IDENTIKEY Appliance Administration Guide

190 Pages·2016·14.96 MB·English

®
IDENTIKEY Appliance
Administrator Guide
3.17
DisclaimerofWarrantiesandLimitationsofLiabilities
LegalNotices
Copyright©2008–2019OneSpanNorthAmerica,Inc.Allrightsreserved.
Trademarks
OneSpan™,DIGIPASS® andCRONTO® are registeredor unregisteredtrademarksofOneSpanNorthAmerica Inc.,
OneSpanNVand/orOneSpanInternationalGmbH(collectively"OneSpan")intheU.S.andothercountries.
OneSpanreservesallrightstothetrademarks,servicemarksandlogosofOneSpananditssubsidiaries.
Allothertrademarksortradenamesarethepropertyoftheirrespectiveowners.
IntellectualProperty
OneSpanSoftware,documentsandrelatedmaterials(“Materials”)containproprietaryandconfidential information.
All title, rights and interest in OneSpan Software and Materials, updates and upgrades thereof, including software
rights,copyrights,patentrights,industrialdesignrights,tradesecretrights,suigenerisdatabaserights,andallother
intellectualandindustrialpropertyrights,vestexclusivelyinOneSpanoritslicensors.NoOneSpanSoftwareorMater-
ialsmaybe downloaded,copied,transferred,disclosed,reproduced,redistributed,or transmittedinanyform or by
any means, electronic, mechanical or otherwise, for any commercial or production purpose, except as otherwise
markedorwhenexpresslypermittedbyOneSpaninwriting.
Disclaimer
OneSpanacceptsnoliabilityfortheaccuracy,completeness,ortimelinessofcontent,orforthereliabilityoflinksto
andcontentofexternalorthirdpartywebsites.
OneSpanshallhavenoliabilityunderanycircumstancesforanyloss,damage,orexpenseincurredbyyou,yourcom-
pany,oranythirdpartyarisingfromtheuseorinabilitytouseOneSpanSoftwareorMaterials,oranythirdpartymater-
ial made available or downloadable. OneSpan will not be liable in relation to any loss/damage caused by
modificationoftheseLegalNoticesorcontent.
Reservation
OneSpanreservestherighttomodifytheseNoticesandthecontentatanytime.OneSpanlikewisereservestheright
towithdraw orrevokeconsentorotherwiseprohibituseoftheOneSpanSoftwareorMaterialsifsuchusedoesnot
conform tothetermsofanywrittenagreementbetweenOneSpanandyou,orotherapplicabletermsthatOneSpan
publishesfromtimetotime.
Contactus
Visitourwebsite:https://www.onespan.com
Resourcecenter:https://www.onespan.com/resource-center
Technicalsupportandknowledgebase:https://www.onespan.com/support
Ifthereisnosolutionintheknowledgebase,contactthecompanythatsuppliedyouwiththeOneSpanproduct.
Datelastmodified:2/22/2019
TableofContents
Tableof Contents
1. Introduction 16
1.1.IDENTIKEYApplianceDocumentationSet 16
2. AdministrationInterfacesforIDENTIKEYAppliance 17
2.1.AdministrationInterfaces 17
2.2.AccessingtheConfigurationToolandtheAdministrationWebInterface 17
2.3. Logging On to IDENTIKEY Appliance Configuration Tool and IDENTIKEY Authentication Server Administration
WebInterface 18
3. ManualSettingsintheConfigurationTool 22
3.1.EnablingServices 22
4. IDENTIKEYApplianceAdministrationWebInterfaceBasicConfiguration 24
4.1.ClientComponentRecords 24
4.2.ClientComponentTypes 25
4.3.UserRecords 28
4.4.DIGIPASSRecordsandAssignment 29
4.5.DIGIPASSLicensingandActivation 32
5. IDENTIKEYApplianceAdministrationWebInterface:UserDashboard 36
5.1.WorkingwiththeUserDashboard 36
5.2.ViewAuditMessagePage 39
5.3.GeneratingReportsviatheReportsTab 40
5.4.ConfiguringtheUserDashboard 40
6. SystemAdministratorAccounts 42
6.1.DisablingtheDefaultsysadminUserAccount 42
6.2.CreatingAdditionalAdministratorAccounts 43
7. TypicalDIGIPASSAuthenticationModuleSetup 45
7.1.CreateaClientComponent 45
IDENTIKEYAppliance3.17–AdministratorGuide iii
TableofContents
8. TypicalRADIUS Setup 49
8.1.RADIUSClientConfiguration 49
9. DIGIPASSAuthenticationforWindowsLogon 52
9.1.ConfiguringIDENTIKEYAppliance 52
9.2.ConfiguringPasswordRandomization 54
9.3.ExportingtheServerCertificate(Optional) 56
9.4.InstallingandConfiguringtheClientSoftware 56
10. LDAP UserSynchronization 57
10.1.Overview 57
10.2.LDAP SynchronizationProfiles 58
