VASCO Digipass, Juniper SSL VPN configuration guide - Orbit One

2. Digipass deployment strategy2.1. Choose an Authentication methodAn important choice you have to make, is how users will need to authenticate. You have severaloptions:• Username + OTP onlyThis should NOT be used, if someone steals the Digipass, he can authenticate in yournetwork without the need to know any “secret”.• Username + OTP + PINThis is a safe way to authenticate, but it requires people to remember yet another PINcode...• Username + OTP + Active Directory passwordThis is our preferred way of authentication, your users are already familiar withauthentication using username and password. We just add the Digipass OTP to thiswhen they work remotely.• Username + OTP + PIN + Active Directory passwordThis is very safe but a bit overkill.See VACMAN Middleware Product Guide.pdf, page 13 for more information.2.2. Understanding Assignment modesYou need to decide how you will link the Digipass devices to your users.• Manual Assignment (see 5.3)The administrator manually assigns a Digipass device to each user in Active Directory.Then you physically give the Digipass with the correct serial number to the person.• Self-AssignmentYou give each user a Digipass device. You instruct the user how to “activate” his Digipassthe first time he will use it. This is called “self-assignment”.They will need to enter the following string in the password:No PIN = “SERIALNUMBERpasswordOTP”PIN active = “SERIALNUMBERpasswordPINOTPIn this document we use the “self-assignment” mode.See page 48 of the VACMAN Middleware Product Guide.pdf for more info.Orbit One InternalVASCO Digipass - Configuration with Juniper SA - 4 October 2008 7