Steel-Belted RADIUS. Digipass Plug-In for SBR. SBR Plug-In SBR. G etting Started

Transcription

1 Steel-Belted RADIUS Digipass Plug-In for SBR SBR Plug-In SBR Steel-Belted RADIUS G etting Started

2 Disclaimer of Warranties and Limitations of Liabilities Disclaimer of Warranties and Limitations of Liabilities The Product is provided on an 'as is' basis, without any other warranties, or conditions, express or implied, including but not limited to warranties of merchantable quality, merchantability of fitness for a particular purpose, or those arising by law, statute, usage of trade or course of dealing. The entire risk as to the results and performance of the product is assumed by you. Neither we nor our dealers or suppliers shall have any liability to you or any other person or entity for any indirect, incidental, special or consequential damages whatsoever, including but not limited to loss of revenue or profit, lost or damaged data of other commercial or economic loss, even if we have been advised of the possibility of such damages or they are foreseeable; or for claims by a third party. Our maximum aggregate liability to you, and that of our dealers and suppliers shall not exceed the amount paid by you for the Product. The limitations in this section shall apply whether or not the alleged breach or default is a breach of a fundamental condition or term, or a fundamental breach. Some states/countries do not allow the exclusion or limitation or liability for consequential or incidental damages so the above limitation may not apply to you. Copyright All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted, in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of VASCO Data Security Inc. Trademarks VACMAN and Digipass are registered trademarks of VASCO Data Security International Inc. Microsoft and Windows are registered trademarks of Microsoft Corporation. All other trademarks are the property of their respective holders. ii

3 Table of Contents Table of Contents 1 Introduction What You Need to Know/Have before Starting System Requirements Requirements Specific to Active Directory Requirements Specific to ODBC Database Available Reference Guides Initial Setup and Testing Basic Procedure Install the RADIUS Client Simulator Configure Steel-Belted RADIUS Requirements Configure Authentication Policies Create a RADIUS Profile Create a Native User account Configure Logging Restart the SBR Service Test Native User Login Database Changes Active Directory SSL Install the Digipass Plug-In for SBR Configure the SBR Plug-In Configure Steel-Belted RADIUS to Use Plug-In Log in to Administration Interfaces Administration MMC Interface Active Directory Users and Computers Set up Policy and Component Test Windows Password Login Import and Assign Digipass Records Import Digipass Records Assign Digipass Record(s) Modify Settings for Digipass logins Policy Settings Test Digipass Login Test Logins Test Pre-requisites Configure Authentication Method Local Authentication Only Back-End Authentication Only Local and Back-End Authentication Configure Login Methods Response Only Step Challenge/Response Configure Protocol

4 Table of Contents Open the RADIUS Client Simulator Test Logins RADIUS Attributes RADIUS Profile Add Attributes to SBR RADIUS Profile SBR Plug-In Configuration...25 Set RADIUS Profile in Digipass User account...26 Test RADIUS Profile Login User Attributes SBR Plug-In Configuration...27 Add Attributes to a Digipass User account Test RADIUS Attributes Login Test Management Features Auto-Assignment Self-Assignment Demo Tokens Obtaining a Demo Digipass Using the Demo Go 1 or Go Activating the Demo Go 1/Go Obtaining a One Time Password Changing the Demo Go 1/Go 3 Server PIN Using the Demo DP Activate the Demo DP Change the PIN Auto-Off Function Unlock the Demo DP Set up Live System Checklist...38 Modify NAS Configuration Test Native User Login...38 Import More Digipass Create Digipass User Accounts Create New Policy...38 Create Component Record for NAS Test Digipass Logins

5 Introduction 1 Introduction This Getting Started Guide will introduce you to the Digipass Plug-In for SBR. It will help you set up a basic installation of the Digipass Plug-In for SBR and get to know the product and the tools it includes. It covers only basic information and the most common configuration requirements. Other options and more in-depth instructions are covered in other manuals. This guide covers a standard implementation of the Digipass Plug-In for SBR: Windows environment Typical installation: SBR Plug-In Active Directory or an ODBC database used as the data store Administration MMC Interface Digipass Extension for Active Directory Users and Computers (if Active Directory is used as the data store) It includes information on: Basic configuration of the Digipass Plug-In for SBR Testing This guide does not cover topics such as: Installation instructions Detailed introduction to the Digipass Plug-In for SBR, its features and components Detailed instructions on the use of the Digipass Plug-In for SBR Additional components Virtual Digipass Backup and recovery 5

