5 Set Up Active Directory Permissions
Set Up Active Directory Permissions
5.1
Permissions Needed by the Identikey Server
The Identikey Server Service runs under the 'Local System' account rather than as a named user account.
Therefore, when connecting to Active Directory, the Identikey Server connects as the computer account, not a user account. The permissions that it has within Active Directory are the permissions of the computer account.
An important exception to this occurs if you install the Identikey Server onto a Domain Controller. Any Service running as 'Local System' on a Domain Controller has all possible permissions to that Domain. In this case, no additional setup of permissions is required. Therefore, the rest of this section applies to the case where the
Identikey Server is not on the Domain Controller.
During installation, the computer account is added to the built-in 'RAS and IAS Servers' group in the Domain, as it will require the permissions assigned by default to this group.
In order to function correctly, the Identikey Server requires the following permissions in Active Directory, that are not granted to 'RAS and IAS Servers' by default:
Read access to the Digipass Configuration Container
Read access to all User accounts (or at least, all who might need to be authenticated by the Identikey Server)
Write access to the new attributes that are added to the User class for Identikey Server (these are in the auxiliary class vasco-UserExt)
Full control over all Digipass (vasco-DPToken) and Digipass Application (vasco-DPApplication) objects
Create and delete permission for Digipass (vasco-DPToken) objects in Organizational Units and containers
(specifically the Digipass-Pool and Users containers)
5.1.1
Giving Permissions to the Identikey Server
During installation, these additional permissions are granted to the 'RAS and IAS Servers' group automatically.
There is also a manual way to grant these permissions, by running the 'setupaccess' command at the command prompt: dpadadmin.exe setupaccess -group “RAS and IAS Servers”
See 2.5
for more information on the setupaccess command.
As mentioned above, this is not necessary if the Identikey Server is installed onto a Domain Controller.
Identikey Server Administrator Reference
72
5.2
Permissions Needed by Administrators
Set Up Active Directory Permissions
5.2.1
Domain Administrators
Domain Administrators already have all required permissions within their Domain.
5.2.2
Delegated Administrators
The term 'Delegated Administrators' is used here to refer to administrators who have been delegated control over an Organizational Unit. Generally speaking, they have administrative control over the user and computer accounts within their Organizational Unit.
See the Digipass Records topic in the Product Guide for more information on possible approaches to delegating
Digipass administration.
By default, these administrators will be able to view the Digipass User Account data for their users and the
Digipass that are located within their Organizational Unit. However, they will not be able to modify any of that data or assign Digipass.
If you wish to delegate responsibility for all Digipass-related administration within an Organizational Unit, the following additional permissions are required by the Delegated Administrator:
Within the scope of the Organizational Unit, Write permission to the new attributes that are added to the User class for Identikey Server (these are in the auxiliary class vasco-UserExt) – you can add Write permissions for each individual Property Set or if appropriate, grant 'Write All Properties' permission
Within the scope of the Organizational Unit, Full Control over all Digipass (vasco-DPToken) and Digipass
Application (vasco-DPApplication) objects
Create and Delete permission for Digipass (vasco-DPToken) objects within the Organizational Unit
If the Delegated Administrator should be allowed to assign Digipass from the Digipass Pool to their users, they need: the Delete Digipass objects permission in the Digipass-Pool container
Write All Properties permission on Digipass objects in the Digipass-Pool container
If the Delegated Administrator should be allowed to move unassigned Digipass back to the Digipass-Pool, they need Create Digipass objects permission in the Digipass-Pool container
5.2.3
Reduced-Rights Administrators
The term 'Reduced-Rights Administrator' is used here to refer to administrators who are granted permissions to perform only selected Digipass-related administration tasks. They may be granted these permissions within the scope of the whole Domain, or only within an Organizational Unit.
Identikey Server Administrator Reference
73
Set Up Active Directory Permissions
An example is a Helpdesk operator who is permitted to troubleshoot Digipass operations, but not to assign/unassign Digipass to/from users.
By default, all users have read access to everything in the Active Directory. The modification permissions that can be granted to this kind of administrator are:
Write permission for any of three Property Sets on the Digipass User Account fields:
Digipass User Account Information – all attributes except those covered by the other two Property Sets, including Authorization Profiles/Attributes
Digipass User Account Link – the link attribute used to share a Digipass between two user accounts
Digipass User Account Stored Password – the Stored Password attribute
Write permission for any individual properties on Digipass objects, except for one Property Set that is defined to control the Digipass assignment link
Write permission for any individual properties on Digipass Application objects, except for one Property Set that is defined to include the Digipass 'blob' that is required for any administrative operation such as Reset PIN,
Test, Set Event Counter, etc.
Create and delete permission on Digipass and Digipass Application objects
If the administrator should be allowed to move Digipass, they need: the Delete Digipass objects and Create Digipass objects permissions in the relevant Domain and/or
Organizational Unit
Write All Properties permission on Digipass objects
Note
This can be necessary for assigning Digipass to users, because a move from one location to another is controlled by permissions to delete from the source and create in the destination
5.2.4
System Administrators
The term 'System Administrator' is used here to refer to an administrator who will be responsible for management of records which affect the configuration and running of the Identikey Server, rather than Digipass User Accounts and Digipass. They need permissions within the Digipass Configuration Container to create, modify and delete these objects:
Component (vasco-Component)
Policy (vasco-Policy)
Report (vasco-Report)
Report Format (vasco-ReportFormat)
Back-End Server (vasco-BackEndServer)
Identikey Server Administrator Reference
74
5.3
Set Up Active Directory Permissions
Server Configuration (vasco-Configuration)
In practice, System Administrators can typically be given full control over the Digipass-Configuration container. If you wish to grant more limited permissions, this can be handled with the standard Active Directory permissions on these objects within the scope of the container.
