Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Defender 5.9.3 - Administration Guide

Table of Contents

Getting started

Features and benefits What you can do with Defender

Authenticating VPN users Authenticating Web site users Authenticating users of Windows-based computers

Deploying Defender

Step 1: Install required Defender components Step 2: Configure Defender Security Server Step 3: Create and configure objects in Active Directory

Defender Security Policy Defender Security Server Access Node

Step 4: Program and assign security tokens to users Defender Setup Wizard reference Defender Security Server Configuration tool reference

Communication ports Upgrading Defender

Upgrading Defender Security Server and Administration Console Upgrading Defender Management Portal Upgrading Management Shell

User interface for managing licenses Adding a license Removing a license

Managing Defender objects in Active Directory

Managing user objects

Managing tokens for a user

Tokens list buttons Authentication Details area elements

Resetting passphrase for a user Managing Defender Security Policy for a user Managing RADIUS payload for a user

Managing security token objects

Importing hardware token objects Assigning a hardware token object to a user Modifying token object properties

General tab Details tab Assigned Users

Import Wizard reference

Managing Defender Security Policies

Creating a Defender Security Policy object

New Object - Defender Policy Wizard reference

Defender Rollout Mode

Automatically Switching to Token Authentication Manually switching to token authentication

Modifying Defender Security Policy object properties

General tab Account tab Expiry tab Logon Hours tab SMS Token tab E-mail Token tab GrIDsure Token tab

Default Defender Security Policy

Managing Access Nodes

Creating an Access Node

New Object - Defender Access Node Wizard reference

Modifying Access Node properties

General tab Servers tab Members tab Policy tab RADIUS Payload tab

Managing Defender Security Servers

Creating a Defender Security Server object Modify Defender Security Server object properties

General tab Security Server tab Prompts tab Policy tab RADIUS Payload tab

Creating a RADIUS payload object

RADIUS payload attributes

Configuring security tokens

Configuring Defender Soft Token

Distributing Defender Soft Token for BlackBerry via BlackBerry Enterprise Service

Configuring GrIDsure token Enabling the use of Authy Enabling the use of Google Authenticator Configuring SMS token Configuring e-mail token Configuring VIP credentials

Enabling the use of VIP credentials Programming a VIP credential for a user

Configuring YubiKey

Yubico OTP mode OATH-HOTP mode

Defender Token Programming Wizard reference

Securing VPN access

Configuring Defender for remote access Configuration example

Configuring your remote access device

Step 1: Create an AAA server group, add Defender Security Server Step 2: Configure an IPsec connection profile

Configuring Defender

Step 1: Configure an Access Node Step 2: Specify users or groups for the Access Node

Using Defender VPN Integrator

Installing Defender VPN Integrator Configuring Defender VPN Integrator

Defender EAP Agent

Deploying Defender EAP Agent

Step 1: Install Defender EAP Agent Step 2: Configure Network Policy Server Step 3: Configure VPN connection on the client computer

Authenticating via EAP Agent

Securing Web sites

Installing ISAPI Agent Configuring ISAPI Agent Accessing Protected Website

Securing Windows-based computers

Installing Defender Desktop Login by using a wizard Performing an unattended installation of Defender Desktop Login Configuring Defender Desktop Login by using a configuration tool Configuring Defender Desktop Login by using Group Policy Defender Desktop Login Configuration tool reference

Defender Management Portal (Web interface)

Installing the portal Opening the portal Specifying a service account for the portal Configuring the portal

Service Account tab Roles tab Log Receiver Service tab Reports tab

Portal roles Enabling automatic sign-in Configuring self-service for users

General tab Software Tokens tab Hardware Tokens tab E-mail Settings tab PIN Settings tab

Troubleshooting authentication issues

User Details tab Tokens tab Authentication Routes tab Authentications tab

Managing users Managing security tokens Viewing authentication statistics Viewing Defender Security Server warnings and logs Viewing token requests from users Using Defender reports

Generating a report

Audit trail Authentication requests Authentication activity Authentication violations Defender Security Server configuration License information Proxied users RADIUS payloads Tokens Active, inactive, and locked users User details

