Digipass Plug-In for IAS Product Guide - Vasco

Digipass Plug-In for IAS Product Guide Digipass
2.3 Digipass Records
2.3.1 Location of Digipass Records
When a Digipass is assigned to a User, it is moved to the same location as the Digipass User
account it is assigned to. This makes it easier to set up the permissions necessary for
delegated administration.
Note
A Digipass record will not automatically be moved when the User account to
which it is assigned is moved to another location. When moving User accounts
within Active Directory, ensure that the records of any assigned Digipass are
manually moved to the same location.
Unassigned Digipass records may be stored in various places in the domain:
Digipass Pool
During installation, a container is created in the Domain called Digipass-Pool. This is intended
as a general store for unassigned Digipass, regardless of which administrator is performing
assignment.
Organizational Units
Digipass can be loaded or moved either into the exact Organizational Units where the User
accounts to which they will be assigned are located, or into a few key Organizational Units in
the hierarchy where they may be assigned to Users in lower level Organizational Units.
Users Container
Digipass can be loaded into the Users container, so they are available for Users in that
container. However, it is not recommended to use the Users container for either User accounts
or Digipass.
Note
The IAS Plug-In will always find or assign the closest available Digipass record
to the selected User record(s).
When looking for an available Digipass to assign to a User, the IAS Plug-In will first look in the
same location as the specific User account. The Search Upwards in Organizational Unit
hierarchy option, when enabled, allows the IAS Plug-In to search in parent Organizational
Units and the Digipass Pool container. This option may be set at the Policy level for system
searches (eg. Auto-Assignment and Self-Assignment) or at the time of the search for manual
assignment.
If the assignment is manual (performed by an administrator), it will only find and successfully
assign Digipass from locations where the administrator has the correct permissions. The
administrator must have read permission for Digipass objects in the location to find a Digipass
record, and if it needs to be moved to the User's location, they must have delete permission
for Digipass objects to successfully assign the Digipass. If the administrator has sufficient
© 2005 VASCO Data Security Inc. 30