T-Pass. Administration Guide. Copyright 2011 Deepnet Security Limited. Copyright 2011, Deepnet Security. All Rights Reserved.

Transcription

1 Administration Guide Copyright 2011 Deepnet Security Limited Copyright 2011, Deepnet Security. All Rights Reserved. Page 1

2 Trademarks Deepnet Unified Authentication, MobileID, QuickID, PocketID, SafeID, GridID, FlashID, SmartID, TypeSense, VoiceSense, MobilePass, DevicePass, RemotePass and Site Stamp are trademarks of Deepnet Security Limited. All other brand names and product names are trademarks or registered trademarks of their respective owners. Copyrights Under the international copyright law, neither the Deepnet Security software or documentation may be copied, reproduced, translated or reduced to any electronic medium or machine readable form, in whole or in part, without the prior written consent of Deepnet Security. Licence Conditions Please read your licence agreement with Deepnet carefully and make sure you understand the exact terms of usage. In particular, for which projects, on which platforms and at which sites, you are allowed to use the product. You are not allowed to make any modifications to the product. If you feel the need for any modifications, please contact Deepnet Security. Disclaimer This document is provided as is without warranty of any kind, either expressed or implied, including, but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. This document could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the document. Deepnet Security may make improvements of and/or changes to the product described in this document at any time. Contact If you wish to obtain further information on this product or any other Deepnet Security products, you are always welcome to contact us. Deepnet Security Limited Northway House 1379 High Road London N20 9LP United Kingdom Tel: +44(0) Fax: +44(0) Web: support@deepnetsecurity.com Copyright 2011, Deepnet Security. All Rights Reserved. Page 2

3 Table of Contents Introduction... 4 Configuration... 4 Gateways... 4 Templates... 4 Token Provisioning... 4 Manual Provisioning... 4 Auto Provisioning... 6 Batch Deployment... 8 Password Delivery By Administrator By Users Windows and Web Applications...10 VPN/RADIUS Applications...11 Copyright 2011, Deepnet Security. All Rights Reserved. Page 3

4 Introduction is a token-less, on-demand one-time password authentication solution that delivers passwords to users phones via Text messages, Telephone calls, Twitter direct messages or messages. When a user requests account logon or online transaction, DualShield Authentication Server generates a one-time password (OTP) and sends the OTP to the user. When the user receives the message he/she enters the OTP into the login or transaction form. The OTP submitted by the user is then forwarded to authentication server to be verified. Upon the successful verification of the OTP the user is granted the permission to access their account or to complete the online transaction. Configuration Gateways supports 4 different channels for sending one-time passwords to users, namely SMS text messages, messages, twitter direct messages and telephone voice messages. Please refer to the DualShield Platform Administration guide for the instructions of configuring various message gateways. Templates You can customise the messages that DualShield sends out to users by changing the message templates. There are 2 message templates that are related to : One-Time Password One-Time Signature Token Provisioning Token Provisioning is a process that creates a token in a user s account in the DualShield server. DualShield provides 3 ways of provisioning tokens, namely Manual Provisioning, Auto Provisioning and Batch Deployment. Manual Provisioning To manually provision a token to a user, in the DualShield management console, navigate to the user directory ( Directories\Users ), and locate the user. Click the context menu of the user account, and select Tokens in the context menu: Copyright 2011, Deepnet Security. All Rights Reserved. Page 4

5 Click Create in the toolbar: Select in the Product dropdown list. The following fields are optional: PIN Mobile Twitter Telephone Copyright 2011, Deepnet Security. All Rights Reserved. Page 5

6 PIN An OTP token can optionally have a PIN. This is the so-called Token PIN or Server PIN, not the User PIN or Client PIN. A User/Client PIN is a PIN that the user set up on the client to lock the client software from being accessed by unauthorised people. A User/Client is not a part of the token and is never submitted to the server in the authentication process. A Token/Server PIN is a PIN that the user set up on the server as an extra password to be attached to an OTP (one-time password) generated from his/her token each time at logon. For instance, if an OTP is and PIN is 0987 then the password submitted in the authentication process is , assuming that the PIN is set to be appended to OTP by the PIN policy. Mobile, , Twitter and Telephone By default, when this field is left empty, DualShield will query the user database or directory server (AD/LDAP) for the user s mobile phone number or address. This field should only be provided with a mobile phone number or address if a) In your user database or directory server, there is no phone number or address stored b) The user wish to use a different phone number or address instead of the phone number or address stored in the user database or directory server. Click Save button to create the token for the user: Auto Provisioning In a large user base, manually provisioning a token to each user might not be practical. You can configure DualShield so that it will automatically provision a token to a user when needed. Auto Provisioning is a setting in the policy. In a authentication (logon) process, if a user selects to authenticate with an On-demand Password token, DualShield will first check if the user already has a token in his/her account. If there is no token found in the user s account, DualShield will then check the policy of the user. If the policy is set to auto provisioning, DualShield will then automatically create a token for the user. To configure the policy, navigate to the policy in the DualShield management console ( Administration\Policies ): Copyright 2011, Deepnet Security. All Rights Reserved. Page 6