6 Introduction 1.1 What You Need to Know/Have before Starting DPX file (unless you will only use the provided demo Digipass files) Encryption Key for the DPX file (if using your own file) Installation Guide 1.2 System Requirements SBR Plug-In Steel-Belted RADIUS 5.0 or greater Operating System Windows Server 2003 (32-bit version only), or Windows XP Professional (32-bit version only) with Service Pack 1 or above, or Windows 2000 with Service Pack 4 or above Language The Digipass Plug-In for SBR is designed to function on any language version of Windows. However, the product has only been comprehensively tested on English language versions of Windows, with some additional German language testing Requirements Specific to Active Directory Digipass Extension for Active Directory Users and Computers Active Directory Users and Computers Snap-In Active Directory set up for SSL In the following cases, SSL must be available for Digipass Plug-In for SBR components to connect to Active Directory: SBR Plug-In not installed on a Domain Controller. Administration Interfaces not installed on a Domain Controller. SBR Plug-In and/or Administration Interface(s) on a Domain Controller, but accessing data in another domain. An Enterprise Certificate Authority must be installed in the forest to enable SSL. Windows Certificate Services is available as an optional Windows component Requirements Specific to ODBC Database The Digipass Plug-In for SBR will support most modern ODBC-compliant relational, transactional databases. It has been tested on the following databases: Oracle 9i Microsoft SQL Server 2000 DB2 8.1 Sybase Adaptive Server Anywhere 9.0 PostgreSQL 8.1 6

7 Introduction 1.3 Available Reference Guides Reference Guides are available: Product Guide The Product Guide will introduce you to the features of this product and the various options you have for using it. It also highlights decisions which you should consider and make before setting up a live installation of the product. Installation Guide Use this guide when planning and working through an installation of the product. Getting Started To get you up and running quickly with a simple installation and setup of the product. Administrator Reference In-depth information required for administration of the product. Data Migration Tool Guide This Guide will take you through a data migration from one VASCO product to another, using the VASCO Data Migration Tool. Help Files Accompany various utilities and the administration interfaces. 7

8 Initial Setup and Testing 2 Initial Setup and Testing 2.1 Basic Procedure The diagram below illustrates the basic procedure which this Guide will take you through in the initial setup and tests for the Digipass Plug-In for SBR. At various points in the process, test logins are recommended to ensure that the previous steps have not caused unexpected problems. This also helps in troubleshooting, as it helps to pinpoint where in the process a problem occurred. 8

9 Initial Setup and Testing Image 1: Basic Setup Procedure 9

10 Initial Setup and Testing 2.2 Install the RADIUS Client Simulator Install the RADIUS Client Simulator on a machine: 1. Locate and run the VACMAN RADIUS Client Simulator Setup.exe. 2. Follow the prompts until the installation is complete. If you chose the default install location, the Simulator will be installed to the C:\Program Files\VASCO\VACMAN RADIUS Client Simulator directory. 3. Launch the Simulator from the Start menu. 10

11 Initial Setup and Testing 2.3 Configure Steel-Belted RADIUS If SBR is newly-installed, there are some steps you will need to follow in order to get the SBR Plug-In working with SBR. The diagram below shows the basic process involved. For help in completing each of these steps, see the relevant sub-section. Image 2: SBR Setup Requirements To complete the recommended steps, you will need SBR Administrator installed, with an established connection to the SBR server and an administrator login. Create RADIUS Client record Create a RADIUS Client record within SBR for the machine on which the RADIUS Client Simulator will be running: 1. Right-click on RADIUS Clients. 2. Click on Add. 3. Fill in the required information. 4. Click on OK. 11

12 Initial Setup and Testing Configure Authentication Policies Configure the Authentication Policies in SBR for use with the SBR Plug-In: 1. Click on Authentication Policies. 2. Ensure that Native User is ticked, and at the top of the list. 3. Untick all other Authentication Methods listed. 4. Click on Apply. 5. If you will be testing with the EAP-MD5 protocol: a. Select Native User. b. Click on EAP Setup... c. Tick MD5-Challenge. d. Click on Save Create a RADIUS Profile 1. Click on Profiles. 2. Click on Add. 3. Enter VASCOGettingStarted in the Name field. 4. Enter a description for the Profile. 5. Click on the Return List tab. 6. Click on Add. 7. Select Reply-Message from the Attributes list box. 8. Enter a message string eg. Getting Started Reply. 9. Click on Add. 10. Click on Close. 11. Click on OK Create a Native User account 1. Click on Users. 2. Click on Add. 3. Enter a name, description and password for the User account. 4. Select the Profile created in the previous section (2.3.3 Create a RADIUS Profile) from the Use Profile drop down list. 12

