Locking
Each DIGIPASS user account contains a user lock count. This value is incremented whenever the user attempts a login via IDENTIKEY Authentication Server with an incorrect one-time password (OTP). It is reset to zero when a correct OTP is used.
Each policy contains a user lock threshold. If a user's lock count equals or exceeds the user lock threshold in the policy in use, the DIGIPASS user account will be locked.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
178
24. Troubleshooting
If a DIGIPASS user account is already locked and user auto-unlock is enabled, the user lock count contains the number of (unsuccessful) unlock attempts using user auto-unlock.
You can unlock a locked DIGIPASS user account in different ways: n
Manually using the Administration Web Interface or the Active Directory Users and Computers Extension.
You need an administrative account with the Unlock User privilege to manually unlock a locked DIGIPASS user account.
n
Automatically via user auto-unlock.
The user auto-unlock mechanism allows a user to implicitly unlock a locked DIGIPASS user account during regular authentication. It is enabled and configured using policies.
By default, user auto-unlock is disabled. To enable it you need to set Maximum Unlock Tries accordingly in the applicable policy, that is the maximum number of unlock attempts. Furthermore, you can set the minimum lock duration before another unlock attempt is allowed and a lock duration multiplier to increase the lock duration after each unsuccessful unlock attempt. A default policy prepared to support user auto-unlock is included in the set of pre-loaded policies, i.e. IDENTIKEY Local Authentication with
Auto-Unlock.
For more information about user auto-unlock, refer to the IDENTIKEY Authentication Server Product Guide , Section
"DIGIPASS User Account Auto-Unlock".
Procedure 90: Unlocking a locked DIGIPASS user account manually
1. Open the Administration Web Interface or the Active Directory Users and Computers Extension.
2. Locate and view the respective DIGIPASS user account.
3. Click Unlock .
24.4.2. DIGIPASS Application Locking
Each DIGIPASS Application contains an error count value. This value is incremented when the user enters an incorrect OTP or Electronic Signature and the active policy has the following DIGIPASS Application settings: n n
The identification threshold or signature threshold is greater than zero.
The DIGIPASS Application is the only one available for use for authentication or signature validation. This means that regardless of how many DIGIPASS Applications are available on a user's
DIGIPASS authenticator, the policy should force all authentication or signature validation attempts to go through one specific DIGIPASS Application.
Note
As long as the policy forces all authentication or signature attempts to go through one DIGIPASS Application, the error count value will increment with each failed attempt. This is independent from the number of DIGIPASS Applications on any user's DIGIPASS authenticator or what kind of DIGIPASS Application
IDENTIKEY Appliance 3.11.12 - Administrator Guide
179
24. Troubleshooting is being forced to perform the operation.
An identification threshold and signature threshold is set in each policy (under the DP Control Parameters tab in the
Administration Web Interface). By default it is set to zero, meaning that the error count will not be checked and
DIGIPASS Application will be available. If either the identification threshold or the signature threshold is set to a value greater than zero, a DIGIPASS Application with an error count reaching either threshold will be locked out from usage by the policy.
The error count is automatically reset to zero when: n n
A correct OTP or Electronic Signature is used.
-AND-
The error count has not yet reached either the identification threshold or signature threshold.
Procedure 91: Resetting the error count manually (ODBC)
1. Log on to the IDENTIKEY Authentication Server Administration Web Interface (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface ) .
2. Open the DIGIPASS record.
3. Switch to the DIGIPASS Application tab and click Reset Error Count .
In some cases, this function may be available from the Other Actions menu.
Procedure 92: Resetting the error count manually (AD)
1. Launch the view the Active Directory Users and Computers Extension.
2. Open the DIGIPASS record / properties.
3. Switch to the DIGIPASS Application tab and select Reset Error Count from the Actions menu.
24.5. DIGIPASS Event Counter Out of Sync
24.5.1. Description
An out-of-sync event counter may repeatedly prevent a user with an event-based DIGIPASS authenticator from logging in using one-time password (OTP).
24.5.2. Possible Cause
This is typically the case if the user is receiving one of the following errors:
IDENTIKEY Appliance 3.11.12 - Administrator Guide
180
24. Troubleshooting n
"The one-time password has already been used."