10.3.MicrosoftActiveDirectorySynchronization 60
10.4.NetIQeDirectorySynchronization 62
10.5.OtherLDAP ServerSynchronizations 63
11. Back-EndAuthentication 65
11.1.RADIUS Back-EndAuthentication 66
11.2.NetIQeDirectoryBack-EndAuthentication 69
11.3.MicrosoftActiveDirectoryBack-EndAuthentication 70
11.4.IBMSecurityDirectoryServerBack-EndAuthentication 75
12. Replication 76
12.1.ReplicationWizard 76
13. SecureSocketsLayer(SSL) 84
13.1.ManagingCertificates 84
13.2.UsingServerCertificates 86
13.3.UsingCACertificatesforClientVerification 88
14. SettingUpSigningandProvisioning 91
14.1.SOAP CommunicationProtocol 91
IDENTIKEYAppliance3.17–AdministratorGuide iv
TableofContents
14.2.EnablingSigningand ProvisioningServices 91
14.3.ConfiguringSignatureandProvisioningSetups 91
15. SettingUpVirtualMobileAuthenticator 92
15.1.ImportingVirtualMobileAuthenticatorRecords 92
15.2.SettingUpMessageDeliveryComponent(MDC) 92
15.3.SettingUpIDENTIKEYAppliancePoliciesforVirtualMobileAuthenticator 95
15.4.TestingVirtualMobileAuthenticator 98
15.5.AssigningPoliciestoClientsforUsingVirtualMobileAuthenticator 99
16. Reporting 100
16.1.WorkingWithReports 100
16.2.CreatingReportsUsingtheReportDefinitionWizard 103
16.3.PDF andHTML ReportCustomization 104
16.4.ReportRetrieval 107
17. ConfiguringRADIUS Environments 108
17.1.Stand-AloneIDENTIKEYApplianceinRADIUSEnvironment 108
17.2.IDENTIKEYApplianceasRADIUSProxyTarget 109
17.3.IDENTIKEYApplianceasIntermediateServer 111
17.4.WirelessRADIUS 113
17.5.CustomizingtheRADIUS AttributesDictionary 117
18. IDENTIKEYAuthenticationServerDiscovery 119
18.1.RegisteringIDENTIKEYAppliancewithDNSServer 119
18.2.ServerDiscovery 119
19. TestPolicySettings 122
19.1.BasicTestingProcedure-PrerequisitesandConfigurations 122
19.2.TestLocalAuthentication 124
19.3.TestRADIUSBack-EndAuthentication 125
IDENTIKEYAppliance3.17–AdministratorGuide v
TableofContents
19.4.TestManagementFeatures 128
20. AdministrationTasks 133
20.1.ScheduledTaskManagement 133
21. Monitoring 134
21.1.Overview 134
21.2.DiskUse 135
21.3.Logging 135
21.4.Auditing 141
21.5.Tracing 151
21.6.ConfiguringSNMP 155
21.7.DownloadingVASCOMIB Files 159
22. PerformanceMonitoring 161
22.1.Filters 161
22.2.Plugins 163
23. SystemMonitoring 164
23.1.ConfiguringSystemMonitoringforSystemOS Events 164
23.2.ConfiguringSystemMonitoringforIDENTIKEYApplianceConfigurationToolEvents 166
23.3.ConfiguringSystemMonitoringforIDENTIKEYAuthenticationServerEvents 169
23.4.ConfiguringSNMP TrapHandlers 170
23.5.BestPracticesforSNMP Targets 171
24. Troubleshooting 173
24.1.ConnectionProblems 173
24.2.DynamicComponentRegistrationProblems 173
24.3.AdministrationWebInterfaceConnectivity 174
24.4.DIGIPASSUserAccountLocking 174
24.5.DIGIPASSEventCounterOutofSync 176
IDENTIKEYAppliance3.17–AdministratorGuide vi
TableofContents
24.6.WirelessRADIUSAuthenticationFailures 178
24.7.LDAP UserSynchronizationIssues 179
24.8.LDAP Back-EndAuthenticationSetupIssues 180
25. Support 182
25.1.SupportProcedure 182
25.2.AllowingRemoteSupportConnections 182
IDENTIKEYAppliance3.17–AdministratorGuide vii
TableofContents
Illustration Index
Image1:IDENTIKEYApplianceConfigurationToolSSL CertificateWarning 18
Image2:LoginPages-IDENTIKEYApplianceConfigurationToolandIDENTIKEYAuthenticationServerAdministrationWebInterface 19
Image3:IDENTIKEYAuthenticationServerAdministrationWebInterfaceHomePage 20
Image4:IDENTIKEYApplianceConfigurationTool HomePage 21
Image5:EnablingorDisablingServicesinIDENTIKEYAppliance ConfigurationTool 23
Image6:AddingaClientComponentinIDENTIKEYAuthenticationServerAdministrationWebInterface 25
Image7:AddingaClientComponentinIDENTIKEYAuthenticationServerAdministrationWebInterface 29
Image8:AddingaClientComponentinIDENTIKEYAuthenticationServerAdministrationWebInterface 30
Image9:DIGIPASSAssignment 31
Image10:DisablingtheUserAccountsysadmin 42
Image11:CreatingUserAccount(1)–CompletingUserDetails 44
Image12:CreatingUserAccount(2)–EditingAdministrationPrivileges 44
