Chat now with support

Get Live Help
Complete Registration

Sign In

Request Pricing

Contact Sales

Defender 6.6 - Administration Guide

Table of Contents

Getting started

Features and benefits What you can do with Defender

Authenticating VPN users Authenticating Web site users Authenticating users of Windows-based computers

Deploying Defender

Step 0: Install required pre-requisites for Defender Step 1: Install required Defender components Step 2: Configure Defender Security Server Step 3: Create and configure objects in Active Directory

Defender Security Policy Defender Security Server Access Node

Step 4: Program and assign security tokens to users Defender Setup Wizard reference Defender Security Server Configuration tool reference

Communication ports Upgrading Defender

Upgrading Defender Security Server and Administration Console Upgrading Defender Management Portal Upgrading Management Shell

User interface for managing licenses Adding a license Removing a license Upgrading Licensing to new One identity branded version from release 6.6.0

Managing Defender objects in Active Directory

Managing user objects

Managing tokens for a user

Tokens list buttons Authentication Details area elements

Resetting passphrase for a user Managing Defender Security Policy for a user Managing RADIUS payload for a user

Managing security token objects

Importing hardware token objects Assigning a hardware token object to a user Modifying token object properties

General tab Details tab Assigned Users

Import Wizard reference

Managing Defender Security Policies

Creating a Defender Security Policy object

New Object - Defender Policy Wizard reference

Defender Rollout Mode

Automatically Switching to Token Authentication Manually switching to token authentication

Modifying Defender Security Policy object properties

General tab Account tab Expiry tab Logon Hours tab SMS Token tab E-mail Token tab GrIDsure Token tab

Default Defender Security Policy

Managing Access Nodes

Creating an Access Node

New Object - Defender Access Node Wizard reference

Modifying Access Node properties

General tab Servers tab Members tab Policy tab RADIUS Payload tab

Managing Defender Security Servers

Creating a Defender Security Server object Modify Defender Security Server object properties

General tab Security Server tab Prompts tab Policy tab RADIUS Payload tab

Creating a RADIUS payload object

RADIUS payload attributes

Configuring security tokens

Configuring Defender Soft Token Configuring GrIDsure token Enabling the use of Authy Enabling the use of Google Authenticator Managing SMS Token

Configuring SMS Token using 2SMS Mobile Provider via Defender Configuring SMS token using Mobile Provider via OneLogin Portal

Configuration of OneLogin Portal To configure the SMS token for a user Creating an Authentication Factor Creating a Security Policy and assigning it to the user Verify the Security Factor from the OneLogin

Configuring e-mail token Configuring VIP credentials

Enabling the use of VIP credentials Programming a VIP credential for a user

Configuring YubiKey

Yubico OTP mode OATH-HOTP mode

Defender Token Programming Wizard reference FIDO2 compatible Hardware Yubikey Configuration settings to provide access to request FIDO2 token from Self-Service Enabling/Disabling FIDO2 token Enabling the use of Microsoft Authenticator Enabling use of OneLogin Authenticator Enabling use of OneLogin Authenticator for PUSH Notifications

Configuring OneLogin Portal

Defender Side Configuration OneLogin Side Configuration - Creating a OneLogin Tenant account Synchronizing User Data Creating an Authentication Factor

Creating a Security Policy and assigning it to the user Obtaining an activation code from the OneLogin portal

Securing VPN access

Configuring Defender for remote access Configuration example

Configuring your remote access device

Step 1: Create an AAA server group, add Defender Security Server Step 2: Configure an IPsec connection profile

Configuring Defender

Step 1: Configure an Access Node Step 2: Specify users or groups for the Access Node

Using Defender VPN Integrator

Installing Defender VPN Integrator Configuring Defender VPN Integrator

Defender EAP Agent

Deploying Defender EAP Agent

Step 1: Install Defender EAP Agent Step 2: Configure Network Policy Server Step 3: Configure VPN connection on the client computer

Authenticating via EAP Agent

Securing Web sites

Installing ISAPI Agent Configuring ISAPI Agent Accessing Protected Website

Securing Windows-based computers

Installing Defender Desktop Login by using a wizard Performing an unattended installation of Defender Desktop Login Configuring Defender Desktop Login by using a configuration tool Configuring Defender Desktop Login by using Group Policy Defender Desktop Login Configuration tool reference

