aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
DIGIPASS User Accounts
16 DIGIPASS User Accounts
16.1
Overview
All Users requiring authentication with the aXsGUARD Identifier must have their records registered in the aXsGUARD Identifier for:
DIGIPASS devices to be assigned to Users
User-specific parameters to be stored
Privileges to be assigned, and
Policy settings to be overruled at a user level.
User Accounts can be created, managed and searched for using the Administration Web Interface (see section 4
on Administration Interfaces) and we explain these operations below.
We strongly recommend that you read section 3 first, to better understand the User Account concept.
16.2
Creating User Accounts
A DIGIPASS User Account can be created using the Administration Web Interface in the following ways: by creating User records manually using the Administration Web Interface. by importing User records (singly or in bulk) from a file using the Administration Web Interface.
dynamically during authentication processing if Dynamic User Registration is enabled.
We explain these methods in the following sections.
Note:
User Account records can also be synchronized with LDAP Servers (see section 14.1).
16.2.1
Creating Users Manually
Users can be created manually by the system administrator. The following records need to be defined to create a user:
User ID, domain and optionally an organizational unit (see section 21 )
Static password (optional)
Local and back-end authentication settings
Whether the account is enabled and/or locked
© 2009 VASCO Data Security 96
aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
DIGIPASS User Accounts
Further management possibilities with User Accounts are listed below. For explanations of the User property fields, please refer to the aXsGUARD Identifier Administration Reference Guide .
16.2.2
Importing User Records
Multiple User Accounts can be imported into the aXsGUARD Identifier in a comma separated values (.csv) text file through the User/Import screen of the Administration Web Interface. Details for structuring the comma separated values within a text file are listed in the aXsGUARD Identifier Administration Reference Guide , 'Importing users using Comma Separated Value Files' section.
16.2.3
Dynamic User Registration
When the aXsGUARD Identifier receives an authentication request for a user without a DIGIPASS User Account, it can check the credentials with the back-end authenticator (e.g. RADIUS). If the authentication is successful with the back-end authenticator, the aXsGUARD Identifier can create a DIGIPASS User Account automatically for the
User. This process is called Dynamic User Registration (DUR) and can be enabled via the Administration Web
Interface. For more information on Dynamic User Registration
, see section 3.4.4
.
DUR is commonly used with Auto-Assignment, so that the new account is immediately assigned a DIGIPASS. For
more information on Auto-Assignment, please see section 17.2.4
.
16.2.4
LDAP User Synchronization
LDAP User Synchronization supports automatic creation and updating of User Accounts on the aXsGUARD
Identifier from records stored on one or more LDAP Servers. Synchronization needs to be configured in the
Configuration Tool, by defining a Synchronization Profile for your specific LDAP Server(s). For more information,
please see section 14.1
.
16.3
Linked User Accounts
Normally, a DIGIPASS record can only be assigned to one User Account (see section 17.4.4
). However, if someone
has two DIGIPASS User Accounts, for example an administrative account and a 'normal user' account, the accounts can be linked to share a DIGIPASS device. The DIGIPASS record for the device is assigned to one account, to which the other account is then linked (see image below).
© 2009 VASCO Data Security 97
aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
DIGIPASS User Accounts
DIGIPASS record
Attached to main
User account
DIGIPASS User account 1
User Account Link
DIGIPASS User account 2
User can log into either account using the same
DIGIPASS
Image 38: User Account Link
16.4
User Account Settings
User Account settings which can be managed through the Administration Web Interface include: the User ID, the domain and possibly organizational unit they belong to are defined on creation; users can also
be moved from one organizational unit to another, but cannot be moved between domains (see section 21.4
)
the account status can be enabled, disabled, locked or deleted
a static password can be enabled and set (see section 16.5
)
whether policy settings for local or back-end authentication may be overruled for a user can be specified
whether the user has a linked User Account can be specified (see section 16.3
)
DIGIPASS records can be assigned or unassigned to a user parameters, such as a user's mobile phone number for using a Virtual DIGIPASS, can be stored
user attributes, which may need returning to applications when requested, can be stored (see section 3.6
)
privileges can be assigned to a user, e.g. for administration (see section 16.7
)
16.5
DIGIPASS User Account Static Password
The DIGIPASS User Account has one static password field, which can be used in different ways:
local static password verification for users who do not have a DIGIPASS device (see section 3.5.4
)
© 2009 VASCO Data Security 98
aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
DIGIPASS User Accounts
during Challenge/Response authentication as Request Method (see section 3.5.3.6
) during Virtual DIGIPASS use as Request Method (see section 3.5.3.6
)
password replacement and autolearn (see section 3.6.3
) back-end authentication e.g. for retrieval of RADIUS attributes (see section 3.6.3
)
static password authentication during the Grace Period (see section 3.5.3.2
)
There are two different mechanisms to set and update static passwords: by the Administrator in the Administration Web Interface, and
by the User using the password autolearn functionality (see section 3.6.3.2
)
16.6
Searching for User Accounts
The Administration Web Interface allows you to search for User Account records in a number of ways:
You can search directly by entering the User ID
You can search for the User who a DIGIPASS device belongs to by searching for the DIGIPASS and double clicking on the User on the DIGIPASS details screen
You can enter the first few characters of the User ID, followed by a wild card (*). A list of results is presented, from which you can select the User you require.
16.7
Administration Privileges
Only DIGIPASS User Accounts with administrative permissions can use the Administration Web Interface to configure the aXsGUARD Identifier. Administrative privileges are assigned to DIGIPASS User Accounts and therefore a DIGIPASS User Account is needed for each administrator. The default administrative accounts are listed in
section 4.2
.
Administrative permissions may be assigned based on:
Type of permission (e.g. Read, Create)
Type of object (e.g. DIGIPASS record, Policy)
The Domain and Organizational Unit in which the administrator account is located determines the range of administration access:
If the account belongs to an Organizational Unit, the administrator can administrate User Accounts and
DIGIPASS records belonging to that Organizational Unit.
If the account does not belong to an Organizational Unit, the administrator can administrate all DIGIPASS records and User Accounts in the Domain to which they belong.
If the account belongs to the Master Domain, the administrator may be able to administrate all DIGIPASS records and User Accounts in the database. This depends on the 'Access Data in All Domains' Privilege, which is only available to administrators in the Master Domain.
More information on the Master Domain and Organizational Units
is available in section 21 .
© 2009 VASCO Data Security 99
