DIGIPASS Authentication for Epic Hyperspace Administrator Guide DIGIPASS Authentication for Epic Hyperspace Overview
2.1
General Overview
2.1.1
Overview of DIGIPASS Authentication for Epic Hyperspace
DIGIPASS Authentication for Epic Hyperspace
(also referred to as DPAuth4EHS) provides strong authentication for Epic Hyperspace using DIGIPASS technology.
DPAuth4EHS is a client-side .NET module that integrates with Epic Hyperspace to add support for two-factor authentication using a DIGIPASS authenticator. It must be installed on each client computer that requires twofactor authentication. It supports 1-step and 2-step challenge/response and response-only authentication. It requires IDENTIKEY Authentication Server as authentication back-end to validate credentials provided by the end user. The one-time passwords (OTP) are validated using IDENTIKEY Authentication Server or IDENTIKEY
Appliance / IDENTIKEY Virtual Appliance.
Figure 1: DIGIPASS Authentication Module Overview
10
DIGIPASS Authentication for Epic Hyperspace Administrator Guide DIGIPASS Authentication for Epic Hyperspace Overview
2.2
DIGIPASS Authentication Module Terminology
The following definitions describe how these items are used in this document.
Authentication server
The term authentication server refers to the component to which the DIGIPASS Authentication Module sends authentication requests. This component is:
• for IDENTIKEY Authentication Server: the IDENTIKEY Authentication Server service or daemon
• for IDENTIKEY Appliance / IDENTIKEY Virtual Appliance: the IDENTIKEY Authentication Server daemon
Client record
The client record is the record defined in the authentication server’s data store, to represent an installed instance of the DIGIPASS Authentication Module.
It is used for the following main purposes:
• To indicate that the authentication server is permitted to process a request from that client
• To specify a policy to be used to process the request
DIGIPASS Authentication Module
This is the generic term for
DIGIPASS Authentication for Epic Hyperspace
. It provides multi-factor authentication for additional security to those who access applications across networks.
DIGIPASS Authentication Module Configuration Wizard
The DIGIPASS Authentication Module Configuration Wizard serves to define the basic settings for using
DIGIPASS Authentication for Epic Hyperspace.
DIGIPASS Authentication Module Configuration Center
The DIGIPASS Authentication Module Configuration Center serves to configure DIGIPASS Authentication for
Epic Hyperspace.
11
DIGIPASS Authentication for Epic Hyperspace Administrator Guide DIGIPASS Authentication for Epic Hyperspace Overview
2.3
Authentication Methods
Refer to the Product Guide for your authentication server product for detailed information about login methods and options.
Response-only login
Response-only login takes place when a user wants to access a resource protected by Epic Hyperspace. The
Citrix StoreFront system requires the user to authenticate, i.e. the user needs to logon to the Epic Hyperspace system using a DIGIPASS authenticator that supports response-only authentication, for instance a single button device like DIGIPASS GO6. When using response-only, a user logs in via the current login page with the user name and a one-time password (OTP).
For information about enabling this login procedure, see 5.1 Enabling the Response-Only Login or 2-Step
Challenge/Response Login .
1-Step Challenge/Response login
In a 1-step challenge/response login process the user wants to access a resource protected by Epic
Hyperspace. The Epic Hyperspace system requires the user to authenticate using challenge/response authentication. A random challenge sent by IDENTIKEY Authentication Server – of a length configured for all users in the authentication server’s policy – is displayed on the login page. The user logs in with the user name and DIGIPASS response to the displayed challenge. In a 1-step challenge/response login process the
DIGIPASS Authentication Module receives the authentication credentials of the end user, and sends an authentication request with these credentials to IDENTIKEY Authentication Server.
For more information about enabling this login procedure, see 5.2 Enabling the 1-Step Challenge/Response
Login Page.
2-Step Challenge/Response login
In a 2-step challenge/response login process a user wants to access a resource protected by Epic
Hyperspace. The Epic Hyperspace system requires the user to authenticate using 2-step challenge/response.
A first authentication request (first step) is used to request a challenge. The second authentication request
(second step) is used to validate the response to that challenge.
For information about enabling this login procedure, see 5.1 Enabling the Response-Only Login or 2-Step
Challenge/Response Login .
Virtual DIGIPASS login
Virtual DIGIPASS login is used when the users do not have access to their DIGIPASS authenticator and need to log on to the Citrix StoreFront using a Virtual DIGIPASS. The user requests IDENTIKEY Authentication Server
(by means of an authentication request through Epic Hyperspace) to generate a one-time password (OTP) and deliver that OTP via SMS or email. This process will typically start when the user clicks Forgot DIGIPASS? in the RO, 1-step C/R or 2-step C/R logon interface (indicating that the user has forgotten the DIGIPASS authenticator).
12
DIGIPASS Authentication for Epic Hyperspace Administrator Guide DIGIPASS Authentication for Epic Hyperspace Overview
Users logging in with Virtual DIGIPASS use a process similar to the 2-step challenge/response login. If the user has a primary Virtual DIGIPASS assigned or requests using the backup Virtual DIGIPASS feature during the first step to generate an OTP, this OTP can be delivered via SMS or email. The user is then redirected by the
DIGIPASS Authentication Module to a new screen to enter the OTP.
13