Defender Management Portal (Web interface)

Installing the portal Configuring SQL Express Server as database for the portal [Optional] Opening the portal Specifying a service account for the portal Configuring the portal

Service Account tab Roles tab Log Receiver Service tab Reports tab

Portal roles Enabling automatic sign-in Configuring self-service for users

General tab Software Tokens tab Hardware Tokens tab E-mail Settings tab PIN Settings tab

Troubleshooting authentication issues

User Details tab Tokens tab Authentication Routes tab Authentications tab

Managing users Managing security tokens Viewing authentication statistics Viewing Defender Security Server warnings and logs Viewing token requests from users Using Defender reports

Generating a report

Audit trail Authentication requests Authentication activity Authentication violations Defender Security Server configuration License information Proxied users RADIUS payloads Tokens Active, inactive, and locked users User details

Report scheduling settings Viewing a generated report Deleting generated reports Viewing a list of scheduled reports Deleting scheduled reports

Managing portal database

Encrypting database Changing password for encrypted database Decrypting database DB Migration

Defender Security Server log cache Log Receiver Service database

Securing PAM-enabled services

Installing Defender PAM Configuring Defender PAM

Step 1: Enable authentication for target service Step 2: Specify Defender Security Servers Step 3: Configure access control for users and services Step 4: Configure Defender objects in Active Directory

Testing Defender PAM configuration Defender PAM logging Auth arguments

Delegating Defender roles, tasks, and functions

Steps to delegate roles, tasks, and functions Roles Service accounts Advanced control Full control Using control access rights

Automating administrative tasks

Installing Defender Management Shell Uninstalling Defender Management Shell Opening Defender Management Shell Getting help Cmdlets provided by Defender Management Shell

Administrative templates

Installing administrative templates Configuring administrative templates Temporary Responses setting Active Roles Web Interface - Token Programming setting Mail Configuration setting ADSI Configuration setting Updating Administrative templates from .adm to .admx

Domain Controller Client computer

Integration with Active Roles

Installing Defender Integration Pack for Active Roles Commands added to the Active Roles Web Interface

Defender Properties Set Defender Password Program Defender Token

Enabling additional features via Group Policy Enabling automatic deletion of tokens Delegating Defender roles or tasks Upgrading Defender Integration Pack for Active Roles Uninstalling Defender Integration Pack for Active Roles

Push Notifications

Setup Instructions for Firebase Communication Points to consider in Customer Network for communication with Firebase

Appendix A: Enabling diagnostic logging

Administration Console Defender Core Token Operations SDK (DTSDK) Defender Security Server Desktop Login EAP Agent Integration Pack for Active Roles Management Portal Management Portal (reports) Management Shell Service Connection Point Soft Token for Windows Token Import Token Programming VPN Integrator Web Service API Product information tool

Appendix B: Troubleshooting common authentication issues

Step 1: Gather required information Step 2: Analyze Defender Security Server log Step 3: Gather further diagnostics

Appendix C: Troubleshooting DIGIPASS token issues

Step 1: Determine type of failure Step 2: Verify Defender configuration Step 3: Gather further diagnostics

Appendix D: Defender classes and attributes in Active Directory

Classes defined by Defender

defender-tokenClass defender-danClass defender-dssClass defender-policyClass defender-licenseClass defender-radiusPayloadClass defender-tokenLicenseClass

Classes extended by Defender

Attributes defined by Defender

defender-tokenType defender-tokenData defender-userTokenData defender-tokenUsersDNs defender-tokenDate defender-dssDNs defender-dssMembers defender-danKey defender-id defender-violationCount defender-resetCount defender-lastLogon defender-objectActive defender-prompts defender-authMethods defender-lockoutThreshold defender-lockoutDuration defender-lockoutTime defender-policy defender-policyMembers defender-danType defender-userIdType defender-subnetMask defender-accessCategories defender-danMembers defender-danDNs defender-dssVersion defender-radiusPayloadDn defender-radiusPayloadMembers defender-radiusPayloadData defender-radiusPayloadGroups defender-radiusPayloadGroupsDN defender-radiusPayloadInherit defender-policyAutoUnlock defender-policyMobileUsers defender-policyMaximumPasswordAge defender-policyMaximumPINAge defender-policyPasswordChangeFlags defender-policyPasswordFilter defender-policyGINAOptions defender-policyLoginTimes defender-notificationId