13 Initial Setup and Testing 5. Click on the Return List tab. 6. Click on Add. 7. Select Callback-Number from the Attributes list box. 8. Enter a number in the String field. 9. Click on Add. 10. Click on Close. 11. Click on OK Configure Logging 1. Open the radius.ini file for Steel-Belted RADIUS. This can be found in the <install directory>\service folder. 2. Change the LogLevel setting to Change the TraceLevel setting to Save and close the file Restart the SBR Service 1. Go to your Windows desktop. 2. Right-click on the My Computer icon. 3. Select Manage from the right-click menu. 4. Double-click on Services and Applications. 5. Click on Services. 6. Find and right-click on Steel-Belted RADIUS in the Services list. 7. Click on Restart. 2.4 Test Native User Login Once SBR has been set up, attempt a login through the RADIUS Client Simulator using the Native User account set up earlier in SBR Administrator. 1. Open the RADIUS Client Simulator. 2. Enter the IP address of the SBR server. 3. Enter Authentication and Accounting port numbers if they vary from the default. 4. Enter the Shared Secret you entered for the RADIUS Client created earlier (2.3.1 Create RADIUS Client record). 13

14 Initial Setup and Testing 5. Select a protocol to use. 6. Click on any port icon to attempt a login. 7. Enter the User ID and password for the Native User account created earlier (2.3.4 Create a Native User account). 8. Click on Login. The Profile and User attributes created earlier should be displayed as Returned RADIUS attributes. 2.5 Database Changes Extend the Active Directory Schema or ODBC database structure according to the instructions in the Installation Guide. 2.6 Active Directory SSL Set up SSL if required. See the Pre-installation Tasks section of the Installation Guide for more information. 2.7 Install the Digipass Plug-In for SBR Install the Digipass Plug-In for SBR according to the instructions in the Installation Guide. Some settings which are created automatically for the SBR Plug-In are: Example Policies. A Component for the SBR Plug-In, which will point to a default Policy. Permissions within Active Directory for the SBR Plug-In (if required). 2.8 Configure the SBR Plug-In When the install process for the Digipass Pack is completed, the SBR Plug-In Configuration Interface can be used to configure the system for familiarising yourself with the product. In particular, these should be configured: Configure auditing log to a text file or to the Windows Event Log. The Windows Event log is recommended while getting familiar with the product. Enable tracing, if desired. Check that the SBR Plug-In is enabled. 2.9 Configure Steel-Belted RADIUS to Use Plug-In 1. Open the SBR Administrator. 14

15 Initial Setup and Testing 2. Click on Authentication Policies. 3. Select Digipass Authentication. 4. Use the arrow buttons to move Digipass Authentication to the top of the list box. 5. Tick the Active checkbox for Digipass Authentication. 6. Untick all other Authentication Methods. 7. Click on Apply Log in to Administration Interfaces Administration MMC Interface The Administration MMC Interface is a standalone MMC snap-in that can be used to administer data for the SBR Plug-In. Active Directory If Active Directory is used as the data store, the Administration MMC Interface can be used for administration of Policies and Components. The Digipass Extension for Active Directory Users and Computers Snap-In is used for other Digipass-related data. 1. Select Programs -> VASCO -> Digipass Plug-In for SBR -> Administration MMC Interface from the Start menu. 2. Expand the Digipass Administration node. 3. Right-click on the domain node. 4. Select Connect from the list. ODBC or Embedded Database If an ODBC database (including the embedded PostgreSQL database) is used as the data store, the Administration MMC Interface can be used for administration of all Digipass-related data. 1. Select Programs -> VASCO -> Digipass Plug-In for SBR -> Administration MMC Interface from the Start menu. 2. Expand the Digipass Administration node. 3. Right-click on the DSN. 4. Select Connect from the list. 5. Enter the User ID and password for a database administrator. If you are using the embedded PostgreSQL database, this will be: a. UserID: digipass b. Password: digipassword 15

16 Initial Setup and Testing 6. Click on OK Active Directory Users and Computers The Digipass Extension for Active Directory Users and Computers can be used to administer Digipass and Digipass User accounts when Active Directory is used as the data store. 1. Open the Active Directory Users and Computers Snap-In. 16

17 Initial Setup and Testing 2.11 Set up Policy and Component Ensure that the SBR Plug-In Component is pointed to a Policy which has the Back-end Authentication set to Windows and Local Authentication disabled. To modify these settings for a Policy: 1. Open the Administration MMC Interface. 2. Click on the Policies node. The Policies list will be displayed in the Result pane. 3. Right-click on the Policy SBR Base Policy. 4. Select Copy Policy Enter the name SBR GettingStarted for the Policy. 6. Click on OK to create the Policy. 7. Double-click on the SBR GettingStarted Policy. The Policy property sheet will be displayed. 8. Click on the Main Settings tab. 9. Check these drop down lists: a. Local Auth. should be set to None. b. Back-end Auth. should be set to Always. c. Back-end Protocol should be set to Windows. To ensure that the SBR Plug-In Component will use the correct Policy: 1. Click on the Components node. The Components list will be displayed in the Result pane. 2. Double-click on the SBR Plug-In Component. The Component property sheet will be displayed. 3. Ensure that the SBR GettingStarted Policy is selected in the Policy drop down list. 4. Click on OK. 5. Restart the Steel-Belted RADIUS service Test Windows Password Login For this step, you will need an active Windows User account. Do not choose the same User ID and password as a Native User account in SBR. 17

