aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
Organization
The first user ID will not be resolved, since the DIGIPASS User Account
' doesn't exist in the Master Domain
(users were only added in the 'mycompany.com' domain). The second user ID will be resolved because the
DIGIPASS User Account
' exists in the 'mycompany.com' domain.
To allow both user IDs to be identified requires the following management:
setting up a domain conforming to the network domain name.
adding users below this domain (i.e. not below the Master Domain), so that user names can be resolved when
authentication requests are made.
configuring a default domain for name resolution to avoid the Master Domain being used when a domain name
cannot be found in the aXsGUARD Identifier. The default domain needs to be configured in the Base Policy of
the aXsGUARD Identifier. All policies below the Base Policy automatically inherit this setting. (Changes to the
default domain setting in any policy are inherited by child policies unless overruled; see section
for more
information on policy inheritance.)
Please see the
aXsGUARD Identifier Installation Guide
for a listing of the default settings required.
21.4
Moving DIGIPASS User Accounts and DIGIPASS
A domain must be chosen for a DIGIPASS User Account when it is created, as the domain makes up part of the
identification for the account. A DIGIPASS User Account may not be moved to a different domain. It must be
deleted and recreated in the required domain.
Unassigned DIGIPASS records may be moved to the required domain after importation.
A DIGIPASS record assigned to a DIGIPASS User Account must belong to the same domain as the account. You
therefore need to ensure that the correct numbers of DIGIPASS records are allocated to the different domains.
A DIGIPASS record assigned to a DIGIPASS User Account must belong to the same Organizational Unit as the User
Account. If a DIGIPASS record is assigned to a User Account in another Organizational Unit, it is moved there
automatically.
A DIGIPASS record assigned to a user cannot be moved. DIGIPASS User Accounts can be moved between
Organizational Units within the same domain whenever required, in which case the assigned DIGIPASS records are
automatically moved with them.
©
2009 VASCO Data Security
127
