9Web Sites. Vasco Identikey Server
Reklamë
Reklamë
9 Web Sites
9.1
9.2
Web Sites
Customizing the Web Sites
The User Self Management Web Site and OTP Request Site can be customized by modifying the pages provided with the installation. You may wish to: change the colors and graphics to match your corporate colors/logos integrate the pages into a larger web site translate or customize the text
Any cosmetic part of the web pages may be modified. Completely new web pages may be used, provided that the correct form fields are posted to the CGI program, and query string variables are interpreted correctly. Server scripting languages such as PHP or ASP, or any other way of generating HTML, can be used.
This section provides the instructions and reference material that you require to customize the site. It is assumed that the reader has some web development knowledge.
CGI Program
A CGI script is used for the User Self Management Web Site and OTP Request Site.
The CGI program carries out the following actions:
Read and validate the input. This input is gathered from:
Configuration settings from the registry
Form variables posted
Send an authorisation request to the RADIUS Server (if used, and provided that there were no validation errors) and interpret the response. Requests are sent to the Server using the RADIUS protocol. A component identifier
Self-Mgt Site will indicate in the Audit Console which audit messages relate to requests from the User Self-
Management Web Site.
(OTP Request Site only) Send a request to the Message Delivery Component to send an OTP to the User's mobile phone via text message.
Output the HTML to direct the user to the page that will indicate success or failure, or display a challenge. This is achieved by returning the HTML for a basic ‘please wait’ page with a ‘meta-refresh’ instruction to go directly to the appropriate page. The meta-refresh will happen immediately, but on a slow link you may notice the intermediate page.
The CGI program cannot be customized. Its behaviour is controlled by the configuration settings and the posted form variables. The configuration settings are listed below; the posted form variables are specified in the
Customizing the Web Site section.
Identikey Server Administrator Reference
125
Web Sites
9.2.1
Configuration Settings
Various configuration settings are used by the CGI program to locate the RADIUS server(s) and to enable tracing.
These can be modified using the Start->Programs menu option “User CGI Configuration”.
The configuration settings are stored in the Windows Registry, at the path:
HKEY_LOCAL_MACHINE\Software\VASCO\User CGI
Table 44: Configuration Settings for CGI Program
Trace-File
Name
Trace-Mask
Source-IP-Address
Server1-IP-Address
Server1-Port
Server2-IP-Address
Server2-Port
String
String
Type
Number
(DWORD)
String
Number
(DWORD)
String
Number
(DWORD)
Value Default
Used to enable internal tracing levels. In general, just use these values:
0 = no tracing
FFFFFFFF (hexadecimal) = full tracing
Full path and filename of output file for internal tracing.
NB: the file will be created if it is missing, but not the directory.
0
<No default>
Source IP address to bind to when sending API requests, if any (only required if there are multiple IP addresses on the machine).eg. 10.9.255.7
<Blank>
IP address of primary RADIUS Server. eg. 10.2.255.45 127.0.0.1
API port of primary RAIUS Server (in general, this should not be changed from the default).
20003
IP address of backup RADIUS Server, or blank if there is no backup.
<Blank>
API port of backup RAIUS Server (in general, this should not be changed from the default)
20003
Identikey Server Administrator Reference
126
9.3
Form Fields
Web Sites
9.3.1
Registration – Main Pages
User Registration (UR), Digipass Assignment (DA) and Password Synchronization (PS) are all implemented using a single invocation of the CGI program. This permits them to be carried out either separately or in any combination.
You can choose to separate them in your customized web site or keep them together as you prefer.
If Challenge/Response or a Virtual Digipass is used, the user will enter their User ID, static password and Serial
Number into the main page without a Digipass Response. They will be directed to a challenge page, which is specified in the next topic, in which they should enter either a Response to the challenge or the OTP sent to their mobile phone. The following table applies only to the main page.
The following posted form fields must be used on the main page, according to the particular function and other conditions specified below:
Table 45: Form Fields for Main Registration Page
Form Field Name Visible Label
(Default)
Value(s)
dpcgi_operation dpcgi_success_page dpcgi_fail_page dpcgi_challenge_page
<hidden>
<hidden>
<hidden>
<hidden>
“register” for User Registration, Digipass
Assignment or Password Synchronization.
Relative or absolute URL of web page to go to if the function is successful.
Relative or absolute URL of web page to go to if the function fails.
Relative or absolute URL of web page to go to if a challenge is returned for the user.