18 Initial Setup and Testing Use the RADIUS Client Simulator to attempt a login (using Windows User ID and Password) with the User account. This is to check that the installation and configuration of the SBR PlugIn has been successful at this point. Note Windows Authentication is only supported by the SBR Plug-In using the PAP protocol, unless the User ID and password are manually added to the SBR Plug-In and Stored Password Proxy is enabled. Therefore, only simulated logins using the PAP protocol will be successful at this point in the testing process. 1. Open the RADIUS Client Simulator. 2. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 3. Enter the User ID for the Windows User account in the User ID field. 4. Enter the password for the Windows User account in the Password field. 5. Click on the Login button. 6. The Status information field will indicate the success or failure of your login. 18

19 Initial Setup and Testing 2.13 Import and Assign Digipass Records Import Digipass Records Digipass records must be imported into the data store before they can be assigned to User accounts. Active Directory To import Digipass records: 1. Open the Active Directory Users and Computers interface. 2. Right-click on the container or Organizational Unit where the test user account is located. 3. Click on Import Digipass Enter or browse for the import path and filename for the DPX file. 5. Enter the encryption key this is for the installed demo Digipass DPX files. 6. Click on Import All Applications. OR a. Click on Show Applications. b. Select the Digipass Applications to import. c. Click on Import Selected Applications. ODBC Database To import Digipass records: 1. Open the Administration MMC Interface. 2. Right-click on the Digipass node. 3. Click on Import Digipass Enter or browse for the import path and filename for the DPX file. 5. Enter the encryption key this is for the installed demo Digipass DPX files. 6. Click on Import All Applications. OR a. Click on Show Applications. b. Select the Digipass Applications to import. 19

20 c. Initial Setup and Testing Click on Import Selected Applications Assign Digipass Record(s) Before a User can use a Digipass to login, the Digipass must be assigned to their User account within the data store. Active Directory To assign a Digipass record to a User account: 1. Open the Active Directory Users and Computers Snap-In. 2. Select the User account to be assigned a Digipass. 3. Right-click on the record and select Assign Digipass Select the Digipass record to be assigned to the User account. 5. Click on OK. This procedure will create a Digipass User account for an Active Directory User if one did not previously exist. ODBC Database To assign a Digipass record to a User account: 1. Open the Administration MMC Interface. 2. Click on the Users node. 3. Create the Digipass User account if it does not currently exist for the User. 4. Select the Digipass User account to be assigned a Digipass. 5. Right-click on the record and select Assign Digipass Select the Digipass record to be assigned to the User account. 7. Click on OK. 20

21 Initial Setup and Testing 2.14 Modify Settings for Digipass logins Policy Settings To test Digipass logins, the SBR Plug-In Component should use a Policy which has Local Authentication enabled and Back-end Authentication disabled. To check that a Policy has these settings: 1. Open the Administration MMC Interface. 2. Click on the Policies node. The Policies list will be displayed in the Result pane. 3. Double-click on the SBR GettingStarted Policy. The Policy property sheet will be displayed. 4. Click on the Main Settings tab. 5. Check these drop down lists: a. Local Auth. should be set to Digipass/Password. b. Back-end Auth. should be set to None. To ensure that the SBR Plug-In Component will use the correct Policy: 1. Click on the Components node. The Components list will be displayed in the Result pane. 2. Double-click on the SBR Plug-In Component. The Component property sheet will be displayed. 3. Ensure that the SBR GettingStarted Policy is selected in the Policy drop down list. 4. Click on OK. 5. Stop and Start the Steel-Belted RADIUS service. 21

22 Initial Setup and Testing Test Digipass Login Use the RADIUS Client Simulator to attempt a Digipass login with a User account which has a Digipass assigned. This is to check that the SBR Plug-In has been configured correctly for authenticating Digipass logins. If you are unsure how to use the Digipass, see the Demo Tokens section. 1. Open the RADIUS Client Simulator. 2. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 3. Enter the User ID for the User account you are using for test logins in the User ID field. 4. Enter the One Time Password generated by the Digipass in the Password field. 5. Click on the Login button. 6. The Status information field will indicate the success or failure of your login. 22

23 Test Logins 3 Test Logins Using the User account to which you assigned a Digipass, and the Digipass, you can test the various authentication methods, login methods and protocols needed. You may wish to try various combinations of authentication method, login method and protocol, or simply the combination required for your system. 3.1 Test Pre-requisites If you are going to test all types of login methods available, you will need: A Digipass User account to test logins with - this can be the same one as in previous tests. A Digipass or Demo Digipass with Response Only and Challenge/Response Applications. 3.2 Configure Authentication Method Create a Policy for each authentication method required, or use a test Policy such as the SBR GettingStarted Policy created in the previous section - which can be modified as desired. Note After changing the Policy or Component, stop and start the Steel-Belted RADIUS service. This ensures that the new settings will take effect immediately Local Authentication Only Local authentication means that only the SBR Plug-In will authenticate a login. The recommended Policy settings for Local Authentication tests are: Local Auth. should be set to Digipass/Password. Back-end Auth. should be set to None Back-End Authentication Only Back-end authentication means that only Windows will authenticate a login. The recommended Policy settings for Back-end Authentication tests are: Local Auth. should be set to None. Back-End Auth. should be set to Always. Back-End Protocol must be set to Windows. 23