Report scheduling settings Viewing a generated report Deleting generated reports Viewing a list of scheduled reports Deleting scheduled reports

Managing portal database

Encrypting database Changing password for encrypted database Decrypting database

Defender Security Server log cache Log Receiver Service database

Securing PAM-enabled services

Installing Defender PAM Configuring Defender PAM

Step 1: Enable authentication for target service Step 2: Specify Defender Security Servers Step 3: Configure access control for users and services Step 4: Configure Defender objects in Active Directory

Testing Defender PAM configuration Defender PAM logging Auth arguments

Delegating Defender roles, tasks, and functions

Steps to delegate roles, tasks, and functions Roles Service accounts Advanced control Full control Using control access rights

Automating administrative tasks

Installing Defender Management Shell Uninstalling Defender Management Shell Opening Defender Management Shell Getting help Cmdlets provided by Defender Management Shell

Administrative templates

Installing and configuring administrative templates Temporary Responses setting Active Roles Web Interface - Token Programming setting Mail Configuration setting ADSI Configuration setting

Integration with Active Roles

Installing Defender Integration Pack for Active Roles Commands added to the Active Roles Web Interface

Defender Properties Set Defender Password Program Defender Token

Enabling additional features via Group Policy Enabling automatic deletion of tokens Delegating Defender roles or tasks Upgrading Defender Integration Pack for Active Roles Uninstalling Defender Integration Pack for Active Roles

Integration with Cloud Access Manager Appendices

Appendix A: Enabling diagnostic logging

Administration Console Defender Core Token Operations SDK (DTSDK) Defender Security Server Desktop Login EAP Agent Integration Pack for Active Roles Management Portal Management Portal (reports) Management Shell Service Connection Point Soft Token for Windows Token Import Token Programming VPN Integrator Web Service API Product information tool

Appendix B: Troubleshooting common authentication issues

Step 1: Gather required information Step 2: Analyze Defender Security Server log Step 3: Gather further diagnostics

Appendix C: Troubleshooting DIGIPASS token issues

Step 1: Determine type of failure Step 2: Verify Defender configuration Step 3: Gather further diagnostics

Appendix D: Defender classes and attributes in Active Directory

Classes defined by Defender

defender-tokenClass defender-danClass defender-dssClass defender-policyClass defender-licenseClass defender-radiusPayloadClass defender-tokenLicenseClass

Classes extended by Defender

Attributes defined by Defender

defender-tokenType defender-tokenData defender-userTokenData defender-tokenUsersDNs defender-tokenDate defender-dssDNs defender-dssMembers defender-danKey defender-id defender-violationCount defender-resetCount defender-lastLogon defender-objectActive defender-prompts defender-authMethods defender-lockoutThreshold defender-lockoutDuration defender-lockoutTime defender-policy defender-policyMembers defender-danType defender-userIdType defender-subnetMask defender-accessCategories defender-danMembers defender-danDNs defender-dssVersion defender-radiusPayloadDn defender-radiusPayloadMembers defender-radiusPayloadData defender-radiusPayloadGroups defender-radiusPayloadGroupsDN defender-radiusPayloadInherit defender-policyAutoUnlock defender-policyMobileUsers defender-policyMaximumPasswordAge defender-policyMaximumPINAge defender-policyPasswordChangeFlags defender-policyPasswordFilter defender-policyGINAOptions defender-policyLoginTimes

Appendix E: Defender Event Log messages

Defender VPN Integrator messages Defender Report Scheduler messages Defender Administration Console messages

Appendix F: Defender Client SDK

Installing Defender Client SDK Application Programming Interfaces (APIs)

IAuthenticator, IAuthenticator2, and IAuthenticator3 interfaces

Authenticate method challengeMessage property sessionID property timeout property

IAuthenticator2 and IAuthenticator3 interfaces

challengeMessageId property challengeMessageData property

IAuthenticator3 interface

AddPayload method GetGridData method GetAuthenticationImage method SetGridResetPIPAttribute method payload property grIDsureMessage property grIDsureGridType property