Image13:RegisteringClientsintheIDENTIKEYAuthenticationServerAdministrationWebInterface 46
Image14:CreateanewadministrationprogramclientintheIDENTIKEYAuthenticationServerAdministrationWebInterface 47
Image15:Stand-AloneIDENTIKEYApplianceinaRADIUS Environment 49
Image16:RegisteringClientsintheIDENTIKEYAuthenticationServerAdministrationWebInterface 50
Image17:CreateaNewRADIUS ClientintheIDENTIKEYAuthenticationServerAdministrationWebInterface 51
Image18:ConfigurationofIP-to-NameResolvingintheIDENTIKEYApplianceConfigurationTool 53
Image19:ConfiguringPasswordRandomization 55
Image20:CreatingLDAP SynchronizationProfilesintheConfigurationTool 58
Image21:ConfiguringtheLDAP SynchronizationProfile 59
Image22:ExampleFilterandAttributeMappingsforMicrosoftActiveDirectory2003/2008 61
Image23:PropertiesofanExampleObjectinMicrosoftActiveDirectory 62
Image24:ExampleFilterandAttributeMappingsforNetIQeDirectory 63
Image25:IDENTIKEYApplianceasIntermediateServerforOTP only 65
Image26:AuthenticationBack-Ends 66
Image27:EditingRADIUS Back-EndPolicy 68
Image28:ManualConfigurationoftheSimplePassword 70
IDENTIKEYAppliance3.17–AdministratorGuide viii
TableofContents
Image29:ConfiguringActiveDirectory DomainControllerforIDENTIKEYAppliance 72
Image30:GlobalCatalogServerSettingsforIDENTIKEYAppliance 74
Image31:ReplicationWizardStep1-WelcomeScreen 77
Image32:ReplicationWizardStep2-RemoteIP Address 78
Image33:ReplicationWizardStep3-SetUpReplication 78
Image34:ReplicationWizardStep3-SetUpProcessing 79
Image35:ReplicationSetupProcessingScreenFeedback 80
Image36:ReplicationStatusintheIDENTIKEYAppliance ConfigurationTool 81
Image37:ReplicationStatusintheIDENTIKEYAuthenticationServerAdministrationWebInterface 82
Image38:RemoveReplicationWizardWelcomeScreen 83
Image39:RemoveReplicationWizard-RemovalProcessing 83
Image40:ServerCertificateConfiguration(SEAL) 88
Image41:ClientCertificateConfiguration(SEAL) 90
Image42:CustomizedReportDataFlow 105
Image43:Stand-AloneIDENTIKEYApplianceinaRADIUSEnvironment 108
Image44:IDENTIKEYApplianceasRADIUSProxyServer 110
Image45:IDENTIKEYApplianceasIntermediateServer(OTP-Only) 111
Image46:IDENTIKEYApplianceasIntermediateServer(OTP-Password) 112
Image47:WirelessRADIUS Components 113
Image48:RoamingWirelessConnections-AssigningtheSameSSIDtoAllWirelessAccessPoints 116
Image49:RoamingWirelessConnections-PolicyandComponentRecordDetails 117
Image50:UploadingaCustomRADIUSDictionary 118
Image51:ConfigurationToolIDENTIKEYAuthenticationServerDiscoverywithoutAuthenticationType 120
Image52:ConfigurationToolIDENTIKEYAuthenticationServerDiscoverywithTSIG asAuthenticationType 121
Image53:IDENTIKEYApplianceConfigurationToolDiskUseOverview 135
Image54:ConfiguringLogging 136
Image55:ConfiguringRemoteLogging 137
Image56:LiveLogViewer 138
Image57:ViewingLogs 138
IDENTIKEYAppliance3.17–AdministratorGuide ix
TableofContents
Image58:SimpleLogFilterEntryandResult 139
Image59:UsingtheAdvancedFilter 139
Image60:AdvancedLogFilterFields 140
Image61:DownloadingSystemLogFiles 141
Image62:ConfiguringIDENTIKEYAuthenticationServerAuditSettingsintheConfigurationTool 142
Image63:LiveAuditViewer 144
Image64:ViewingtheLiveAuditViewer 144
Image65:SimpleAuditFilterEntryandResult 145
Image66:UsingtheAdvancedFilter 145
Image67:AdvancedAuditFilterFields 146
Image68:ExportingfromtheAuditViewer 147
Image69:ExportingAuditFiles 147
Image70:DownloadingAuditFiles 149
Image71:ConfiguringTracingforIDENTIKEYAuthenticationServer 152
Image72:ConfiguringTracingforMessageDeliveryComponent(MDC) 153
Image73:ConfiguringTracingforLDAP UserSynchronization 154
Image74:ManagingTraceFiles 155
Image75:ConfiguringSNMP v2c 157
Image76:ConfiguringSNMP v3 157
Image77:DownloadingVASCO MIB Files 160
Image78:AddingFilterinPerformanceMonitoring 162
Image79:ConfiguringNotificationSettings 167
Image80:ConfiguringSupportConnections 183
Image81:SelectingSupportCertificate 183
IDENTIKEYAppliance3.17–AdministratorGuide x