24 Test Logins Local and Back-End Authentication Local and back-end authentication means that both the SBR Plug-In and Windows will authenticate a login. The recommended Policy settings for Local and Back-end Authentication tests are: Local Auth. should be set to Digipass/Password. Back-End Auth. should be set to Always. Back-End Protocol must be set to Windows. 3.3 Configure Login Methods Response Only To configure a Policy to allow Response Only logins: 1. Open the Policy property sheet. 2. Click on the Digipass Settings tab. 3. Check that No Restriction or Response Only is selected from the Application Type drop down list. 4. Click on OK Step Challenge/Response 1. Open the Policy property sheet. 2. Click on the Digipass Settings tab. 3. Check that No Restriction or Challenge/Response is selected from the Application Type drop down list. 4. Click on Apply. 5. Click on the Challenge Settings tab. 6. Select Keyword from the 2-step Challenge/Response Request Method drop down list. 7. Enter a Keyword to use (eg. '2stepCR') in the Keyword field. You can leave this field blank, so that an empty password can be used to get a challenge. 8. Click on OK. 24

25 Test Logins 3.4 Configure Protocol Open the RADIUS Client Simulator. 1. Check that the Protocol drop down list is set to the protocol you wish to implement (eg. CHAP, MS-CHAP, MS-CHAP2). 3.5 Test Logins 1. Configure a Policy for the authentication method, login method and protocol to be tested. 2. Ensure that the SBR Plug-In Component is using the configured Policy. In the RADIUS Client Simulator: 3. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 4. Enter the User ID for the User account you are using for test logins in the User ID field. 5. Enter the password for the User account and an OTP from the Digipass in the Password field. 6. Click on the Login button. 7. The Status information field will indicate the success or failure of your logon. 3.6 RADIUS Attributes Using the SBR Plug-In, there are two ways in which RADIUS attributes can be returned during a login: RADIUS Profile in SBR Individual User attributes Examples of adding RADIUS attributes are documented below RADIUS Profile Note The RADIUS Profile(s) used in the SBR Plug-In must exist in SBR. If SBR cannot find a listed Profile, it will fail the authentication request Add Attributes to SBR RADIUS Profile The desired test attributes should be added to the VASCOGettingStarted Profile created earlier (2.3.3 Create a RADIUS Profile). An example, using MPPE keys, is shown below. 25

26 Test Logins MPPE Keys If you are testing MS-CHAP or MS-CHAPv2 protocol and need to have MPPE keys returned, follow these steps: 1. Open the SBR Administrator. 2. Click on Profiles. 3. Double-click on the VASCOGettingStarted Profile you created earlier (2.3.3 Create a RADIUS Profile). 4. Click on the Return List tab. 5. Click on Add. MS-CHAPv2 Only 6. Select MS-MPPE-Encryption-Policy from the Attributes list box. 7. Select Encryption-Allowed from the Values list box. 8. Click on Add. 9. Select MS-MPPE-Encryption-Type from the Attributes list box. 10. Type into the Hexadecimal value field. 11. Click on Add. 12. Click on Close. MS-CHAP Only 6. Select MS-CHAP-MPPE-Keys from the Attributes list box. 7. Click on Add. 8. Click on Close SBR Plug-In Configuration The following configuration settings tell the SBR Plug-In to look for the RADIUS Attribute Group and SBR Profile Attribute Name in attribute settings for a Digipass User account. This allows different SBR Plug-Ins to use different RADIUS Profiles and user attributes for the same Digipass User account. 1. Open the SBR Plug-In Configuration. 2. Enter RADIUS into the Attribute Group field. 3. Enter SBR into the Profile Attribute Name field. 4. Click on Apply. 26

27 Test Logins Set RADIUS Profile in Digipass User account Once the VASCOGettingStarted Profile is configured with the required attributes, the test Digipass User account must be modified to use it. 1. Open the User property sheet in the Administration MMC Interface (ODBC database) or Active Directory Users and Computers (Active Directory). 2. Click on the Digipass User Account tab. 3. Click on the Authorization Profiles/Attributes button. 4. Click on Add Enter RADIUS in the Attribute Group field. 6. Enter SBR in the Name field. 7. Select Profile from the Usage drop down list. 8. Enter VASCOGETTINGSTARTED in the Value field. 9. Click on OK. 10. Click on Close Test RADIUS Profile Login Using the RADIUS Client Simulator, attempt a Digipass login using the Digipass User configured above. Check that the expected RADIUS Profile attributes were returned User Attributes Individual user attributes may also be added to a Digipass User account. Note The attributes listed in the SBR Plug-In must exist in dictionaries loaded in SBR. If SBR cannot find a listed attribute, it will fail the authentication request. 27