IAuthInfo interface

userIdType property isUserDefenderAuthenticated property

Defender Security Server messages

Appendix G: Defender Web Service API

AddSoftwareTokenToUser method AddTokenToUser method GetTokensForUser method RemoveAllTokensFromUser method RemoveDefenderPassword method RemovePinFromUserToken method RemoveTemporaryResponse method RemoveTokenFromUser method ResetDefenderToken method ResetDefenderViolationCount method SetDefenderPassword method SetPinOnUserToken method SetTemporaryResponse method TestDefenderToken method

AssignedSoftwareToken type AssignedToken type ProgrammableSoftwareTokenType type TokenList type UserTokenDetail type DefenderResult type UserViolationCount type TemporaryResponse type

defender-dssClass

Appendices > Appendix D: Defender classes and attributes in Active Directory > Classes defined by Defender > defender-dssClass

CN defender-dssClass
Ldap-Display-Name defender-dssClass
Governs-Id 1.2.840.113556.1.8000.1267.1.3
Object-Category 1
Subclass of Leaf
Possible Superiors Organizational-Unit
Update Privilege Domain or Defender administrator
Update Frequency Record of this type are updated each time a Defender Security Server (DSS) is created, deleted, or modified.
Description A record of this type is created for each Defender Security Server (DSS) defined to Defender.

This class contains the following attributes:

Table 40:
defender-dssClass attributes
Attribute	Mandatory
defender-dssMembers	False
defender-dssVersion	False
defender-objectActive	False
defender-policy	False
defender-prompts	False
defender-radiusPayloadDn	False

defender-policyClass

Appendices > Appendix D: Defender classes and attributes in Active Directory > Classes defined by Defender > defender-policyClass

CN defender-policyClass
Ldap-Display-Name defender-policyClass
Governs-Id 1.2.840.113556.1.8000.1267.1.4
Object-Category 1
Subclass of Leaf
Possible Superiors Organizational-Unit
Update Privilege Domain or Defender administrator
Update Frequency Records of this type are updated each time a Defender Security Policy is created, deleted, or modified.
Description A record of this type is created for each Defender Security Policy defined in Defender.

This class contains the following attributes:

Table 41:
defender-policyClass attributes
Attribute	Mandatory
defender-accessCategories	False
defender-authMethods	False
defender-lockoutDuration	False
defender-lockoutThreshold	False
defender-policyAutoUnlock	False
defender-policyGINAOptions	False
defender-policyLoginTimes	False
defender-policyMaximumPasswordAge	False
defender-policyMaximumPINAge	False
defender-policyMembers	False
defender-policyMobileUsers	False
defender-policyPasswordChangeFlags	False
defender-policyPasswordFilter	False

defender-licenseClass

Appendices > Appendix D: Defender classes and attributes in Active Directory > Classes defined by Defender > defender-licenseClass

CN defender-licenseClass
Ldap-Display-Name defender-licenseClass
Governs-Id 1.2.840.113556.1.8000.1267.1.5
Object-Category 1
Subclass of Leaf
Possible Superiors Organizational-Unit
Update Privilege Domain or Defender administrator
Update Frequency Records of this type are updated each time a Defender license is created, deleted, or modified.
Description A record of this type is created for each license defined in Defender.

This class contains the following attributes:

Table 42:
defender-licenseClass attributes
Attribute	Mandatory
defender-tokenData	False

defender-radiusPayloadClass

Appendices > Appendix D: Defender classes and attributes in Active Directory > Classes defined by Defender > defender-radiusPayloadClass

CN defender-radiusPayloadClass
Ldap-Display-Name defender-radiusPayloadClass
Governs-Id 1.2.840.113556.1.8000.1267.1.6
Object-Category 1
Subclass of Leaf
Possible Superiors Organizational-Unit
Update Privilege Domain or Defender administrator
Update Frequency Record of this type are updated each time a Defender RADIUS payload is created, deleted, or modified.
Description A record of this type is created for each RADIUS payload defined to Defender.

This class contains the following attributes:

Table 43:
defender-radiusPayloadClass attributes
Attribute	Mandatory
defender-radiusPayloadData	False
defender-radiusPayloadGroups	False
defender-radiusPayloadGroupsDN	False
defender-radiusPayloadMembers	False

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2022 One Identity LLC. ALL RIGHTS RESERVED. Feedback Terms of Use Privacy