If the event counter in the DIGIPASS BLOB in IDENTIKEY Authentication Server is set higher than the event count on the DIGIPASS authenticator itself, IDENTIKEY Authentication Server will interpret authentication requests as code replay attempts and refuse the requests.
n
"The one-time password was incorrect."
If the event counter in the DIGIPASS BLOB in IDENTIKEY Authentication Server is set lower than the event count on the IDENTIKEY Authentication Server, IDENTIKEY Authentication Server will not recognize the
OTPs as valid.
24.5.3. Solutions
Setting the event counter
If an out-of-sync event counter is preventing users from logging in, you can manually re-set the event counter. An administrator with the correct privileges may use Set Event Counter in Administration Web Interface to increase the IDENTIKEY Authentication Server event counter for the DIGIPASS authenticator. This should be done in careful increments until the event counts in the DIGIPASS authenticator and IDENTIKEY
Authentication Server are close enough for the DIGIPASS authenticator event count to be within the IDENTIKEY
Authentication Server event window.
Note
The event counter may only be increased, not decreased.
Re-importing the DIGIPASS authenticator
This is the only solution available if the event counter in IDENTIKEY Authentication Server is higher than the
DIGIPASS event count.
Procedure 93: Re-importing a DIGIPASS authenticator
1. Delete the DIGIPASS record.
2. Re-import the .dpx
file, ensure that the Upgrade existing DIGIPASS with new activation code option is disabled.
3. Re-assign the imported DIGIPASS authenticator to the correct user.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
181
24. Troubleshooting
24.6. Wireless RADIUS Authentication Failures
24.6.1. Possible Cause
Authentication via wireless RADIUS may fail if a user enters a domain name of more than 15 characters in the
DOMAIN\USER format.
This problem occurs within default Windows supplicant applications.
Example
The user attempts a wireless authentication, and enters
OurDomain.OurCompany\MyUserID in the user ID field, and the one-time password (OTP) in the password field. The authentication fails despite correct user ID and OTP.
24.6.2. Solutions
Workaround 1
Where a domain field is available in the login window, the user should enter the domain name into that field.
Example
The user attempts a wireless authentication, and enters
MyUserIDin the user ID field,
OurDomain.OurCompany
in the domain field and the one-time password (OTP) in the password field. The authentication succeeds as expected.
Workaround 2
Use the
User@Domain format for the user ID instead.
Example
The user attempts a wireless authentication, and enters
[email protected]
in the user ID field and the one-time password (OTP) in the password field. The authentication succeeds as expected.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
182
24. Troubleshooting
24.7. LDAP User Synchronization Issues
24.7.1. Description
LDAP user synchronization does not work.
24.7.2. Possible Causes n n n n n
The bind DN user account is locked.
The synchronization profile is disabled.
The user ID is not mapped in the synchronization profile.
The filter settings are incorrect.
A network problem occurred.
Tip
To troubleshoot LDAP user synchronization consult the specific tracing files (see
21.5.3. Configuring Tracing for
LDAP User Synchronization
). Furthermore, consult the audit records logged (see
21.4. Auditing ). Audit records are
helpful to understand why a certain operation failed, e.g. when deleting a user account failed.
24.7.3. Solutions n
The user account is locked.
Verify that the bind DN and bind password are correct in the synchronization profile. If the user account is locked on the LDAP server, synchronization from user accounts on the LDAP server to the IDENTIKEY Appliance is not possible.
n
The synchronization profile is disabled.
Verify that the Enable box is selected in the Synchronization Profile. If the synchronization profile is not enabled, synchronization is impossible and a notice is logged.
n
User ID is not mapped in the synchronization profile.
At least one attribute must always be mapped to the IDENTIKEY Appliance user ID property. If the user ID property has no mapping entry in the synchronization profile, synchronization is impossible and an error is logged.
n
The filter settings are incorrect or conflicting.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
183
24. Troubleshooting
Correct filter settings result in records for synchronized user accounts. If the filter settings are incorrect or conflicting, no user accounts are found for synchronization; therefore none will be synchronized and no tracing records will be produced. Missing tracing records for synchronized user accounts indicates that the filter settings should be verified.
n
A network problem occurred.