UserID in the Identikey Server.
dpcgi_userid UserId dpcgi_password dpcgi_serialno dpcgi_response
Password
Serial Number
Static password.
Digipass serial number.
Digipass Response Digipass response (without static PIN if there is one).
dpcgi_newpin dpcgi_confirmpin
New PIN
Confirm New PIN dpcgi_usecombinedpwd <hidden>
New static PIN (for Go 1/Go 3).
Confirm the new static PIN.
“True” to send the password, serial number, response and PIN to the Identikey Server in one attribute.
“False” to send the contents of the password field
(1)
If any users may self-assign a Challenge/Response Digipass, provide this form field.
Y
Y
Y
Y
Y
Required?
UR PS DA
Y Y
Y
Y
Y
Y
(4) (1)
Y Y
Y Y
Y
(5) (2)
(3)
(3)
Identikey Server Administrator Reference
127
Web Sites
(2)
If any users may self-assign a Response Only Digipass, provide this form field.
(3)
If any users may self-assign a Response Only Digipass which uses a static PIN at the beginning of the response (eg. Go 1/Go 3), where the Digipass are initialized with no initial static PIN, they have to enter a new PIN the first time they use the Digipass. If they are self-assigning the Digipass, that means that they have to enter the new PIN and confirm it during the self-assignment process. They can do this by adding the new PIN twice at the end of the Digipass Response, however it may be more user-friendly to provide these two separate form fields.
(4)
If any users have a Challenge/Response application or a Primary Virtual Digipass, include this field.
(5)
If any users have a Response Only application, include this field.
9.3.1.1 Registration – Challenge Page
The Registration challenge page will be used for Digipass Challenge/Response or Virtual Digipass. The user enters their response to the challenge, to complete the registration process.
The following posted form fields must be used on the challenge page:
Table 46: Form Fields for Registration Challenge Page
Form Field Name Visible Label
(Default)
dpcgi_operation dpcgi_success_page dpcgi_fail_page dpcgi_userid dpcgi_response dpcgi_challenge
Value(s)
<hidden>
<hidden>
“register” for User Registration, Digipass Assignment or
Password Synchronization.
Relative or absolute URL of web page to go to if the function is successful.
<hidden> Relative or absolute URL of web page to go to if the function fails.
UserId UserID in the Identikey Server.
Digipass Response Digipass response or Virtual Digipass OTP.
Challenge Digipass challenge returned to the user.
Y
Y
Y
Y
Y
Y
Required?
Note
If you make dpcgi_challenge a visible form field, ensure that it is not modifiable. An alternative is to make it a hidden form field, while also displaying the challenge in HTML text rather than as a form field.
Identikey Server Administrator Reference
128
Web Sites
9.3.1.2 PIN Change
The PIN Change function is only applicable for Digipass Response Only where the Server PIN is entered at the start of the response (eg. Go 1/Go 3).
The following posted form fields must be used on the PIN Change page:
Table 47: Form Fields for Server PIN Change Page
Form Field Name Visible Label
(Default)
Value(s) Required?
dpcgi_operation dpcgi_success_page dpcgi_fail_page dpcgi_userid dpcgi_response dpcgi_currentpin dpcgi_newpin dpcgi_confirmpin
<hidden>
<hidden>
<hidden>
“changepin” for PIN Change.
Relative or absolute URL of web page to go to if the function is successful.
Relative or absolute URL of web page to go to if the function fails.
UserID in the Identikey Server.
UserId
Digipass Response Digipass response (without static PIN if there is one).
Current PIN Current static PIN to be changed.
New PIN New static PIN.
Confirm New PIN Confirm the new static PIN.
Y
Y
Y
Y
Y
Y
Y
(6)
(6)
If the Digipass has had its Server PIN reset by the administrator because the user has forgotten it, there is no current Server PIN to enter here. In all other cases, the current Server PIN must be provided to permit the PIN change.
Identikey Server Administrator Reference
129
Web Sites
9.3.1.3 Login Test – Main Page
If a Challenge/Response application or Primary Virtual Digipass is used, the user will enter just their UserId (and maybe password) into the main page without a Digipass Response. If using the Backup Virtual Digipass, they will need to enter the trigger specified in server settings (password and/or a Keyword) into the password field.
They will be directed to a challenge page, specified in the next topic. The following table applies only to the main page.
The following posted form fields must be used on the main page:
Table 48: Form Fields for Main Login Test Page
Form Field Name Visible Label
(Default)
Value(s) Required?
dpcgi_operation dpcgi_success_page dpcgi_fail_page dpcgi_challenge_page dpcgi_userid dpcgi_response
<hidden>
<hidden>
<hidden>
<hidden>
UserId
Digipass
Response
“testlogin” for Login Test.
