Defender Configuring for Use with GrIDsure Tokens

Size: px

Start display at page:

Download "Defender Configuring for Use with GrIDsure Tokens"

Warren Kennedy
6 years ago
Views:

1 Configuring for Use with GrIDsure Tokens Introduction The GrIDsure token can be used to protect any website hosted on Internet Information Server (IIS). 5.6 supports the use of GrIDsure tokens with the Desktop Login application. Please follow the configuration steps in this document and refer to the Desktop Login GrIDsure Token User Guide. This guide provides information for the administrator on how to configure and IIS, using the ISAPI Agent, for use with the GrIDsure token. The instructions in this guide assume that a working system is in place with the required components installed and configured, refer to System Requirements. For further information on installation and configuration, refer to the Installation Guide and the Configuration Guide. 1

2 System Requirements Before configuring to use GrIDsure tokens, ensure that the following components are installed and configured in your system: Administration Console version or higher Security Server version or higher ISAPI Agent version or higher. Installing the GrIDsure Token License To enable GrIDsure tokens within, you must first install a GrIDsure Token License. 1. To do this, from Active Directory Users & Computers select the Install Desktop Token License option from the menu. the menu is available when the OU is selected. 2. The License Import Wizard starts. 3. Click Next to display the Import Wizard (License Files) dialog. 4. Click Add File to add your license file to the Licenses to install list. 5. Click on the required file, then click Open. The selected file is added to the Licenses to install list. 6. Click Next twice to complete the procedure. How to Program a GrIDsure Token GrIDsure tokens can be programmed: for a user by the Administrator, or created and registered by the users themselves through Auto-Enrollment. Programming a GrIDsure Token via the Administration Console 1. In Active Directory Users and Computers (ADUC), display the user properties page for the required user, then select the tab. 2

3 2. Click Program to start the Token Programming Wizard. 3. Click Next. The Token Types dialog is displayed: 3

If the user already has a GrIDsure token, the following dialog is displayed: You can choose to overwrite the user s existing

4 4. Select Desktop Token, then click Next. The Desktop Token Types dialog is displayed: 5. Select GrIDsure, then click Next. Note: A user can have only one GrIDsure token assigned to them at any one time. If the user already has a GrIDsure token, the following dialog is displayed: You can choose to overwrite the user s existing GrIDsure token or to leave the existing token. If you choose to overwrite the existing token, the user must register the new token before it can be used to authenticate. 4

5 6. The Checking User License dialog is displayed: 7. Click Next. The Token Programming Complete dialog is displayed: 5

6 8. Click Finish. The GrIDsure token is displayed in the Token Management field on the username Properties, tab. 9. If GrIDsure authentication is enabled in the token policy assigned to this user (refer to Creating/Editing a Policy for GrIDsure Tokens), the user will be required to configure his PIP the first time the token is used for authentication through a GrIDsure aware client, i.e. the ISAPI Agent or Desktop Login. 6

Creating/Editing a Policy for GrIDsure Tokens You now need to configure a Policy to use GrIDsure tokens. You can either modify an existing policy or create a new policy.

7 Creating/Editing a Policy for GrIDsure Tokens You now need to configure a Policy to use GrIDsure tokens. You can either modify an existing policy or create a new policy. For information on how to create a new policy, please refer to the Configuration Guide. To configure the policy for use with GrIDsure tokens where the tokens will be programmed by the Administrator, perform the following steps: 1. Select the OU from the Active Directory tree. 2. Select Policies. 3. Right-click on the required policy. 4. Select Properties from the menu. 5. The policyname -Properties Policy dialog box is displayed: 6. On the Policy tab, in the Authentication methods, Use field, select Token. 7

8 7. Select the GrIDsure tab: 8. Select Enable GrIDsure Tokens and set the pattern length as required. 9. Select OK. The policy is now configured for GrIDsure tokens. 10. Assign the policy to the relevant access node, Security Server, user or user group as required. For information on how to assign a security policy, please refer to the Configuration Guide. 8

GrIDsure Token Auto-Enrollment Mode To enable Auto-Enrollment, set the Authentication Method, Use field to Token (GrIDsure Auto-Enrollment Mode).

9 GrIDsure Token Auto-Enrollment Mode To enable Auto-Enrollment, set the Authentication Method, Use field to Token (GrIDsure Auto-Enrollment Mode). The first time that the user attempts to authenticate using a GrIDsure enabled policy, the GrIDsure token will be created and configured. Enabling User Auto-Enrollment for GrIDsure Tokens To configure the policy that will enable GrIDsure tokens to be created and configured when the user first attempts to authenticate, perform the following steps: 1. Select the OU from the Active Directory tree. 2. Select Policies. 3. Right-click on the required policy. 4. Select Properties from the menu.the policyname -Properties Policy dialog box is displayed: 5. On the Policy tab, in the Authentication methods, Use field, select Token (GrIDsure Auto-Enrollment Mode). 9

