Troubleshooting DIGIPASS Authentication for Windows Logon (DAWL) Off-line data uploading.

Transcription

1 KB Troubleshooting DIGIPASS Authentication for Windows Logon (DAWL) Off-line data uploading. Creation date: 21/11/2013 Last Review: 4/12/2014 Revision number: 2 Document type: Documentation Security status: EXTERNAL Summary Several Problems and conditions can prevent the correct uploading of Off-line Data from IDENTIKEY Server to the DAWL Client. This KB will explain the most common problems and possible solutions. Problem details. These are the conditions for IDENTIKEY Server to send Off-line data: IDENTIKEY Server must receive an authentication request from a DAWL client and The policy connected to the DAWL client must have Offline Auth Enabled : [Yes] and The user must have a DIGIPASS assigned and There must be valid Back-end authentication performed. When these conditions are met; IDENTIKEY Server will send the off-line data to the DAWL client. The data must be received correctly. Time-out on the connection is also a possible problem. If you enable the full trace file of IDENTIKEY Server you can verify if the first condition is met: Identikey must receive an authentication request from a DAWL client If you do not see the request in the trace file, then there may be a configuration problem on the DAWL client, or a network problem can be preventing the communication. Page 1 of 8

2 Depending on the settings in the DAWL Client (with or without DNS lookup see the screen shots above) you need to verify the IP address of the IDENTIKEY Server and/or the DNS record. Also verify if there are (personal) firewalls or malware preventing the use of the SEAL port (20004). If the request is entering the trace file, you can start looking for the other conditions that needs to be met: [2012/11/22 09:59: UTC][02932][MAJOR][0x ][ssl_accept] > No CA certificate store provided. [2012/11/22 09:59: UTC][02932][DEBUG][0x ][ssl_accept] > Applying setting: SSL_VERIFY_NONE [2012/11/22 09:59: UTC][02932][DEBUG][0x ][ssl_accept] > Applying setting: ~SSL_VERIFY_CLIENT_ONCE [2012/11/22 09:59: UTC][02932][RESRC][0x ][CListenSocket::accept] > Accepted connection <4> on < : 20004> from < : 58312> Here the connection is coming in [2012/11/22 09:59: UTC][02932][INFO ][0x ][SealFrontEndHandler::handleMessage] > Test socket <4> [2012/11/22 09:59: UTC][02932][INFO ][0x ][SealFrontEndHandler::handleMessage] > Test socket <4> [2012/11/22 09:59: UTC][02608][VINFO][0x000000B5][SealServer::receive] > Message received from < : 58312> size <47> bytes.. [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][ComponentLoader::fetchComponent] > Existing Component record [Identikey Server: ] returned from Component Cache [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][ComponentCheckUtils::checkServerComponent] > Scenario field <WindowsLogon> was successfully located in license. [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][ComponentCheckUtils::checkServerComponent] > Server component and license check succeeded [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][ComponentLoader::fetchComponent] > Existing Component record [Identikey Windows Logon Client:w7dawl.vdsi.local] returned from Component Cache In this case the client already existed [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][ComponentCheckUtils::checkClientComponent] > Client component check succeeded [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][ComponentCheckUtils::checkClientComponent] > Client license check succeeded [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][AuthenticateRequest::execute] > Processing user authentication request... [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][AuthenticateRequest::execute] > Fast authentication is <false> [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][AuthenticateRequest::execute] > Password format is [Cleartext combined] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > *** Effective Policy Settings *** [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Policy ID : [mytest] Policy usedby the client [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Parent Policy ID : [Windows Page 2 of 8

