aXsGUARD Identifier 3.0.2.0 Product Guide v1.5
User Authentication Process
1.
Login Step 1
: the User logs in with a User ID and password and/or keyword and requests an OTP to be
generated and delivered to them. (The Policy defines how this request should be made, with the
Request
Method
and
Request Keyword
settings explained in section 3.5.3.6).
2.
The aXsGUARD Identifier checks the User credentials, and if OK, generates an OTP, which is sent to the
User's mobile phone using the Message Delivery Component (MDC, explained in section 12).
3.
Login Step 2:
t
he User enters their password and OTP into the login window.
4.
The aXsGUARD Identifier authenticates the User.
Backup Virtual DIGIPASS
) have additional restrictions on use, to keep the cost of text
messages down. These restrictions are verified by the aXsGUARD Identifier before an OTP is generated and are
described in section
Image 10: Virtual DIGIPASS Login
If 2-step login is not supported, e.g. RADIUS without support for Challenge/Response or Web HTTP Basic
Authentication, there are two possible work-arounds:
An OTP Request website can be provided, where Users can request an OTP to be sent to their mobile phone.
The OTP can then be entered with the User ID in a single login window.
A single login window can be used twice: the first login fails (without an OTP), but initiates an OTP request.
In the second login attempt, the user enters the OTP.
For further information on
Virtual DIGIPASS
use, please see section
©
2009 VASCO Data Security
36
