Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Defender 5.8 - Administrator Guide

Table of Contents

Getting started

Features and benefits What you can do with Defender

Authenticating VPN users Authenticating Web site users Authenticating users of Windows-based computers

Deploying Defender

Step 1: Install required Defender components Step 2: Configure Defender Security Server Step 3: Create and configure objects in Active Directory

Defender Security Policy Defender Security Server Access Node

Step 4: Program and assign security tokens to users Defender Setup Wizard reference Defender Security Server Configuration tool reference

Communication ports Licensing

User interface for managing licenses Adding a license Removing a license

Managing Defender objects in Active Directory

Managing user objects

Managing tokens for a user

Tokens list buttons Authentication Details area elements

Resetting passphrase for a user Managing Defender Security Policy for a user Managing RADIUS payload for a user

Managing security token objects

Importing hardware token objects Assigning a hardware token object to a user Modifying token object properties

General tab Details tab Assigned Users

Import Wizard reference

Managing Defender Security Policies

Creating a Defender Security Policy object

New Object - Defender Policy Wizard reference

Modifying Defender Security Policy object properties

General tab Account tab Expiry tab Logon Hours tab SMS Token tab E-mail Token tab GrIDsure Token tab

Default Defender Security Policy

Managing Access Nodes

Creating an Access Node

New Object - Defender Access Node Wizard reference

Modifying Access Node properties

General tab Servers tab Members tab Policy tab RADIUS Payload tab

Managing Defender Security Servers

Creating a Defender Security Server object Modify Defender Security Server object properties

General tab Security Server tab Prompts tab Policy tab RADIUS Payload tab

Creating a RADIUS payload object

RADIUS payload attributes

Configuring security tokens

Configuring Defender Soft Token

Distributing Defender Soft Token for BlackBerry via BlackBerry Enterprise Service Distributing Defender Soft Token for BlackBerry by using a .jad file

Configuring GrIDsure token Enabling the use of Authy Enabling the use of Google Authenticator Configuring SMS token Configuring e-mail token Configuring VIP credentials

Enabling the use of VIP credentials Programming a VIP credential for a user

Configuring YubiKey

Yubico OTP mode OATH-HOTP mode

Defender Token Programming Wizard reference

Securing VPN access

Configuring Defender for remote access Configuration example

Configuring your remote access device

Step 1: Create an AAA server group, add Defender Security Server Step 2: Configure an IPsec connection profile

Configuring Defender

Step 1: Configure an Access Node Step 2: Specify users or groups for the Access Node

Using Defender VPN Integrator

Installing Defender VPN Integrator Configuring Defender VPN Integrator

Defender EAP Agent

Deploying Defender EAP Agent

Step 1: Install Defender EAP Agent Step 2: Configure Network Policy Server Step 3: Configure VPN connection on the client computer

Authenticating via EAP Agent

Securing Web sites

Installing ISAPI Agent Configuring ISAPI Agent Accessing Protected Website

Securing Windows-based computers

Installing Defender Desktop Login by using a wizard Performing an unattended installation of Defender Desktop Login Configuring Defender Desktop Login by using a configuration tool Configuring Defender Desktop Login by using Group Policy Defender Desktop Login Configuration tool reference

Securing PAM-enabled services

Installing Defender PAM Configuring Defender PAM

Step 1: Enable authentication for target service Step 2: Specify Defender Security Servers Step 3: Configure access control for users and services Step 4: Configure Defender objects in Active Directory

Testing Defender PAM configuration Defender PAM logging Auth arguments

Defender Management Portal (Web interface)

Installing the portal Opening the portal Specifying a service account for the portal Configuring the portal

Service Account tab Roles tab Log Receiver Service tab Reports tab

Portal roles Enabling automatic sign-in Configuring self-service for users

General tab Software Tokens tab Hardware Tokens tab E-mail Settings tab PIN Settings tab

Troubleshooting authentication issues

User Details tab Tokens tab Authentication Routes tab Authentications tab

Managing users Managing security tokens Viewing authentication statistics Viewing Defender Security Server warnings and logs Viewing token requests from users Using Defender reports

Generating a report

Audit trail Authentication requests Authentication activity Authentication violations Defender Security Server configuration License information Proxied users RADIUS payloads Tokens Active, inactive, and locked users User details

Report scheduling settings Viewing a generated report Deleting generated reports Viewing a list of scheduled reports Deleting scheduled reports

Managing portal database

Encrypting database Changing password for encrypted database Decrypting database

Defender Security Server log cache Log Receiver Service database

Delegating Defender roles, tasks, and functions

Steps to delegate roles, tasks, and functions Roles Service accounts Advanced control Full control Using control access rights

Automating administrative tasks

Installing Defender Management Shell Uninstalling Defender Management Shell Opening Defender Management Shell Getting help Cmdlets provided by Defender Management Shell

Administrative templates

Installing and configuring administrative templates Temporary Responses setting Active Roles Web Interface - Token Programming setting Mail Configuration setting ADSI Configuration setting

Integration with Active Roles

Installing Defender Integration Pack for Active Roles Commands added to the Active Roles Web Interface