28 Test Logins SBR Plug-In Configuration The SBR Plug-In must be configured to make use of individual user attributes. 1. Open the SBR Plug-In Configuration. 2. Tick the Set User Attributes checkbox. 3. Click on OK Add Attributes to a Digipass User account If an individual attribute such as Callback-Number must be returned for a Digipass User: 1. Open the User property sheet in the Administration MMC Interface (ODBC database) or Active Directory Users and Computers (Active Directory). 2. Click on the Digipass User Account tab. 3. Click on the Authorization Profiles/Attributes button. 4. Enter RADIUS in the Attribute Group field. 5. Enter Callback-Number in the Name field. 6. Select Return from the Usage drop down list. 7. Enter a phone number in the Value field. 8. Click on OK. 9. Click on Close Test RADIUS Attributes Login Using the RADIUS Client Simulator, attempt a Digipass login using the Digipass User configured above. Check that the expected RADIUS Profile and user attributes were returned. 28

29 Test Management Features 4 Test Management Features 4.1 Auto-Assignment Initial Setup 1. Open the Administration MMC Interface. 2. Click on the Components node. The Components list will be displayed in the Result pane. 3. Double-click on the SBR Plug-In Component. The Component property sheet will be displayed. 4. Ensure that the SBR Base Policy is selected in the Policy drop down list. 5. Click on OK. 6. Stop and Start the Steel-Belted RADIUS service. 7. Create or use a Windows User account which does not currently have a Digipass User account. 8. Check that at least one unassigned Digipass is available in either: the same Organizational Unit, a parent Organizational Unit, or the Digipass-Pool Container (Active Directory) or the domain root (ODBC). If one of the latter two options, ensure that the Search Upwards in Organizational Unit hierarchy option is enabled for the SBR Base Policy. Test Auto-Assignment - 1 In the following test, both Dynamic User Registration and Auto-Assignment should fail, meaning that a Digipass User account will not be created, and a Digipass will not be assigned to the User. In the RADIUS Client Simulator: 9. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 10. Enter the User ID for the Windows User account you created earlier (step 7) in the User ID field. 11. Enter the password for the Windows User account. 12. Click on the Login button. The Status information field will indicate the success or failure of your logon. 29

30 Test Management Features Check Test Results To check whether a Digipass User account has been created for the User: Active Directory 13. Open the Active Directory Users and Computers Snap-In 14. Find the User account record and right-click on it. 15. Select Properties from the list. The User property sheet will be displayed. 16. Click on the Digipass User Account tab. If the Created On field is blank, a Digipass User account does not exist for the User. ODBC Database 13. Open the Administration MMC Interface. 14. Click on the Digipass Users node. 15. Search for the User ID in the Users list. If the Digipass User account exists in the database, the Dynamic User Registration was successful. Modify Settings 17. Modify the Group Check method in the SBR Windows Auto-Assignment Policy to No check. 18. Modify the SBR Plug-In Component to use the SBR Windows Auto-Assignment Policy. 19. Stop and Start the Steel-Belted RADIUS service. Test Auto-Assignment - 2 In the following test, both Dynamic User Registration and Auto-Assignment should succeed, meaning that a Digipass User account will be created, and an available Digipass will be assigned to the User. In the RADIUS Client Simulator: 20. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 21. Enter the User ID for the Windows User account you created earlier (step 7) in the User ID field. 22. Enter the password for the User account. 23. Click on the Login button. 30

31 Test Management Features The Status information field will indicate the success or failure of your logon. Check Test Results To check whether a Digipass User account has been created for the User: 24. Open the Active Directory Users and Computers Snap-In (Active Directory) or the Administration MMC Interface (ODBC). 25. Find the User account record and right-click on it. 26. Select Properties from the list. The User property sheet will be displayed. 27. Click on the Digipass User Account tab. If the Created On field is not blank, a Digipass User account exists for the User. To check whether a Digipass has been assigned to the User: 28. Click on the Digipass Assignment tab. 29. If a Digipass is listed under this tab, the User has been assigned the listed Digipass. 30. Check the Grace Period End field to see that a Grace Period of the correct length (7 days by default) has been set. Check Grace Period Password login 31. Using the RADIUS Client Simulator, attempt a login using the Windows User's User ID and password only. If the Grace Period is still effective, this should be successful. OTP login 32. Using the RADIUS Client Simulator, attempt a login using the Windows User's User ID and One Time Password. This should be successful. Password login 33. Using the RADIUS Client Simulator, attempt a login using the Windows User's User ID and password only. As the OTP login from the previous step should have ended the Grace Period for the Digipass, this login should fail. 34. Check the Grace Period End in the User record. It should contain today's date. 31

