DIGIPASS Authentication for Epic Hyperspace Administrator Guide Configuring DIGIPASS Authentication Module
4.3.2.3
Default domain
Where users log in without entering a domain name or UPN, the authentication server will need to be configured to use the correct domain. There are two basic scenarios that might apply:
Change master domain
If users will only ever be logging in to one domain via the authentication server, the simplest solution is to set the master domain name to the fully qualified domain name of the required domain.
This option is not available for IDENTIKEY Appliance / IDENTIKEY Virtual Appliance.
Set default domain in policy
This strategy should be used if
•
You wish to keep the master domain strictly for administration accounts and separate from user accounts.
•
The authentication server may be required to handle a different default domain for different DIGIPASS
Authentication Modules or other clients.
Each policy may be configured with a default domain, to be used if a user does not enter a domain on login.
Typically, you will need to modify the policy used by each DIGIPASS Authentication Module.
4.3.3
Policy
The client record created during installation of DIGIPASS Authentication for Epic Hyperspace uses the default password replacement policy for the package. It will be named:
•
Identikey Windows Password Replacement (IDENTIKEY Authentication Server)
•
Identikey Microsoft AD Password Replacement
(IDENTIKEY Appliance / IDENTIKEY Virtual Appliance)
This policy is configured with the following settings:
•
Back-end authentication is set to
Always (used for
Windows Password Replacement
,
Dynamic User
Registration
,
Password Autolearn
etc. Not all logins).
•
Windows is used as the back-end authenticator in the
IDENTIKEY Windows Password Replacement policy.
•
Dynamic User Registration
and
Password Autolearn
are enabled.
•
Group check mode is set to
Pass Back and DIGIPASS Users is placed in the group list. This means that any logins by users not in the DIGIPASS users group will be ignored – not rejected – by the authentication server in the Identikey Windows Password Replacement policy.
If you need different settings, either select a different policy (e.g. Self-Assignment or Auto-Assignment ) for the
DIGIPASS Authentication Module component or copy the password replacement policy to a new record, modify the new policy as required, and use the new policy for the DIGIPASS Authentication Module component.
4.3.3.1
DIGIPASS users log in with OTP only (Windows user accounts)
The following settings are recommended for this scenario:
Back-end authentication
• Back-end authentication:
If needed
43