3 Logon Online and Offline Auth - Windows Back-End] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > DUR : [Yes] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Autolearn : [Yes] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Stored Pwd Proxy : [Yes] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Assignment Mode : [Neither] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Assign Search Up OU Path : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Grace Period : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Application Names : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Application Type : [No Restriction] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Digipass Types : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Local Authentication : [Digipass/Password] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > BackEnd Authentication : [Always] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > BackEnd Protocol ID : [Windows] Back-end is configured [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Default Domain : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Group List : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Group Check Mode : [No Check] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > User Lock Threshold : [3] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > One-Step Chall/Response : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > One-Step CR Chall Length : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > One-Step CR Check Digit : [1] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Backup VDP Enabled : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Backup VDP Maximum Days : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Backup VDP Max Uses : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Pin Change Allowed : [Yes] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Self-Assign Separator : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Challenge Request Method : [Keyword] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Challenge Request Keyword : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Primary VDP Rqst Method : [Password] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Primary VDP Rqst Keyword : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Backup VDP Rqst Method : [KeywordPassword] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Backup VDP Rqst Keyword : [otp] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > ITimeWindow : [20] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > STimeWindow : [20] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > EventWindow : [20] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > SyncWindow : [6] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > IThreshold : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > SThreshold : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Check Challenge : [1] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > OnlineSG : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Check Inactive Days : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Offline Auth Enabled : [Yes] Offline authentication is enabled [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Offline Time Interval : [2] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Offline Max Events : [300] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > DCR : [Yes] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Chg Win Pwd Enabled : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Chg Win Pwd Length : [16] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Client Group List : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Client Group Mode : [No Check] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > 2OTP Sync Enabled : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > VDP Delivery Method : [SMS] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Reply Radius Attribute Enabled : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Radius Attribute Group List : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Radius Allowed Protocols : [Any] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Radius Session Lifetime : [3600] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Radius Session Ticket Lifetime : [86400] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Radius Session Ticket Reuse : [48] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Radius Session Group List : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Diff To Prev : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Min Length : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Min Lower Alpha : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Min Upper Alpha : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Min Number : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Min Symbol : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Static Password Not UserId Based : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Multi Digipass Application Mode : [Multiple DIGIPASS Applications Allowed] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > Privileged Users : [Reject] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Policy::traceDetails] > ********************************* [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][UserChecks::resolveUserAndGroupCheck] > userid is [test2] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][UserChecks::resolveUserAndGroupCheck] > domain is [vdsi.local] Page 3 of 8

4 [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][ODBCStorageConnector::connect] > Trying to connect to the ODBC data source [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][UserChecks::userChecks] > Digipass User account found [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][UserChecks::userChecks] > Checking User login inactivity: 'true' [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][UserChecks::userChecks] > User login inactivity time: [0] [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][UserChecks::userChecks] > Setting m_userchecksstate to [User Exists] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > *** User Details *** [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > User ID : [test2] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Mobile no. : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > . : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Domain : [vdsi.local] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Org Unit : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > LDAP DN : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Local Auth : [Digipass/Password] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Back End Auth : [Always]Here some policy settings can be overruled by the user settings (wich is not the case here) [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Offline Auth Enabled : [Yes] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Use DP from UserID : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Use DP from domain : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > Use DP from LDAP DN: [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][User::traceDetails] > ******************** [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][UserChecks::adminPrivilegeCheck] > 'Privileged Users' policy setting set to 'Reject' however this user does not have administrative privileges. The admin privilege check for this user has therefore succeeded. [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][LocalAuthenticationChecks::localVerification] > Length of password entered is [6] bytes [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdsdomain, vdsserialno, vdsorgunit, vdsdptype, vdsgpexpires, vdsbvdpenabled, vdsbvdpexpires, vdsbvdpusesleft, vdsuserid, vdsdpsoftparamsid, vdsactivlocs, vdsactivcount, vdslastactivtime FROM vdsdigipass WHERE (vdsdomain =?) AND vdsorgunit IS NULL AND (vdsuserid =?) ORDER BY vdsdomain, vdsserialno, vdsdpdescription" [2012/11/22 09:59: UTC][02608][LOCAT][0x ][ODBCStatement::BindString] > Encoding of string: UTF-16LE [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindString] > Bound parameter 1 to string "vdsi.local" [2012/11/22 09:59: UTC][02608][LOCAT][0x ][ODBCStatement::BindString] > Encoding of string: UTF-16LE [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindString] > Bound parameter 2 to string "test2" [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCResultSet::GetRowCount] > Returned row-count 1 [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdsdpapplication.vdsserialno, vdsdpapplication.vdsapplname, vdsdpapplication.vdsapplno, vdsdpapplication.vdsappltype, vdsdpapplication.vdsactive, vdsdpapplication.vdsblob, vdsdigipass.vdsdomain, vdsdigipass.vdsorgunit, vdsdigipass.vdsuserid, vdsdpapplication.vdscreatetime, vdsdpapplication.vdsmodifytime, vdsdpapplication.vdsstoragekeyid, vdsdpapplication.vdssensitivekeyid FROM (vdsdpapplication INNER JOIN vdsdigipass ON (vdsdpapplication.vdsserialno = vdsdigipass.vdsserialno)) WHERE (vdsdpapplication.vdsserialno =?) ORDER BY vdsdpapplication.vdsserialno, vdsdpapplication.vdsapplname" [2012/11/22 09:59: UTC][02608][LOCAT][0x ][ODBCStatement::BindString] > Encoding of string: UTF-16LE [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindString] > Bound parameter 1 to string "VES " [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCResultSet::GetRowCount] > Returned row-count 1 [2012/11/22 09:59: UTC][02608][LOCAT][0x000000B6][ODBCStorageConnector::sensitiveFieldAttribute] > Field ID [8 - vdsblob] in attribute type [Digipass Application] is encrypted. [2012/11/22 09:59: UTC][02608][LOCAT][0x000000B6][ODBCStorageConnector::sensitiveFieldAttribute] > Field ID [8 - vdsblob] in attribute type [Digipass Application] is sensitive. [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][vasco::CryptoEngine::storageDecrypt] > Decrypting digipass Blob. [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][vasco::CryptoEngine::storageDecrypt] > Decrypting digipass Blob. [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][vasco::CryptoEngine::decryptWithEmbeddedProvider] > Decrypt the content using embedded crypto provider. [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][SoftwareCryptoBase::preDecryptProcess] > First 2 byte of cipher text 0x[00] 0x[0A] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][SoftwareCryptoBase::custom_aes128cbc_key_derive] > Block size for aes is [16] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][vasco::CryptoEngine::decryptWithEmbeddedProvider] > Data is decrypted using embedded crypto provider. [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > *** Digipass Details *** [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Serial No. : [VES ] Digipass for user found. User has Digipass assigned [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Domin : [vdsi.local] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Org Unit : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > LDAP DN : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Backup VDP Enabled : [No] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Grace Period Expiry : [2012/10/10] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Backup VDP Expiry : [] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > Backup VDP Uses Left: [] Page 4 of 8

