Configuration
3.5.3
Policy
The Component record created during installation of the IIS 6 Module uses the default Password Replacement
Policy for the package. It will be named:
VM3 Windows Password Replacement (VACMAN Middleware)
Identikey Windows Password Replacement (Identikey Server)
Identikey Microsoft AD Password Replacement (aXs GUARD Identifier)
These Policies are configured with the following settings:
3.5.3.1
Note
These settings are all available on Windows but the VM3 Windows Password Replacement policy is not available on Identikey Server on Linux or the aXs GUARD Identifier, so the corresponding settings are not available on those platforms
Back-End Authentication is set to If Needed (used for DUR, Password Autolearn etc, not all logins).
Windows is used as the back-end authenticator in the VM3 Windows Password Replacement and Identikey
Windows Password Replacement Policies.
Dynamic User Registration, Password Autolearn and Stored Password Proxy are enabled.
Group Check Mode is set to Pass Back and Digipass Users is placed in the Group List. This will mean that any logins by Users not in the Digipass Users group will be ignored – not rejected – by the Authentication Server in the VM3 Windows Password Replacement and Identikey Windows Password Replacement Policies.
If you will need different settings, either select a different Policy (eg. Self-Assignment or Auto-Assignment ) for the
IIS 6 Module Component or copy the Password Replacement Policy to a new record, modify the new Policy as required, and use the new Policy for the IIS 6 Module Component.
Standard Policy Configurations for Citrix Web Interface
Digipass Users login with OTP only (Windows user accounts)
The following settings are recommended for this scenario:
Back-End Authentication
Back-End Authentication: If Needed
Back-End Protocol: Windows (Identikey Server and VACMAN Middleware) or Microsoft AD (aXs GUARD Identifier)
These settings allow the Authentication Server to check user login details with Windows or Active Directory in case of DUR, Password Autolearn and Self-Assignment logins through the IIS 6 Module.
Digipass Authentication for Citrix Web Interface Guide 52
Configuration
Digipass User Account Handling
Dynamic User Registration: Enabled
Password Autolearn: Enabled
Stored Password Proxy: Enabled
These settings allow the Authentication Server to create an account for an unrecognized User based on a successful Windows or Active Directory authentication. The Authentication Server can then store the User’s Active
Directory password and replay it to the IIS 6 Module in place of the One Time Password entered by the User on future logins.
Digipass Assignment Mode
Either Self-Assignment or Auto-Assignment would typically be used in this scenario, although manual assignment may also be used.
Local Authentication
The typical setting for local authentication would be Digipass/Password, meaning that Users usually need to use an
OTP when logging in, but are not required to in some circumstances (eg. in Grace Period).
Digipass Users login with Password and OTP (Windows user accounts)
The following settings are recommended for this scenario:
Back-End Authentication
Back-End Authentication: If Needed
Back-End Protocol: Windows (Identikey Server and VACMAN Middleware) or Microsoft AD (aXs GUARD Identifier)
These settings allow the Authentication Server to check user login details with Windows or Active Directory in case of DUR and Self-Assignment logins through the IIS 6 Module.
Digipass User Account Handling
Dynamic User Registration: Enabled
Password Autolearn: Disabled
Stored Password Proxy: Disabled
These settings allow the Authentication Server to create an account for an unrecognized User based on a successful Windows or Active Directory authentication. The Authentication Server will not store or replay a User’s
Windows or Active Directory password.
Digipass Authentication for Citrix Web Interface Guide 53
