aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
User Authentication Process
3.6
Back-end Authentication
3.6.1
Overview
Back-end Authentication
is a term used to describe the process of checking User credentials with another system.
With aXsGUARD Identifier this could mean a RADIUS server or an LDAP-based back-end server. It is used for
various purposes, including:
Enabling automatic management features such as
Dynamic User Registration
and
Self-Assignment
(see
Static password verification for Users who do not have a DIGIPASS device and for Virtual DIGIPASS (see
sections
and
Retrieval of RADIUS attributes from a RADIUS server (explained below)
Password Replacement
- allowing the User to log in with just a One Time Password, in an environment where
the Windows password is required , e.g. Outlook Web Access (explained below)
First we introduce the back-end server policy settings, and then explain how a static password is used during
back-end authentication. We then describe back-end server records and their specific types.
3.6.2
Back-end Server Policy Settings
The
Back-end Authentication
Policy setting indicates whether to perform back-end authentication, and if so, when
to do it. This setting is overridden by the same setting in the DIGIPASS User account, unless this has the value
Default
. However, this setting in the DIGIPASS User account would typically only be used for rare special case
Users. The possible values for the back-end authentication setting are listed in the table below.
The
Back-end Protocol
setting indicates whether back-end authentication uses RADIUS (a RADIUS server) or LDAP
to authenticate towards the back-end server.
For more information on Policy settings, see section
©
2009 VASCO Data Security
40