If there is a network problem, e.g. due to the firewall configuration, synchronization is impossible and a connection error is logged.
24.7.4. Additional References
For more information about tracing and auditing, refer to the IDENTIKEY Appliance Product Guide and the
IDENTIKEY Appliance Administrator Reference .
24.8. LDAP Back-End Authentication Setup Issues
24.8.1. Description
When using Microsoft Active Directory back-end authentication some issues could occur if the configuration: n n involves network address translation (NAT) between IDENTIKEY Appliance and the domain controller(s).
the Active Directory DNS server is not used, i.e. an alternative DNS server is configured in the IDENTIKEY
Appliance Configuration Tool.
24.8.2. Possible Cause
SASL DIGEST-MD5 authentication with SPN verification
These issues relate to the SASL Digest-MD5 LDAP authentication mechanism used by IDENTIKEY Appliance and a Microsoft security concept called service principal name (SPN). Authentication with SASL Digest-MD5 is only allowed when the digest-uri parameter contains a string which is also defined as SPN on the Active Directory server.
IDENTIKEY Appliance automatically sets the digest-uri parameter by performing a DNS reverse lookup of the IP address used to contact the domain controller.
Example
The location of the back-end server record is
192.0.2.21
.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
184
24. Troubleshooting
The DNS server used by IDENTIKEY Appliance contains the following information: n n an 'A' record: dc1.mydomain.com
resolves to
192.0.2.21
.
a 'PTR' record:
21.2.0.192.in-addr.arpa
resolves to dc1.mydomain.com
.
Steps during authentication:
1. IDENTIKEY Appliance retrieves information from the back-end record and opens an LDAP connection to the domain controller.
2. IDENTIKEY Appliance performs a reverse DNS lookup for 192.0.2.21 (DNS request for
21.2.0.192.in-addr.arpa
) and receives dc1.mydomain.com
.
3. IDENTIKEY Appliance sends digest-uri dc1.mydomain.com
along with other authentication settings to the Active Directory using the open LDAP connection.
4. The domain controller verifies that the digest-uri parameter exists as an SPN; if so, authentication proceeds and credentials are verified.
24.8.3. Solutions
Both issues explained can be solved by ensuring that the result returned by a reverse DNS lookup of the IP address, used by IDENTIKEY Appliance to connect to the domain controller, exists as an SPN on the domain controller. This can be achieved by configuring a 'PTR' record in the DNS server used by IDENTIKEY Appliance (see example).
For more information about configuring these settings, refer to the documentation of your DNS server.
Tip
To verify the available SPNs on your Active Directory server, use the setSPN.exe command on the command line: setSpn.exe -L \
<hostname_of_windows_server>
IDENTIKEY Appliance 3.11.12 - Administrator Guide
185
25. Support
25. Support
25.1. Support Procedure
If you have problems with or questions about a VASCO product, follow the steps below:
1. Check if your problem has been resolved in the online knowledge base at http://www.vasco.com/support .
2. If you are unable to solve your problem with the Knowledge Base, please contact the company which sold you the VASCO product.
3. If your supplier is unable to solve your query, they will automatically contact the appropriate VASCO expert.
If necessary VASCO experts can access your IDENTIKEY Appliance remotely to solve any problems. Remote support and access to your IDENTIKEY Appliance are achieved through the VASCO Customer Portal.
25.2. Allowing Remote Support Connections
If necessary, VASCO experts can access your IDENTIKEY Appliance remotely to solve problems. Remote support requires a connection between the VASCO Customer Portal and your IDENTIKEY Appliance.
25.2.1. Before You Begin
A support certificate must be installed before a connection can be established to the VASCO Customer Portal.
Note
When the Rescue Tool is running on the console, support is always enabled.
25.2.2. Allowing Remote Support Connections
Procedure 94: Allowing remote support connections
1. Log on to the IDENTIKEY Appliance Configuration Tool (see Section
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration Web Interface
).