32 Test Management Features 4.2 Self-Assignment Initial Setup 1. Open the Administration MMC Interface. 2. Click on the Components node. The Components list will be displayed in the Result pane. 3. Double-click on the SBR Plug-In Component. The Component property sheet will be displayed. 4. Ensure that the SBR Base Policy is selected in the Policy drop down list. 5. Click on OK. 6. Stop and Start the Steel-Belted RADIUS service. 7. Create or use a Windows User account which does not currently have a Digipass User account. 8. Check that the record for the Digipass to be used in the Self-Assignment is available in either: the same Organizational Unit, a parent Organizational Unit, or the Digipass-Pool Container (Active Directory) or the domain root (ODBC). If one of the latter two options, ensure that the Search Upwards in Organizational Unit hierarchy option is enabled for the SBR Base Policy. Test Self-Assignment - 1 In the following test, both Dynamic User Registration and Self-Assignment should fail, meaning that a Digipass User account will not be created, and the selected Digipass will not be assigned to the User. In the RADIUS Client Simulator: 9. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 10. Enter the User ID for the Windows User account you created earlier (step 7) in the User ID field. 11. Enter the Serial Number for the Digipass, the Separator, the Windows User's Password, a Server PIN (if required) and a One Time Password from the Digipass into the Password field. eg password (see the Login Permutations topic in the Administrator Reference for more information). 12. Click on the Login button. The Status information field will indicate the success or failure of your logon. 32

33 Test Management Features Check Test Results To check whether a Digipass User account has been created for the User: Active Directory 13. Open the Active Directory Users and Computers Snap-In 14. Find the User account record and right-click on it. 15. Select Properties from the list. The User property sheet will be displayed. 16. Click on the Digipass User Account tab. If the Created On field is blank, a Digipass User account does not exist for the User. ODBC Database 13. Open the Administration MMC Interface. 14. Click on the Digipass Users node. 15. Search for the User ID in the Users list. If the Digipass User account exists in the database, the Dynamic User Registration was successful. Modify Settings 17. Modify the SBR Plug-In Component to use the SBR Windows Self-Assignment Policy. 18. Stop and Start the Steel-Belted RADIUS service. Test Self-Assignment - 2 In the following test, both Dynamic User Registration and Self-Assignment should succeed, meaning that a Digipass User account will be created, and the intended Digipass will be assigned to the User. In the RADIUS Client Simulator: 19. Click on any port in the Simulated NAS Ports group to display the Manual Simulation window. 20. Enter the User ID for the Windows User account you created earlier (step 7) in the User ID field. 21. Enter the Serial Number for the Digipass, the Separator, the Windows User's Password, a Server PIN (if required) and a One Time Password from the Digipass into the Password field. eg password (see the Login Permutations topic in the Administrator Reference for more information). 22. Click on the Login button. 33

34 Test Management Features The Status information field will indicate the success or failure of your logon. Check Test Results To check whether a Digipass User account has been created for the User: 23. Open the Active Directory Users and Computers Snap-In (Active Directory) or the Administration MMC Interface (ODBC). 24. Find the User account record and right-click on it. 25. Select Properties from the list. The User property sheet will be displayed. 26. Click on the Digipass User Account tab. If the Created On field is not blank, a Digipass User account exists for the User. To check whether the Digipass has been assigned to the User: 27. Click on the Digipass Assignment tab. 28. If the Digipass is listed under this tab, it has been assigned to the Digipass User account. Check Grace Period 29. Check that a Grace Period has not been set. Password login 30. Using the RADIUS Client Simulator, attempt a login using the Windows User's User ID and password only. This should fail, as a Grace Period is not set for a Self-Assignment. OTP login 31. Using the RADIUS Client Simulator, attempt a login using the Windows User's User ID and One Time Password. This should be successful. 34

35 Demo Tokens 5 Demo Tokens 5.1 Obtaining a Demo Digipass If you do not have a demo Digipass, you can use a simulated DP300 at The DPX files for the Demo DP300 and Demo Go 1/Go 3 are located in the DPX folder under the Digipass Plug-In for SBR installation directory. 5.2 Using the Demo Go 1 or Go 3 This topic explains the activation and use of the demonstration Go 1 or Go 3 Note The Demo Go 1 and Go 3, and other Go 1/Go 3 tokens, only produce a timebased One Time Password - referred to as a Response. This is referred to as the Response Only authentication method. The Go 1 and Go 3 tokens are used with a PIN, which is entered before the Response Activating the Demo Go 1/Go 3 To turn on the Demo Go 1, slide the Go 1 apart to reveal the LCD screen. To turn on the Demo Go 3, press the button on the token. All Go 1/Go 3 tokens have an auto-off function, meaning that they automatically turn themselves off after short periods of inactivity Obtaining a One Time Password Whenever the Demo Go 1/Go 3 is activated, it produces a 6-digit number on its LCD screen. This response number is generated based on the secret code stored within the token, and the current time. At logon, the Users' Server PIN and the One Time Password from the Go 1/Go 3 should be entered as into the appropriate password field in the logon screen or web page. The Server PIN is initially For example, if the One Time Password generated by the Demo Go 1/Go 3 was , should be entered in the login screen. 35

