Defender 6.4 - Administration Guide

You can select one of the following options:

• Software token  Allows you to program and assign a software token, such as Defender Soft Token, e-mail token, GrIDsure token, or SMS token.
• Hardware token  Allows you to program and assign a hardware token, such as DIGIPASS or YubiKey. This option does not support hardware VIP credentials.
• Symantec VIP credential  Allows you to program and assign a software or hardware VIP credential. This option becomes available after you enable the use of VIP credentials. For details, see Enabling the use of VIP credentials.

Click to select the software token you want to program and assign to the user.

Select the Expire token activation code after check box if you want to set a validity time period (in days) for the code with which the user must activate the software token. Then, specify the number of days during which you want the token activation code to remain valid.

The token activation code is generated when you complete this wizard.

Leave the Expire token activation code after text box cleared if you do not want to limit the validity time period of the token activation code.

In this step, you can select the following check boxes:

• Expire token activation code after  Select this check box if you want to set a validity time period (in days) for the code with which the user must activate the software token. Then, specify the number of days during which you want the token activation code to remain valid. The token activation code is generated when you complete this wizard.
• Alert user about failed passphrase attempts  Select this check box to notify the user when the user has entered an incorrect passphrase when unlocking the token. Optionally, you can select the Lock token passphrase after check box to lock the passphrase after the user has expended the specified number of attempts to unlock the token.
• Token requires a passphrase  Select this check box to enforce the user to configure a passphrase for using with the token. When this check box is cleared, no passphrase is required. If you select this check box, you can optionally select the Passphrase must be strong check box, which requires the user to configure a passphrase that is at least six characters long, includes uppercase and lowercase characters, and numbers or special characters.

Use the options in this step to specify an operation mode (synchronous or challenge-response), encryption method, and response length for the software token.

Select the one-time password algorithm you want Google Authenticator to use.

You can select one of the following algorithms:

• Time based (TOTP)  One-time password remains valid for a particular amount of time. Then, Google Authenticator automatically generates a new one-time password.
• Counter based (HOTP)  One-time password remains valid until the user manually generates a new one-time password in Google Authenticator.

Note that the algorithm you select in this wizard is only used if the user activates Google Authenticator with a QR code.

If the user activates Google Authenticator by manually typing the activation code, the one-time password algorithm specified by the user in Google Authenticator during activation takes precedence over the option you select in this wizard.

Specify the Active Directory container in which you want to store the token object.

If you change the default location, ensure that the Defender Security Server service account and the Defender administrator account have sufficient permissions for the new location you specify.

Specify options for saving the token activation code.

In this step, you can use the following options:

• One file for all users  Saves token activation codes for all users to a single file.
• Individual file for each user  Saves token activation code for each user to an individual file.
• File Location  Specify path to the folder in which you want to create files containing token activation codes.
• File Name  Specify name for the file in which you want to store token activation codes. If a file with such name does not exist, it will be created.
• Append activation codes to existing file  If you select this option and the file with the specified name already exists in the specified location, the wizard appends the activation codes to the file without overwriting its contents. If you leave this check box cleared, the existing file’s contents will be overwritten with the new token activation codes.

This step shows up if the selected users already have a GrIDsure token assigned. Each user can only have one GrIDsure token assigned.

Select one of the following options:

• Overwrite existing tokens  Creates new GrIDsure token objects which overwrite the existing GrIDsure token objects assigned to the users. As a result, the users will have to configure their GrIDsure Personal Identification Pattern (PIP) the next time they access a protected resource.
• Keep using existing tokens  Does not create new GrIDsure token objects for the users who already have GrIDsure tokens assigned.