Appendix E: Defender Event Log messages

Defender VPN Integrator messages Defender Report Scheduler messages Defender Administration Console messages

Appendix F: Defender Client SDK

Installing Defender Client SDK Application Programming Interfaces (APIs)

IAuthenticator, IAuthenticator2, and IAuthenticator3 interfaces

Authenticate method challengeMessage property sessionID property timeout property

IAuthenticator2 and IAuthenticator3 interfaces

challengeMessageId property challengeMessageData property

IAuthenticator3 interface

AddPayload method GetGridData method GetAuthenticationImage method SetGridResetPIPAttribute method payload property grIDsureMessage property grIDsureGridType property

IAuthInfo interface

userIdType property isUserDefenderAuthenticated property

Defender Security Server messages

Appendix G: Defender Web Service API

AddSoftwareTokenToUser method AddTokenToUser method GetTokensForUser method RemoveAllTokensFromUser method RemoveDefenderPassword method RemovePinFromUserToken method RemoveTemporaryResponse method RemoveTokenFromUser method ResetDefenderToken method ResetDefenderViolationCount method SetDefenderPassword method SetPinOnUserToken method SetTemporaryResponse method TestDefenderToken method

AssignedSoftwareToken type AssignedToken type ProgrammableSoftwareTokenType type TokenList type UserTokenDetail type DefenderResult type UserViolationCount type TemporaryResponse type

defender-radiusPayloadClass

CN defender-radiusPayloadClass
Ldap-Display-Name defender-radiusPayloadClass
Governs-Id 1.2.840.113556.1.8000.1267.1.6
Object-Category 1
Subclass of Leaf
Possible Superiors Organizational-Unit
Update Privilege Domain or Defender administrator
Update Frequency Record of this type are updated each time a Defender RADIUS payload is created, deleted, or modified.
Description A record of this type is created for each RADIUS payload defined to Defender.

This class contains the following attributes:

Table 43:
defender-radiusPayloadClass attributes
Attribute	Mandatory
defender-radiusPayloadData	False
defender-radiusPayloadGroups	False
defender-radiusPayloadGroupsDN	False
defender-radiusPayloadMembers	False

defender-tokenLicenseClass

CN defender-tokenLicenseClass
Ldap-Display-Name defender-tokenLicenseClass
Governs-Id 1.2.840.113556.1.8000.1267.1.7
Object-Category 1
Subclass of Leaf
Possible Superiors Organizational-Unit
Update Privilege Domain or Defender administrator
Update Frequency Record of this type are updated each time a Defender token license is created, deleted, or modified.
Description A record of this type is created for each token license defined in Defender.

This class contains the following attributes:

Table 44:
defender-tokenLicenseClass attributes
Attribute	Mandatory
defender-tokenData	False
defender-tokenType	False

Classes extended by Defender

The following is the list of Microsoft Active Directory schema classes that are extended by Defender. Each class has been listed in accordance with the Active Directory schema definitions format as used in the MSDN documentation (for further details, see information on Active Directory Schema published in MSDN at http://msdn.microsoft.com/en-us/library/ms675085(VS.85).aspx). Only attributes that are specific to Defender have been listed; all other attributes are as per the MSDN documentation provided for each extended class specified.

In this section:

Group

CN Group
Ldap-Display-Name Group
Governs-Id 1.2.840.113556.1.5.8

Defender extends this class to include the following attributes:

Table 45:
Group attributes added by Defender
Attribute	Mandatory
defender-danDNs	False
defender-policy	False
defender-radiusPayloadDn	False
defender-radiusPayloadInherit	False
defender-radiusPayloadGroupsDN	False

Related Documents

The document was helpful.

Select Rating

I easily found the information I needed.

Select Rating

© 2024 One Identity LLC. ALL RIGHTS RESERVED. Terms of Use Privacy Cookie Preference Center