Relative or absolute URL of web page to go to if the function is successful.
Y
Y
Relative or absolute URL of web page to go to if the function fails.
Y
Relative or absolute URL of web page to go to if a challenge is returned for the user.
(7)
UserID in the Identikey Server.
Y
Digipass response (with static PIN if there is one). (8)
(7)
If any users have a Challenge/Response Digipass, a Primary Digipass or use the Backup Virtual Digipass feature, provide this form field.
(8)
If any users have a Response Only Digipass, provide this form field.
Identikey Server Administrator Reference
130
Web Sites
9.3.1.4 Login Test – Challenge Page
The user enters their response to the challenge or the OTP sent to their mobile phone to complete the login test.
The following posted form fields must be used on the challenge page:
Table 49: Form Fields for Login Test Challenge Page
Form Field Name Visible Label (Default)
dpcgi_operation <hidden> dpcgi_success_page <hidden> dpcgi_fail_page dpcgi_userid dpcgi_response dpcgi_challenge
<hidden>
UserID
Digipass Response
Challenge
Value(s)
“testlogin” for Login Test.
Y
Relative or absolute URL of web page to go to if the function is successful.
Y
Relative or absolute URL of web page to go to if the function fails.
Y
User ID in the Identikey Server.
Y
Digipass response.
Digipass challenge returned to the user.
Y
Y
Required?
Note
If you make dpcgi_challenge a visible form field, make sure that it is not modifiable. An alternative is to make it a hidden form field, while also displaying the challenge in HTML text rather than as a form field.
Identikey Server Administrator Reference
131
9.3.2
OTP Request Site
9.3.2.1 Request Page
The request page must contain the following fields:
Table 50: Form Fields for OTP Request Page
Name
Username
Password dpcgi_operation dpcgi_vdp_success_page dpcgi_vdp_fail_page dpcgi_vdp_wrongtoken_page
Type
text
Password
“VDPrequest”
Name of “OTP was sent” Page
Name of “OTP not sent” Page
Name of “Not a Virtual Digipass” Page
Web Sites
Visible
Visible
Hidden
Hidden
Hidden
Hidden
Identikey Server Administrator Reference
132
Web Sites
9.4
Query String Variables
The query string variables that are passed to the web pages by the CGI program are mainly concerned with status and error reporting. There is also a variable that is used to pass a challenge to the pages that display one.
9.4.1
Failure/Error Handling
There are three main groups of failures that can occur, which should be handled in a different manner. In all cases there is a numeric error code, however in some cases there is an auxiliary code and message such as the return code and message from the Identikey Server. The main error codes will be assigned in three separate ranges, so that the web pages can identify which category of error is returned.
API return codes – these are returned by the VASCO API used to make the authentication request to the
Server. In some cases there will be an auxiliary code and message.
CGI errors – these errors are detected by the CGI program, mainly when the web pages are not providing or enforcing the posted form fields correctly. These will not generally have an auxiliary code and message, but it is possible.
Internal errors – these are technical errors that ‘should not occur’. In some cases there will be an auxiliary code and message.
The intention of using this code-based scheme is to allow translation and customization of the messages. The main error code will be translated into a message by the web pages themselves. The pages can also translate the auxiliary code into a message, for the Identikey Server codes, but normally, the pages would not know how to translate it into a message, and should display the auxiliary message as provided.
Identikey Server Administrator Reference
133
Web Sites
9.4.2
Query String Variable List
The following table indicates which variables are used for the User Self Management Web Site and the required conditions:
Table 51: Query String Variable List
Variable
result challenge serialNo auxcode auxmsg
Value Condition Used by Site
0
<API return code, numeric>
<error code, numeric>
<challenge returned by API, string>
Successful authentication request Both
Unsuccessful authentication request Both
CGI or internal error occurred
Challenge returned by API
Both
User Self
Management Web
Site only
<Digipass Serial Number assigned>
<VACMAN Controller return code, numeric>
<additional error code for CGI or internal error, numeric>
<Message for VACMAN Controller return code, string>
<message for CGI or internal error, string>
Successful Auto- or Self-
Assignment
User Self
Management Web
Site only
Unsuccessful authentication request due to Controller rejecting password
Both
CGI or internal error occurred, where another error code is relevant
Both
Unsuccessful authentication request due to Controller rejecting password
Both
CGI or internal error occurred, where an error message is relevant
Both
Examples:
success: /vmsite/success.html?result=0 invalid Digipass response due to code replay: /vmsite/fail.html?result=1000&auxcode=2&auxmsg=Code+Replay+Attempt challenge: /vmsite/challenge.html?challenge=738453
Identikey Server Administrator Reference
134
Web Sites
9.4.3
Return Code Listing
In the following tables, the Message is the one that is provided by the standard web pages that we install.
