Defender 6.1 - Administration Guide

Click to program a token for the user.

Click to recover the token selected in the list or reset the token’s passphrase. You may need to reset a token when it has reached its preset use limit or been invalidated because the user exceeded the preset number of bad PIN attempts.

Allows you to verify that the token is programmed correctly and valid for the user.

After you click this button, use the Response text box to type the one-time password displayed on the token. If a PIN is enabled for the token, you can also test the PIN by entering it in the PIN (Optional) text box. Click Verify to run the test on the token.

If you use the Test button to test a token response, that token response cannot then be used for user authentication.

Allows you to resynchronize the token selected in the list with the Defender Security Server or assign a temporary password to the token user.

After you click the Helpdesk button, a dialog box opens. This dialog box provides the following options:

• Reset  Click this button to resynchronize the token with the Defender Security Server.

  The token generates a one-time password that is based on an internal time clock and DES keys. For successful authentication, the Defender Security Server must agree with the token's time clock and DES keys. The token's time clock can become out-of-sync with the Defender Security Server. If this value is out-of-sync, the user cannot use the token for authentication. If access is denied to the user, the token clock must be synchronized with the Defender Security Server clock.

  After resetting the token, instruct the user to use the token to generate a one-time password and use it for Defender authentication.

• Expires  Allows you to select a validity period for the temporary password.
• Allow response to be used multiple times  Select this check box to allow the temporary password to be used more than once for authentication. If you leave this check box cleared, the temporary password can only be used once.
• Assign  Assigns the generated temporary password to the user.
• Clear  Removes the temporary password from the user.
• Response  Shows the generated temporary password.

Removes the token selected in the list from the user. You can also use this option to delete the corresponding token object from Active Directory.

To remove the token from the user and keep the token object in Active Directory, in the confirmation message that appears after you click this button, click No. In this case, the token object does not get deleted from Active Directory and can be reassigned.

To remove the token from the user and delete the token object from Active Directory, in the confirmation message, click Yes.

Allows you to search for and assign a token to the user. After you click this button, a new dialog box opens. In that dialog box, you can use the following elements:

• Token Serial Number  Type the serial number of the token you want to assign to the user. If you do not know the serial number, leave this text box blank.
• Show unassigned tokens only  Select this check box to search for the tokens that are not assigned to users. If you leave this check box cleared, the search results will include both assigned and not assigned tokens.
• Token Type  Select the token type you want to search for.

Click OK to start your search. When the search completes, in the Select Defender Tokens dialog box, double-click the token you want to assign, and then click OK to assign the token to the user. The assigned token appears on the Defender tab in the Tokens list.

Allows you to set a new PIN for the token selected in the list. After you click the Set PIN button, a dialog box opens. This dialog box provides the following options:

• Enable PINs  Enables PIN for the selected token.
• New PIN  Type the new PIN you want to assign to the selected token.
• Confirm PIN  Confirm the new PIN you want to assign.
• Expire  Select this check box if you want the PIN to expire.

When you require users to enter a PIN set for a selected token, users should enter the PIN followed by the token response to access a resource protected by Defender. For example, if the PIN is 1234 and the response is 5678, users should enter 12345678 when prompted for authentication.

When users need to reset the PIN, they should enter the old and new PINs in the following format: <old PIN><new PIN><new PIN>. For example, if the old PIN is 1234 and the new PIN is 5678, users should enter the following: 123456785678.