Defender Properties Set Defender Password Program Defender Token

Enabling automatic deletion of tokens Delegating Defender roles or tasks

Integration with Cloud Access Manager Appendices

Appendix A: Enabling diagnostic logging

Administration Console Defender Core Token Operations SDK (DTSDK) Defender Security Server Desktop Login EAP Agent Integration Pack for Active Roles Management Portal Management Portal (reports) Management Shell Service Connection Point Soft Token for Windows Token Import Token Programming VPN Integrator Web Service API

Appendix B: Troubleshooting common authentication issues

Step 1: Gather required information Step 2: Analyze Defender Security Server log Step 3: Gather further diagnostics

Appendix C: Troubleshooting DIGIPASS token issues

Step 1: Determine type of failure Step 2: Verify Defender configuration Step 3: Gather further diagnostics

Appendix D: Defender classes and attributes in Active Directory

Classes defined by Defender

defender-tokenClass defender-danClass defender-dssClass defender-policyClass defender-licenseClass defender-radiusPayloadClass defender-tokenLicenseClass

Classes extended by Defender

Attributes defined by Defender

defender-tokenType defender-tokenData defender-userTokenData defender-tokenUsersDNs defender-tokenDate defender-dssDNs defender-dssMembers defender-danKey defender-id defender-violationCount defender-resetCount defender-lastLogon defender-objectActive defender-prompts defender-authMethods defender-lockoutThreshold defender-lockoutDuration defender-lockoutTime defender-policy defender-policyMembers defender-danType defender-userIdType defender-accessCategories defender-subnetMask defender-danMembers defender-danDNs defender-dssVersion defender-radiusPayloadDn defender-radiusPayloadMembers defender-radiusPayloadData defender-radiusPayloadGroups defender-radiusPayloadGroupsDN defender-radiusPayloadInherit defender-policyAutoUnlock defender-policyMobileUsers defender-policyMaximumPasswordAge defender-policyMaximumPINAge defender-policyPasswordChangeFlags defender-policyPasswordFilter defender-policyGINAOptions defender-policyLoginTimes

Appendix E: Defender Event Log messages

Defender VPN Integrator messages Defender Report Scheduler messages Defender Administration Console messages Defender Security Server messages

Appendix F: Defender Client SDK

Installing Defender Client SDK Application Programming Interfaces (APIs)

IAuthenticator, IAuthenticator2, and IAuthenticator3 interfaces IAuthenticator2 and IAuthenticator3 interfaces IAuthenticator3 interface IAuthInfo interface

Defender Security Server messages

Appendix G: Defender Web Service API

AddSoftwareTokenToUser method AddTokenToUser method GetTokensForUser method RemoveAllTokensFromUser method RemoveDefenderPassword method RemovePinFromUserToken method RemoveTemporaryResponse method RemoveTokenFromUser method ResetDefenderToken method ResetDefenderViolationCount method SetDefenderPassword method SetPinOnUserToken method SetTemporaryResponse method TestDefenderToken method

AssignedSoftwareToken type AssignedToken type ProgrammableSoftwareTokenType type TokenList type UserTokenDetail type DefenderResult type UserViolationCount type TemporaryResponse type

Appendix E: Defender Event Log messages

This section lists the messages that Defender components write to the Windows Event Log.

In this section:

•

Defender VPN Integrator messages

•

Defender Report Scheduler messages

•

Defender Administration Console messages

•

Defender Security Server messages

Defender VPN Integrator messages

Defender VPN Integrator can write the following messages to the Windows Event Log, all with Source = pgwcserv, Event = 0:

•

Handler not installed

•

Service stopped

•

Bad service request

•

Service started

Defender Report Scheduler messages

Defender Report Scheduler can write the following messages to Windows Event Log, all with Source = Defender Report Scheduler:

•

1000: The Defender Report Scheduler was initialized successfully

•

1001: The Defender Report Scheduler failed to initialize

•

1002: The Defender Report Scheduler has been shutdown

•

1003: The Defender Report DCOM object failed to load. <Error Message> (<Error Code>)

•

1004: Generated scheduled report - <Name of report generated>

Defender Administration Console messages

Defender Administration Console can write the following messages to the Windows Event Log, all with Source = Defender Console:

•

1000: Token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>

•

1001: Failed to assign token <Distinguished Name of the Token> to user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1002: Defender Password assigned to user <Distinguished Name of the User>

•

1003: Failed to assign Defender Password to user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1004: Set PIN on token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>

•

1005: Failed to set PIN on token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1006: Set temporary response on token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>

•

1007: Failed to set temporary response on token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1008: Cleared temporary response on token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>

•

1009: Failed to clear temporary response on token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1010: Modified data of token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>

•

1011: Failed to modify data of token <Distinguished Name of the Token> assigned to user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1012: Token <Distinguished Name of the Token> unassigned from user <Distinguished Name of the User>

•

1013: Failed to unassign token <Distinguished Name of the Token> from <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1014: Defender Password unassigned from user <Distinguished Name of the User>

•

1015: Failed to unassign Defender Password from user <Distinguished Name of the User>, error (<Error Code>) <Error Message>

•

1016: Token <Distinguished Name of the Token> replicated to all Global Catalog servers

•

1017: Token <Distinguished Name of the Token> replicated to <count> of <total count> Global Catalog servers

•

1018: Token <Distinguished Name of the Token> replicated to all AD servers

•

1019: Token <Distinguished Name of the Token> replicated to <count> of <total count> AD servers

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2021 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy