Digipass Plug-In for IAS troubleshooting guide. Creation date: 15/03/2007 Last Review: 24/09/2007 Revision number: 3

Transcription

1 Digipass Plug-In for IAS troubleshooting guide. Creation date: 15/03/2007 Last Review: 24/09/2007 Revision number: 3 Document type: Whitepaper Security status: EXTERNAL Summary This document explains how to troubleshoot your Digipass plug-in for IAS (DPP4IAS) environment. Details This document is mainly intended to discover and resolve configuration issues. Before you start troubleshooting: Make sure that you have installed the latest version of the DPP4IAS software. The software can be downloaded from: At the time of writing this article, Version is the most recent version. Check for available patches for the DPP4IAS. The latest patches can be downloaded from: Different tools are available to help you during the troubleshooting: The Vasco Radius Client simulator (included on the DPP4IAS CD). This tool can simulate Radius requests. The log file dpiasext.trace. All DPP4IAS events can be logged in this file. The Windows Event Viewer..doc (1.0) 24/09/ :30 Page 1 of 8

2 Troubleshooting 1) Testing the IAS server setup. After having installed IAS service on Windows you need to make sure that the authentications are working correctly before installing the DPP4IAS. If the DPP4IAS is already installed, you can disable the Plug-in to check IAS operations without the Vasco DIGIPASS Plug-In: Start the Digipass Plug Configuration from the Windows Start Menu Uncheck the Enabled checkbox: You can test your Radius authentications to the IAS Server by using the Vasco Radius Client simulator. (Check the VACMAN RADIUS Client Simulator Users Guide, included on the Digipass Plug-in for IAS CD, for details): 1) In the Microsoft Active Directory Users and Computers (ADU&C), Create an Active Directory user test 2) Change the Dial-in or VPN access of the user test to Allow Access in the user properties. 3) On the IAS server create a Radius Client with the IP address of the machine where the Radius Client Simulator is installed. 4) On the IAS server you need to create a policy to make sure that the user test is allowed to logon (for example a policy that checks logon hours). Important: Do not forget to check the authentication protocol in the Authentication.doc (1.0) 24/09/ :30 Page 2 of 8

3 options of the Radius profile (PAP, CHAP, MS-CHAP, ) 5) Install the Radius Client Simulator and try to authenticate the user test with his static AD password. 6) If that authentication was successful, you can continue with the next step: Test the Radius setup with the DPP4IAS If the authentication was unsuccessful, check the IAS log files and Windows Event Viewer for error messages. To help you solve IAS issues, check the following link: d.mspx or (1.0) 24/09/ :30 Page 3 of 8

4 2) Enable the DPP4IAS tracing In order to troubleshoot your setup in case of problems it is important to enable logging and check the log files for additional information that can help solve the issue Start the IAS plug-in Configuration from the start menu: Select the Full Tracing option and click OK :.doc (1.0) 24/09/ :30 Page 4 of 8

5 Restart the IAS service to activate the new DPP4IAS settings: After enabling this option all IAS plug-in events are logged to a text file: C:\Program Files\VASCO\Digipass Plug-In for IAS\Log\dpiasext.trace.doc (1.0) 24/09/ :30 Page 5 of 8

6 3) Testing the Radius setup with the DPP4IAS Import a Demo Digipass in Active Directory Users and Computers For example from: C:\Program Files\VASCO\Digipass Plug-In for IAS\DPX Assign the Digipass to the user test Try the Radius Client simulator using the One Time Password (this should work). If not check the log files. Retry the authentication with the static password (This should fail since the Grace Period ended after the successful first use of the OTP ).doc (1.0) 24/09/ :30 Page 6 of 8

7 Common error messages Error code <2> [Static Password Validation Failed] - When mistyping the Server (Static) PIN code - A user with a Digipass with Server (Static) PIN code uses his Static Password to login instead of his Digipass Password after the Grace Period has expired - Correctly enter the PIN and OTP - Make sure users only use their Digipass OTP after the expiry of the Grace Period Error code: <201> [Code Replay Attempt] The Digipass OTP has already been used before Wait at least 36 seconds before retrying to log in. Never login more than once with the same OTP since this will always fail Error code: <-202> [Response Too Small] The user did not type his complete PIN+OTP Make sure the user enters his full OTP (With PIN if required) Error code: <-205> [Response Not Decimal] The user tries to login using his static password after the grace period has Expired Make sure users only use their Digipass OTP after the expiry of the Grace Period Error code: <1007> Error message: <User Account [test] is locked> The user has tried to login using an incorrect password and has passed the User Lock Threshold Uncheck the Locked box in the Active Directory Users and Computers in.doc (1.0) 24/09/ :30 Page 7 of 8

8 the user properties on the Digipass User Account tab. Other issues: These issues do not always produce a clear error message but can be caused by the following: The user s static password does not correspond with the IAS plug-in password while using backend Windows authentication - If Autolearn is enabled let the user login using Windows Password + PIN + OTP. - If Autolearn is not enabled make this change manually in the Active Directory Users and Computer in the User properties in the Digipass User Account Tab. The Shared secret between the server and client do not match. In the dpiasext.trace file this will show as if the user tried to login with a 35 character OTP: [The One Time Password was incorrect] with length [35] - Make sure the shared secret is correct - The Vasco Radius client will give the following error message: Login failed - invalid response authenticator. Mismatched shared-secret is a possibility Applies to: Digipass plug-in for IAS 1.0.x More information: Documentation: Digipass Plug-In for IAS Product Guide A4.pdf Digipass Plug-In for IAS Administration Reference A4.pdf VACMAN RADIUS Client Simulator Users Guide A4.pdf.doc (1.0) 24/09/ :30 Page 8 of 8