36 Demo Tokens Changing the Demo Go 1/Go 3 Server PIN The Demo Go 1/Go 3 Server PIN (1234) can be changed during the authentication process. To change the Demo Go 1/Go 3 Server PIN: 1. Go to the login page or screen. 2. In the user ID field, enter the User ID for the account you are using for testing. 3. In the password field, enter the current Server PIN (1234) for the Demo Go 1/Go Activate the Demo Digipass and enter the One Time Password generated in the response field directly after the Server PIN. 5. Next, enter the new PIN for the Demo Go 1/Go 3 after the response in the Response field, then enter it again to confirm it. 6. Submit your login to issue the new Server PIN information to the SBR Plug-In. Example To change the Server PIN for a Demo Digipass from 1234 to 5678, where the OTP generated was , enter: in the password field and login. Any time you login using the Demo or another Go 1/Go 3, you may use this method to change your PIN, except for RADIUS authentications where any form of CHAP is in use (E.g., CHAP, MS-CHAP, MS-CHAP2). This is because the information is one-way hashed and cannot be retrieved from the packet. If CHAP protocols are used, refer to the User Self-Management Web Site Guide for more information about alternative web based methods for PIN change (eg. using your intranet). 5.3 Using the Demo DP300 This topic explains the activation and use of the demonstration DP Activate the Demo DP300 The Demo DP300 is turned on with the < button. Each time the Demo DP300 is activated it will request a 4-digit PIN number (displayed on the LCD screen). The PIN for Demo DP300s is initially set to The Demo Digipass will then prompt you to indicate the application you wish to use: 36

37 Demo Tokens Application 1 : Response only When you press 1 on the keypad, the demo DP300 will produce a 6-digit number. This response number is generated based on the secret code stored within the token, and the current time. The One Time Password displayed should be entered into the appropriate password field in the logon screen or web page. Application 2 : Digital Signature When you press 2 on the keypad, you will be prompted for 3 numbers (typically from an online transaction) comprising up to 5 digits each. When all three numbers required have been entered, a 6-digit number is generated (displayed on the LCD screen). This number is the digital signature for the transaction. This needs to be entered into the appropriate field in the digital signature web page or screen. Note Digital signatures are not currently in use with the SBR Plug-In. Application 3: Challenge / Response When you press 3 on the keypad, the Digipass will present you with four dashes ( ) to indicate that a challenge must be entered. You may have the option of holding the optical reader to the middle of the flash sequence (the white flashing panels) on the logon web page if one is presented. Alternatively, if the challenge number is shown on the screen, you can key it in directly into the keypad. The demo DP300 will then calculate and display a One Time Password based on the challenge and the secret code stored in the DP300. The One Time Password displayed should be entered into the appropriate password field in the logon screen or web page Change the PIN Turn on the Demo DP300 and enter the current PIN to activate the token. Then hold down the On (<) button for 2 seconds, to be prompted for a new PIN. The DP300 will then prompt you to re-enter the new PIN to confirm it. The new PIN can now be used to logon Auto-Off Function To preserve the maximum battery life, the Demo DP300 automatically turns off after 30 seconds of inactivity. 37

38 Demo Tokens Unlock the Demo DP300 If an incorrect PIN is entered into a Demo DP300 too many times (3), the Digipass will lock itself from further use. When a token is locked, it will display an unlock challenge on its LCD screen. Digipass may be unlocked using the Digipass Extension for Active Directory Users and Computers Snap-in (when Active Directory is used as the data store) or the Administration MMC Interface (when ODBC is used as the data store). 38

39 Set up Live System 6 Set up Live System 6.1 Checklist Modify NAS Configuration Configure the Network Access Server to send authentication requests to SBR. Test Native User Login Create a test Native User account in SBR. Open the SBR Administrator, temporarily enable Native User Authentication Policy and disable the Digipass Authentication Plug-In. Test logins through the NAS. Restore the Authentication Methods to their previous settings. Import More Digipass Import all required Digipass records Create Digipass User Accounts If required, manually create Digipass User accounts. Alternatively, enable Dynamic User Registration in the SBR Plug-In. Create New Policy If Policy settings different to those in preset Policies, create a Policy in the Administration MMC Interface for login authentications requested by the NAS. Create Component Record for NAS If needed, create a Component record for the NAS in the Administration MMC Interface. Test Digipass Logins Test Digipass logins through the NAS, using One Time Passwords. 39