aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
Organization
However, there
are two differences between domains and Organizational Units:
All DIGIPASS User Accounts and DIGIPASS records must belong to a domain. DIGIPASS User Accounts and
DIGIPASS records do not have to belong to an Organizational Unit.
The domain is used to identify User Accounts, whereas Organizational Units are not (as explained below). As a
consequence, two User Accounts with the same name can only exist if they are in different domains.
21.3
Master Domain and Practical Uses
21.3.1
Master Domain Concepts
When the aXsGUARD Identifier is installed, a single domain is created in the database, the
Master Domain
. By
default, all new DIGIPASS User Accounts and DIGIPASS records are created in the Master Domain.
The Master Domain serves three important purposes:
for initial access and configuration of the aXsGUARD Identifier. Two system administrators exist on the Master
Domain, one for system operation, which should never be removed, and one for the aXsGUARD Identifier
system administrator (see section
all DIGIPASS instances are imported by default into the Master Domain although different domains or
Organizational Units can be chosen during importation. Example relocation models are shown in section
for whenever a domain cannot be found for an authentication request (explained below).
If a separate domain field is provided on login, this is used with the User ID. If a separate domain field is not
provided, but the user name is in the form userid@domain, and there is a domain with the given domain name,
that domain is used. In this case, the user name has the '@domain' part removed. Otherwise, the user name
remains as userid@domain and no domain is identified.
If no domain is identified, the applicable Policy is checked for a
Default Domain
. The Default Domain is used if it is
specified in the Policy. Otherwise, the Master Domain is used as a default (see image below and also section
©
2009 VASCO Data Security
125