2. Navigate to System > Support .
3. Select Enable Support .
This enables VASCO support to connect to the appliance to perform maintenance operations as requested.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
186
25. Support
Image 79: Configuring Support Connections
4. Select a support certificate from the Support Certificate list.
The Support Certificate list contains all support certificates you have previously imported using the Certificate Management tab. For more information, refer to the IDENTIKEY Appliance Administrator Guide , Section "Certificate Management".
Image 80: Selecting Support Certificate
5. Select Enable Remote Support .
6. Click Save .
IDENTIKEY Appliance 3.11.12 - Administrator Guide
187
25. Support
25.2.3. Additional Considerations
Remote support can be enabled without installing a support certificate by providing VASCO support VPN access to your network. This allows direct access to the IDENTIKEY Appliance Configuration Tool.
IDENTIKEY Appliance 3.11.12 - Administrator Guide
188
Index
Index
A
Administration Web Interface troubleshooting connectivity
ADUCE
Audit Viewer auto-unlock
Autolearn
Password Autolearn
B
Back-End Authentication
RADIUS
Back-End Protocol back-end server creating a new back-end server record
C
CHAP
Citrix Web Interface
Communicator cryptographic signature
CSV
Secure Auditing plugin customization reporting
PDF/HTML reports
D
DIGIPASS event counter troubleshooting instance master activation application
Multi-Device Activation
Multi-Device Licensing
Secure Channel troubleshooting
DIGIPASS event counter troubleshooting
DIGIPASS user account auto-unlock unlocking, automatically using user auto-unlock unlocking, manually dpx file dynamic user registration (DUR) troubleshooting
178
179
25, 145-146
179
127-128, 131
131
71, 131-132
131
111, 117
26, 45
49, 90-91, 121
153
167
107
180
177
179
179
179
95
180
31
32
31
31
33
178
E
EAP event-based event counter troubleshooting
F filters performance monitoring
G
Group Check
H
HTML reports
XSLT templates
I
IIS module
L
LDAP back-end authentication troubleshooting
LDAP user synchronization configuring tracing troubleshooting
Licensing
Login Permutations
M
Message Delivery Component (MDC) configuring tracing monitoring filters
Net-SNMP performance
Performance Monitoring tool plugins system monitoring
O
Outlook Web Access
IDENTIKEY Appliance 3.11.12 - Administrator Guide
156
165
159
165
165, 167
167
168, 170, 173
26, 45
184
157
183
31, 33, 123
135
110
47
112, 117
180
180
180
165
52, 55, 178
Index
Index
P
PAP password
PDF supported protocols report templates
PDF Report Templates
PEAP perofrmance monitoring plugins performance monitoring proxy server
R
RADIUS
Back-End Authentication dictionary uploading custom dictionary recent DIGIPASS activity recent user activity remote support
Report Definition Wizard reporting reporting changing report owner deleting a report editing a report retrieving a report running a report
S
Secure Auditing
Master Audit Keystore
Simple Network Management Protocol (SNMP) engine ID
MIB files
MIB files, downloading trap handler, configuring
T templates
HTML reports
XSLT
PDF reports, customized tracing
IDENTIKEY Authentication Server events
111, 117
111
107
108
112, 117
165
167
113
103, 106
105
105
105
110
103
131
121
121
37
37
186
153
154
159
175
163
163
174
LDAP user synchronization, configuring
157
Message Delivery Components (MDC) events, configuring 156
trace files, deleting trace files, downloading
158
158
troubleshooting
Administration Web Interface connectivity connection issues
DIGIPASS authenticator locked
178
177
178
180
DIGIPASS event counter out-of-sync
DIGIPASS user account locked dynamic user registration (DUR)
LDAP back-end authentication
LDAP user synchronization wireless RADIUS authentication
178
177
184
183
182
U
User Account troubleshooting
User Dashboard
178
35
V view audit information
W
Windows Group Check
Wireless Access Points multiple wireless RADIUS wireless RADIUS authentication troubleshooting
X
XSLT Templates
38
52, 55
117-118
118
116, 182
182
110
110
108
155
IDENTIKEY Appliance 3.11.12 - Administrator Guide
