DIGIPASS Authentication for Epic Hyperspace Administrator Guide Configuring DIGIPASS Authentication Module
• Back-end protocol:
Windows (IDENTIKEY Authentication Server) or Microsoft AD (IDENTIKEY Appliance /
IDENTIKEY Virtual Appliance.)
These settings allow the authentication server to check user login details with Active Directory in case of
Dynamic User Registration (DUR)
,
Password Autolearn
and
Self-Assignment
logins through the
DIGIPASS Authentication Module
.
DIGIPASS User Account handling
•
Dynamic User Registration:
Enabled
•
Password Autolearn:
Enabled
•
Stored Password Proxy:
Enabled
These settings allow the authentication server to create an account for an unrecognized user based on a successful Windows or Active Directory authentication. The authentication server can then store the user’s
Active Directory password and replay it to the DIGIPASS Authentication Module in place of the one-time password entered by the user on future logins.
DIGIPASS Authentication Module
Either Self-Assignment or Auto-Assignment would typically be used in this scenario, although manual assignment may also be used.
Local Authentication
The typical setting for local authentication would be Digipass/Password , meaning that user usually need to use an OTP when logging in, but are not required to in some circumstances (e.g. in grace period).
4.3.3.2
DIGIPASS users log in with password and OTP (Windows user accounts)
The following settings are recommended for this scenario:
Back-end authentication
• Back-end authentication:
If needed
• Back-end protocol:
Windows (IDENTIKEY Authentication Server) or Microsoft AD (IDENTIKEY Appliance /
IDENTIKEY Virtual Appliance).
These settings allow the authentication server to check user login details with Windows or Active Directory in case of
Dynamic User Registration (DUR)
and
Self-Assignment
logins through the DIGIPASS
Authentication Module
.
DIGIPASS
User Account handling
•
Dynamic User Registration:
Enabled
•
Password Autolearn:
Enabled
•
Stored Password Proxy:
Enabled
These settings allow the authentication server to create an account for an unrecognized user based on a successful Windows or Active Directory authentication. The authentication server will not store or replay a user’s Active Directory password.
44