9.4.3.1 API Return Codes
The following codes are the ones that in normal cases might be returned:
Table 52: API Return Codes
Code Message Auxiliary Code/
Message?
-1 Error during request to Server N
Notes
We are unable to distinguish the error from the client side of the API – the administrator would have to look at the
Audit Console.
9.4.3.2 CGI Errors
Table 53: CGI Error Return Codes
Code Message
-107
-108
-109
-110
-111
-112
-113
-114
-115
-100
-101
-102
-103
-104
-105
-106
Only the POST method is permitted
No dpcgi_operation was posted
An invalid dpcgi_operation was posted dpcgi_challenge_page cannot be used for this operation dpcgi_password cannot be used for this operation dpcgi_serialno cannot be used for this operation dpcgi_currentpin cannot be used for this operation dpcgi_newpin cannot be used for this operation dpcgi_confirmpin cannot be used for this operation dpcgi_challenge cannot be used for this operation dpcgi_success_page must be entered for this operation dpcgi_fail_page must be entered for this operation dpcgi_userid must be entered for this operation dpcgi_password must be entered for this operation dpcgi_response must be entered for this operation dpcgi_newpin must be entered for this operation
N
N
N
N
N
N
N
N
N
N
N
N
N
N
N
N
Auxiliary
Code/
Message?
Identikey Server Administrator Reference
135
Code Message
-121
-122
-123
-124
-131
-116
-117
-118
-119
-120
9.4.3.3 Internal Errors
dpcgi_confirmpin must be entered for this operation
A Digipass Response is required to assign a Digipass
A New PIN can only be set when assigning a Digipass
Enter the new PIN in the New PIN and Confirm New PIN fields
The New PIN and Confirm New PIN fields have different values
A challenge was returned, but there is no dpcgi_challenge_page
Unknown parameter
The Content-Length passed in was invalid dpcgi_serialno must be entered for this operation
Wrong token page is forbidden
Table 54: Internal Error Codes
Code Message
-1007
-1008
-1009
-1010
-1011
-1012
-1014
-1015
-1016
-1000
-1001
-1002
-1003
-1004
-1005
-1006
Identikey Server Administrator Reference
Cannot read Trace-Mask configuration setting
Cannot read Trace-File configuration setting
Cannot open Trace-File
Cannot read Source-IP-Address configuration setting
Cannot read Server1-IP-Address configuration setting
Cannot read Server1-Port configuration setting
Cannot read Server2-IP-Address configuration setting
Cannot read Server2-Port configuration setting
Invalid configuration setting Source-IP-Address
Invalid configuration setting Server1-IP-Address
Invalid configuration setting Server1-Port
Invalid configuration setting Server2-IP-Address
Invalid configuration setting Server2-Port
Cannot read HTTP request data
Request to Server not completed
Cannot read Self-Management Site registry key
Y
Y
N
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
Y
Auxiliary
Code/
Message?
136
Web Sites
N
N
N
N
N
N
N
N
N
N
Auxiliary
Code/
Message?
-1030
-1031
-1032
-1033
-1034
-1040
-1017
-1018
-1019
-1020
-1021
Code Message
The specified Source-IP-Address is not on this machine
Cannot read Trace-Header configuration setting
Invalid configuration setting Trace-Header
The Trace file name must not contains quotes ' or ".
No File found in the trace file <trace file name>
Error reading Server 1 Secret - return code was <return code>
Error reading Server 2 Secret - return code was <return code>
Error reading No of Retries - return code was <return code>
Error reading Timeout - return code was <return code>
Error writing Protocol - return code was <return code>
The Shared Secret and Confirm Shared Secret do not match.
Web Sites
N
N
N
N
N
N
N
N
N
Y
Y
Auxiliary
Code/
Message?
Identikey Server Administrator Reference
137
Shkarko
Lidhja publike u përditësua
Lidhja publike për bisedën tuaj është përditësuar. You may view and manage your chat links after registration here.
Lidhja publike e dokumentit
Reklamë