7 By default, there is a pre-configured policy that is applied to the entire system. You might wish to create a custom policy and apply it to a specific domain/group/unit or user. You will need to configure the following options: Maximum Number of Tokens Send the next OTP as soon as the current OTP is used Overwrite the old OTP message on the user's phone Token Provisioning Token Activation Message Channel Maximum Number of Tokens Copyright 2011, Deepnet Security. All Rights Reserved. Page 7

8 The maximum number of tokens allowed in a user account. Send the next OTP as soon as the current OTP is used Turn on this option if you want DualShield to automatically send a new password to a user as soon as the user has successfully logged in, so that the user always has an OTP in hand for the next logon. Overwrite the old OTP message on the user's phone If this option is turned on, then new OTP text messages received by users will replace old OTP message on their phones. Token Provisioning Provision token automatically DualShield will automatically create a token for a user when needed. Do Nothing No action is required. Token Activation Automatically activate the token when created or assigned The token is automatically activated and useable as soon as it is created or assigned to the user. Send activation code to the user when created or assigned The token is not activated after it is created or assigned, and not useable until it is activated by the user. DualShield will automatically send an Activation Code to the user via the specified Message Channel. Do Nothing The token is not activated after it is created or assigned, and not useable until it is activated by the user. Message Channel SMS - SMS text message SMTP - message Twitter - Twitter direct message Telephone - Telephone voice call Batch Deployment Instead of manually provision a to an individual user, you can also deploy a T- Pass to all users in a domain, group or unit in a single step. To deploy a token to all users in a domain/unit/group, navigate to the domain/unit/group in the management console and click its context menu. Copyright 2011, Deepnet Security. All Rights Reserved. Page 8

9 Select Deploy Tokens Select the type of token product, i.e., and press Save button. Copyright 2011, Deepnet Security. All Rights Reserved. Page 9

10 Password Delivery is an on-demand password authentication product, which means that DualShield will only send a new one-time password to a user on the request from the user or by the system administrator (unless the option: Send the next OTP as soon as the current OTP is used in the policy is turned on). By Administrator The system administrator can send a new OTP of to a user by navigating to the token list of the user, and select Send OTP in the context menu of the token. By Users Users can request the DualShield server to send out a new OTP in the logon screen of the applications that they are trying to access. Windows and Web Applications On Window and Web applications, DualShield will provide links in the application s logon screen that the users can click to make the password delivery request: Copyright 2011, Deepnet Security. All Rights Reserved. Page 10

11 VPN/RADIUS Applications For VPN logon, DualShield does not install an authentication agent on the user s machine. Users will continue to use their current VPN client software without any modification by DualShield. In other words, there are no links on the VPN logon screen for user to click to make the request for password delivery. However, DualShield does provide alternative ways for users to make requests. Commands If the authentication method of a VPN application in DualShield is set to one of the following methods: Static Password Static Password + One-Time Password One-Time Password + Static Password Then, in order to ask DualShield to send out a new OTP, users will enter a command in the user name field in the VPN client logon window: Copyright 2011, Deepnet Security. All Rights Reserved. Page 11

12 A command starts with the > character, followed by one of the following commands and the user name itself. >sms >text > >tweet >call >phone >sms and >text commands are for sending OTP via SMS text message > command is for sending OTP by message >tweet is for sending OTP by twitter direct message >call and >phone are for sending OTP by voice over telephone calls If the policy requires static password authentication prior to sending OTP, then the user must also enter their static password in the password field. Challenge & Response If the authentication method of a VPN application in DualShield is set to one of the following methods: Static Password >> One-Time Password Static Password >> Challenge/Response Then, users do not need to enter a command. Instead, users will simply enter their user name and password and DualShield will automatically send a new OTP to the user as soon as the user is successfully verified by the user name and password provided. Copyright 2011, Deepnet Security. All Rights Reserved. Page 12