Digipass Plug-In for IAS Product Guide - Vasco

Digipass Plug-In for IAS Product Guide Overview
1.4.2 Policies
Policies specify various login settings which can affect how a User must log in. The Policy used
for a specific authentication request is decided based on the RADIUS Client that transmitted
the request or based on the IAS Plug-In component that handles the request.
Some policy settings include:
Whether Local and/or Back-End Authentication should be used
Whether various automatic management features should be used
The Digipass Application types required for login
Backup Virtual Digipass settings
1.4.3 Digipass User Account
A Digipass User account is attached to an Active Directory User account, by including
additional attributes. These attributes are stored in an auxiliary class attached to the User
object class. The account is created to hold authentication settings for the IAS Plug-In. It
includes settings such as Digipass assignment and authentication overrides.
The Digipass User account contains some login settings that affect how a User must log in.
These settings can be used to override equivalent settings in the relevant Policy.
A Digipass User account is created as required for a User record in Active Directory – for
example when a Digipass must be assigned or Digipass User account settings modified. When
Auto-Assignment is enabled (see later), creation of the account via Dynamic User Registration
is the trigger for a Digipass to be automatically assigned to the User.
1.4.3.1 Digipass User Account Settings
Stored Static Password
This may be used when local authentication is enabled and back-end authentication disabled,
to avoid using the Windows static password for remote network access. It can be used for
authenticating a User when a Digipass has not been assigned, or the assigned Digipass is still
in the grace period. It can also be used for the Virtual Digipass feature, which requires a static
password to be used in addition to the transmitted OTP.
Local Authentication
See 1.4.1 Local and Back-End Authentication.
The Digipass User account setting overrides
the Policy setting of the same name.
Back-End Authentication
See 1.4.1 Local and Back-End Authentication.
The Digipass User account setting overrides
the Policy setting of the same name.
Disabled
Specifies whether the Active Directory User account has been disabled. If so, the User will be
rejected by the IAS Plug-In.
Locked
If a Digipass User account is locked, the User will be unable to log in until it is unlocked by an
administrator.
© 2005 VASCO Data Security Inc. 15