Assign Administration Permissions to a User
Note
This example assumes that the administrator's User account has read permissions for all User records already.
To grant permissions to manage Digipass records, you will need to follow these steps:
1.
Right-click on the Organizational Unit in which to assign permissions. in the Active Directory Users and
Computers extension.
2.
Select Delegate Control... from the right-click menu.
The Delegate Control Wizard will be displayed.
3.
Select the User or Windows Group to assign permissions.
4.
Click on
OK.
5.
Select the Delegate Common Tasks option button.
6.
Select Create, Delete and Manage Digipass from the list.
7.
Click on Next.
8.
Click on Finish.
If you wish to grant permissions to modify Digipass User Account properties, you will need to follow these steps:
9.
Select View -> Advanced Features from the main menu.
10.
Right-click on the Organizational Unit in which to assign permissions.
11.
Select Properties from the right-click menu.
12.
Click on the Security tab.
13.
Click on the Advanced button.
The
Advanced Security Settings window will be displayed.
14.
Click on
Add...
15.
Type the username of the User to assign the permissions to and click OK.
16.
Click on the Properties tab.
17.
Select User Objects from the Apply onto drop down list.
Identikey Server Administrator Reference
75
Set Up Active Directory Permissions
18.
Select the required permissions from:
Write Digipass User Account Information
Write Digipass User Account Link
Write Digipass User Account Stored Password
19.
Click on OK.
20.
Click on OK.
21.
Click on
OK.
If the administrator requires permissions to take Digipass out of the Digipass-Pool for assignment, you will need to follow these steps:
22.
Right-click on the Digipass Pool.
23.
Select Properties from the right-click menu.
24.
Click on the
Security tab.
25.
Click on the Advanced button.
The Advanced Security Settings window will be displayed.
26.
Click on Add...
27.
Select the User account.
28.
Click on OK.
29.
Click on the Object tab.
30.
Select Child objects only from the Apply onto drop down list.
31.
Tick the Allow box for:
Delete Digipass Objects
Create Digipass Objects (if you wish to allow the administrator to move Digipass records into the Digipass Pool)
32.
Click on OK.
33.
Click on
Add...
34.
Select the User account.
35.
Click on OK.
36.
Click on the Object tab.
37.
Select Digipass objects from the Apply onto drop down list.
38.
Tick the Allow box for Write All Properties .
39.
Click on OK.
40.
Click on OK.
41.
Click on
OK.
Identikey Server Administrator Reference
76
Set Up Active Directory Permissions
5.4
Multiple Domains
When using the Identikey Server with multiple domains, extra steps must be followed to ensure that both the
Identikey Server and administrators have permissions sufficient to access required data. The main issues are:
The Digipass Configuration Container is only in one Domain. All Identikey Servers need read access to this container, even when they are in a different Domain. Cross-Domain access for administrators is a less likely requirement however.
If a Identikey Server handles users and Digipass in more than one Domain, they need to be granted the necessary permissions in all the necessary Domains.
In this manual, we will handle cross-Domain permissions using a combination of Domain Local and Domain Global groups. It is also possible in a 'native' mode Domain to use Universal groups, but this is not covered in the instructions below.
Three possible scenarios for multiple domain setup are outlined below:
5.4.1
Scenario 1 – Each Identikey Server Handles One Domain
Each Identikey Server handles only the domain in which it is a member.
Install the Identikey Server in each domain (the result will be at least as many Identikey Servers as domains).
Give each Identikey Server access to the Digipass Configuration Domain:
Domain Global Group(s)
For each domain (apart from the Digipass Configuration Domain) -
1.
Create a Domain Global group
2.
Add the Identikey Server(s) to the Domain Global group (check which machines are in the 'RAS and IAS
Servers' group to ensure the correct additions)
Domain Local group
In the Digipass Configuration Domain -
3.
Create or use an existing Domain Local group.
4.
Give the Domain Local group full read access to the Digipass Configuration Container.
5.
Add the Domain Global Group from each other domain to the Domain Local group.
Identikey Server Administrator Reference
77
Set Up Active Directory Permissions
5.4.2
Scenario 2 – One Identikey Server Handles All Domains
Identikey Servers in one domain handle all domains. The Digipass Configuration Container should be located in the domain to which the Identikey Servers belong.
Give the necessary access to User and Digipass data:
Domain Global group
In the RADIUS server Domain -
1.
Create a Domain Global group.
2.
Add the Identikey Servers to the Domain Global group (check which machines are in the 'RAS and IAS
Servers' group to ensure the correct additions).
Domain Local groups
For each other Domain -
3.
Create a Domain Local group.
4.
Give the Domain Local group the required permissions (run the setupaccess command - See
2.5
Utility for more information).
5.
Add the Domain Global group from the Identikey Server Domain to the Domain Local group.
5.4.3
Scenario 3 - Combination
This scenario represents more complex setups, where a combination of steps from Scenarios 1 and 2 will be required. Use the steps given in the first two scenarios as a guide for what you will need to do for the combination scenario.
Identikey Server Administrator Reference
78