5 [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][Digipass::traceDetails] > ************************ [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdscomponenttype, vdslocation, vdsdomain, vdsuserid, vdsserialno, vdseventwindow, vdseventcounter, vdsregenrequired, vdsstarttime, vdsendtime, vdscreatetime, vdsmodifytime FROM vdsofflinedata WHERE (vdsdomain =?) AND (vdsuserid =?) ORDER BY vdscomponenttype, vdslocation, vdsdomain, vdsuserid, vdsserialno" [2012/11/22 09:59: UTC][02608][LOCAT][0x ][ODBCStatement::BindString] > Encoding of string: UTF-16LE [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindString] > Bound parameter 1 to string "vdsi.local" [2012/11/22 09:59: UTC][02608][LOCAT][0x ][ODBCStatement::BindString] > Encoding of string: UTF-16LE [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindString] > Bound parameter 2 to string "test2" [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCResultSet::GetRowCount] > Returned row-count 0 [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][DigipassAppl::verifyPlainTextOTPCombined] > Combined parameters. [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][DigipassList::verifyResponse] > Response verification has been successful for digipass VES Here we can see that the OTP has been accepted [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][LocalAuthenticationChecks::doResponseChecking] > Set localauthstate to [Success - Existing DIGIPASS] [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > Fast authentication is <false>, will try to do backend auth [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > Password format is [Cleartext combined] [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > No password was entered [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > Stored Password Proxy is on - extracting password [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > Length of static password for back-end authentication is [4]Here we see that the stored static password is not empty. We see the length of the static password used (for back-end authentication) [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][BackEndSelector::getServerList] > Cached backend server list contains no servers for protocol ID <Windows> domain <vdsi.local> [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > Authenticating user with backend authenticator. Auth params are: {User ID : test2} {Password : ********} {Domain Name : vdsi.local} {Password Format : 0} {Static Password : ********} {Component Type : Identikey Windows Logon Client} Server list is: 0 attributes [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][WindowsBackEndAuthenticator::authenticate] > User ID : test2 [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][WindowsBackEndAuthenticator::authenticate] > Domain : vdsi.local [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][WindowsBackEndAuthenticator::authenticate] > Logon-Provider: Standard [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][WindowsBackEndAuthenticator::authenticate] > Successful Windows Authentication: 1 [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][BackEndAuthenticationChecks::backEndVerification] > Setting m_backendauthstate to [Success] Back end authentication succeeded [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][LocalAuthenticationChecks::generateOfflineAuthData] > Generating offline authentication data [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][LocalAuthenticationChecks::generateOfflineAuthData] > Generating encrypted offline data Page 5 of 8