10 6. Select the GrIDsure tab: 7. Check the Enable GrIDsure Tokens checkbox, then click OK to finish. For information on how to authenticate in GrIDsure Auto-Enrollment Mode, refer to Accessing the Protected Website. 10

Additional Configuration Options During configuration, the following options can be set on the GrIDsure tab if required: Block consecutive patterns (horizontal, vertical and diagonal) Check this box

11 Additional Configuration Options During configuration, the following options can be set on the GrIDsure tab if required: Block consecutive patterns (horizontal, vertical and diagonal) Check this box to enforce additional complexity rules for the PIP. Use this option to prevent the use of horizontal, vertical and diagonal patterns. Enable Pattern Expiry Check this box to force the user to provide a new pattern (PIP) after a set number of days. This option is similar to setting a password expiry limit for AD passwords. Use letters in grid instead of numbers The default configuration is to use numbers within the grid. Alternatively, you can specify that the grid should display letters, as shown in the following example: 11

12 Grid Style Displays the GrIDsure Style dialog enabling you to change the size and style of the grid as required. 12

To install the ISAPI Agent on the server hosting IIS, perform the following steps: 1.

13 Installing the ISAPI Agent The ISAPI Agent can be used as an ISAPI filter to provide authentication for the website. To install the ISAPI Agent on the server hosting IIS, perform the following steps: 1. Run the installation file ISAPI Agent x64 Installer.exe (for x64 platforms), or ISAPI Agent Installer.exe (for x86 platforms). 2. Select Next. 3. Accept the License Agreement. 13

14 4. Select Next. 5. Select Next to accept the default installation location, alternatively select Browse to choose a different location. 6. Select Next. 14

15 7. The ISAPI Agent installation starts and the Installation Progress dialog is displayed: 8. On completion of the installation, the Installation Complete dialog is displayed: 9. Select Finish. 15

Enter the name of the Security Server where user authentication will be performed 3. Enter the IP address of the Security Server. 4.

16 Configuring the ISAPI Agent On completion of the ISAPI Agent installation, select Configure ISAPI Agent Now. The ISAPI Agent Configuration dialog is displayed: To configure the ISAPI Agent: 1. On the DSS Parameters tab, select Add. 2. Enter the name of the Security Server where user authentication will be performed 3. Enter the IP address of the Security Server. 4. Enter the port number and shared secret configured on the access node that this connection will use. 5. Select the Protected Sites tab. 6. Select the site that you want to protect with, then click OK to save the selection. 16

17 Accessing the Protected Website This section describes how to access the protected website using authentication and a GrIDsure token. 1. From Internet Explorer, access the protected website. The Login page is displayed: 2. Enter your username and then click Login. 3. If you are using the GrIDsure Auto-Enrollment Mode and have no other token types assigned you will be prompted for your Active Directory Windows password to start the registration process for your GrIDsure token. 4. Enter your Windows password, then click Login. 17

18 If you have more than one token type assigned, you can choose which token to use for authen- tication. In the example, the user can enter either the synchronous response from a Go-x token, or if the user has a registered GrIDsure token, or the administrator has programmed a GrIDsure token, the user can click Use GrIDsure to authenticate with a GrIDsure token. On first use, you are required to configure your GrIDsure pattern or PIP. The GrIDsure grid (as defined on the security policy) is displayed. 18

19 5. Select a pattern using the letters within the grid and then enter these letters, without spaces, in the Configure your GrIDsure PIP: box. For example, the policy configured in Creating/Editing a Policy for GrIDsure Tokens, requires a pattern of between 4 and 8. Therefore a pattern, or PIP, such as AJBBBGAN would create a pattern using the top left square and then the first 3 squares from row 2. 19

20 If the PIP does not meet the complexity rules configured on the policy, the following dialog is displayed: Enter a PIP that meets the complexity requirements. 20

21 6. Select Login to save the PIP. 7. You are then prompted to authenticate using the PIP that was created for your token. 8. Enter the PIP in the Use your GrIDsure PIP: box and select Login, e.g You will now be authenticated and allowed access to the protected website. 10. A GrIDsure token is now created for you. This can be viewed in the username Properties tab in Active Directory Users and Computers. The next time you access the website, you will be prompted for your user name only and the PIP corresponding to your pattern. TRADEMARKS Quest, Quest Software, the Quest Software logo and itoken are trademarks and registered trademarks of Quest Software, Inc. in the United States of America and other countries. Gridsure and the Gridsure logos are trademarks and registered trademarks of Gridlock TS Limited. All other trademarks and registered trademarks are property of their respective owners. 21

Defender Desktop Login GrIDsure Token User Guide

Defender Desktop Login GrIDsure Token User Guide Desktop Login GrIDsure Token User Guide Introduction This guide describes what the user will see when using Desktop Login with GrIDsure tokens. The logon procedure will vary slightly depending on the platform