6 [2012/11/22 09:59: UTC][02608][INFO ][0x ][SoftwareCryptoBase::legacy_encrypt] > Encrypting data using different cipher <7> to current configuration <7> [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][LocalAuthenticationChecks::generateOfflineAuthData] > Generating offline state data [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][LocalAuthenticationChecks::generateOfflineAuthHashData] > Generating offline hash data [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][LocalAuthenticationChecks::generateOfflineAuthData] > Offline authentication data generated successfully. [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B6][AuthenticateRequest::calculateExitState] > User checks state is [User Exists], local auth state is [Success - Existing DIGIPASS], backend auth state is [Success] [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][AuthenticateRequest::dbUpdate] > Fast authentication is <false> [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > *** OfflineData Details *** [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Component Type : [Identikey Windows Logon Client] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Component Location : [w7dawl.vdsi.local] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Domain Name : [vdsi.local] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > User Id : [test2] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Digipass Serial No : [VES ] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Event Window : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Event Counter : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Start Time : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > End Time : [0] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > Regen Required : [2] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][OfflineData::traceDetails] > ******************** [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][User::createOfflineData] > Created Offline Data record [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][DigipassList::update] > Updating 1 digipasses. [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getKeyData] > key [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMStorageDataKey] > SSM Storage [2012/11/22 09:59: UTC][02608][DEBUG][0x ][ODBCConnection::TransactionStart] > Starting transaction [2012/11/22 09:59: UTC][02608][LOCAT][0x000000B6][ODBCStorageConnector::sensitiveFieldAttribute] > Field ID [8 - vdsblob] in attribute type [Digipass Application] is encrypted. [2012/11/22 09:59: UTC][02608][LOCAT][0x000000B6][ODBCStorageConnector::sensitiveFieldAttribute] > Field ID [8 - vdsblob] in attribute type [Digipass Application] is sensitive. [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][CryptoKeyLoader::getDefaultKeyData] > Default key usage [0] found in the cache [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][CryptoKeyDataFactory::createSSMSensitiveDataKey] > SSM Sensitive [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][SoftwareCryptoBase::legacy_custom_encrypt_aes128cbc] > aes_128_cbc block size [16] [2012/11/22 09:59: UTC][02608][DATA ][0x000000B6][SoftwareCryptoBase::custom_aes128cbc_key_derive] > Block size for aes is [16] [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::PrepareSQL] > Prepared SQL statement "UPDATE vdsdpapplication SET vdsapplno =?, vdsappltype =?, vdsactive =?, vdsblob =?, vdsmodifytime =?, vdsstoragekeyid =?, vdssensitivekeyid =? WHERE (vdsserialno =?) AND (vdsapplname =?)"Database is updated with the Page 6 of 8

7 new data [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindInteger] > Bound parameter 1 to integer 1 [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindInteger] > Bound parameter 2 to integer 0 [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindInteger] > Bound parameter 3 to integer 1 [2012/11/22 09:59: UTC][02608][LOCAT][0x ][ODBCStatement::BindString] > Encoding of string: UTF-16LE [2012/11/22 09:59: UTC][02608][DATA ][0x ][ODBCStatement::BindString] > Bound parameter 4 to string "********" [2012/11/22 09:59: UTC][02608][VINFO][0x ][Distributor::acquireConnection] > Node.Connector allocated [2012/11/22 09:59: UTC][02608][VINFO][0x ][Distributor::releaseConnection] > Node.Connector released [2012/11/22 09:59: UTC][02608][MAJOR][0x ][alert_record] > plugin not initialized [2012/11/22 09:59: UTC][02608][INFO ][0x ][adt_record] > Audit: {Success} {Authentication} {S } {User authentication was successful.} {0xD4DA89232BCCAB9F7DBCA5BA09579C80} [2012/11/22 09:59: UTC][02608][INFO ][0x ][adt_record] > Audit: {Policy ID:mytest, User ID:test2, Domain:vdsi.local, Input Details: {User ID : test2} {Password : ********} {Domain Name : vdsi.local} {Password Format : 0} {Component Type : Identikey Windows Logon Client}, Output Details: {User ID : test2} {Domain Name : vdsi.local} {Static Password : ********} {State Data : ********} {Hash Data : ********} {Hash Data Type : 2} {Encrypted Offline Data : ********} {Notification that a user has a token assigned : ********}, Serial No:VES , Application:AUTHENTICATE, Local Authentication:yes, Back-End Authentication:Windows, Source Location: , Client Location:w7dawl.vdsi.local, Client Type:Identikey Windows Logon Client} [2012/11/22 09:59: UTC][02608][VINFO][0x ][Distributor::acquireConnection] > Node.Connector allocated [2012/11/22 09:59: UTC][02608][VINFO][0x ][Distributor::releaseConnection] > Node.Connector released [2012/11/22 09:59: UTC][02608][MAJOR][0x ][alert_record] > plugin not initialized [2012/11/22 09:59: UTC][02608][INFO ][0x000000B6][AuthenticateRequest::execute] > User authentication request - exit state [Success] [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][CommandTask::process] > Finished executing scenario command, results are: ===================Command Results======================== <Result Codes: { Status Code: 'Call completed successfully (0)' ; Return Code: 'Success (0)' }> <Results: {User ID : test2} {Domain Name : vdsi.local} {Static Password : ********} {State Data : ********} {Hash Data : ********} {Hash Data Type : 2} {Encrypted Offline Data : ********} {Notification that a user has a token assigned : ********}> <Error stack: > ========================================================== [2012/11/22 09:59: UTC][02608][VINFO][0x000000B6][SealServer::send] > Message sent to < : 58312> size <135743> bytes Response is send to DAWL client [2012/11/22 09:59: UTC][02608][COUNT][0x ][ODBCConnection::Release] > Connection released [2012/11/22 09:59: UTC][02932][INFO ][0x ][SealFrontEndHandler::handleMessage] > Test socket <4> [2012/11/22 09:59: UTC][02608][VINFO][0x000000B7][SealServer::receive] > Message received from < : 58312> size <311> bytes [2012/11/22 09:59: UTC][02608][DEBUG][0x000000B7][SealMessageAdapter::SealMessageAdapter] > Tracing is configured for SealMessageAdapter [2012/11/22 09:59: UTC][02608][VINFO][0x000000B7][CommandTask::process] > Executing scenario command, passing command parameters: <Command Key: 'Object:'Credentials', Command:'Confirm Offline Data''> <Command Parameters: ' Type:Identikey Windows Logon Client, Source Location: } [2012/11/22 09:59: UTC][02608][VINFO][0x ][Distributor::acquireConnection] > Node.Connector allocated [2012/11/22 09:59: UTC][02608][VINFO][0x ][Distributor::releaseConnection] > Node.Connector released [2012/11/22 09:59: UTC][02608][MAJOR][0x ][alert_record] > plugin not initialized [2012/11/22 09:59: UTC][02608][VINFO][0x000000B7][CommandTask::process] > Finished executing scenario command, results are: ===================Command Results======================== <Result Codes: { Status Code: 'Call completed successfully (0)' ; Return Code: 'Success (0)' }> <Results: > <Error stack: > Page 7 of 8

8 ========================================================== [2012/11/22 09:59: UTC][02608][VINFO][0x000000B7][SealServer::send] > Message sent to < : 58312> size <63> bytes [2012/11/22 09:59: UTC][02608][COUNT][0x ][ODBCConnection::Release] > Connection released [2012/11/22 09:59: UTC][02932][INFO ][0x ][SealFrontEndHandler::handleMessage] > Test socket <4> [2012/11/22 09:59: UTC][02608][MINOR][0x ][CStreamSocket::read] > Socket <4> closed at other end - read cancelled [2012/11/22 09:59: UTC][02608][MINOR][0x000000B8][SealMessageTask::process] > SEAL connection was closed by the remote end This error message indicates that there was a problem sending the reply. Probably because the connection timed out. In case the connection times out, verify that the time out settings on the DAWL client are set to maximum (30s) Another way to prevent time-out is to limit the amount of off-line data that needs to be sent to the DAWL Client. The amount of off-line date to be sent is determined in the policy: (The larger these number, the bigger the off-line data, the longer it takes to create and send it to the DAWL client) Page 8 of 8