UniOTP Credential Provider Agent: Difference between revisions

From SecuTech Wiki
Jump to navigationJump to search

Bao (talk | contribs)

0 edits
Created page with "Category:UniOTP_Tools <p>This document mainly introduces how to use and install UniOTP Windows logon Agent, this document is aimed at end users that want to use UniOTP dy..."
 
Bao (talk | contribs)
0 edits
mNo edit summary
 
(9 intermediate revisions by one other user not shown)
Line 1: Line 1:
[[Category:UniOTP_Tools]]
[[Category:UniOTP_Tools]]


<p>This document mainly introduces how to use and install UniOTP Windows logon Agent, this document is aimed at end users that want to use UniOTP dynamic password authentication to perform system logon.</p>
This document details how to install and use the UniOTP Windows Logon Agent, intended for end users who want to use UniOTP authentication to log onto their system. The UniOTP Windows Logon Agent is used to integrate the UniOTP dynamic password authentication system with Windows. There are two versions of the UniOTP Windows Agent: GINA (Windows 2000, XP); and Credential Provider (Windows Vista, 7, Windows Server 2008). Both use two different Windows logon architecture models. This document covers the installation and usage of the Credential Provider agent.


<p>UniOTP Windows logon agent is used to integrate Windows logon and UniOTP dynamic password authentication. There are 2 versions of UniOTP Windows Agent: GINA version (XP, Windows 2000) and Credential Provider version (Vista, Windows 7, Windows 2008), used for 2 different kinds of Windows logon architecture models. This document mainly introduces installation and usage of Credential Provider version agent.</p>
Note: UniOTP MGS Win Logon currently does not work with Windows 7 Home Premium and Pro.


== Implementation procedure ==
== Installation ==


==== Preparation ====
==== Preparation ====


<p>Before implementing UniOTP Windows logon agent, please verify the following elements:</p>
Before implementing the UniOTP Windows Logon Agent, please verify the following requirements:
* UniOTP authentication server is already correctly configured and is running.
* The UniOTP authentication server is already configured and running.
* The administrator already added an active account for the agent on the server, and this account has been binded correctly to the UniOTP device you are using.
* The administrator has and is already using an active account for the agent on the server
* The aforementioned account has been bound to the UniOTP device used.


==== UniOTPWindows logon agent implementation ====
==== UniOTP Windows Logon Agent Installation ====


<p>1. Once you got UniOTP Windows distributable package in hands, find the installation file “setup.exe” inside the package and double-click it to launch the installation process.</p>
1. Once the UniOTP Windows Distributable Package has been downloaded and installed, find the installation file setup.exe inside the package and double-click it to launch the installation process.


<p>2. Installation process welcome screen (picture below)</p>
2. Click on Next in the InstallShield Wizard welcome screen.


[[Image:uniotpcp img01.jpg|370px]]
[[Image:uniotpcp img01.jpg|500px|alt=installation wizard initial screen]]


<p>3. Fill in your username and company name. (the program will be installed in the directory C:\Program Files\”name of the company”)</p>
3. Input your User Name and Company Name and click on Next.


[[Image:uniotpcp img02.jpg|370px]]
[[Image:uniotpcp img02.jpg|500px|alt=inputting user and company name]]


<p>4. Choose “Complete” installation</p>
4. Select Complete and click on Next.


[[Image:uniotpcp img03.jpg|370px]]
[[Image:uniotpcp img03.jpg|500px|alt=selecting installation type]]


<p>5. Keep the default settings and finish the installation process. Once the installation completed, User management tool will open automatically. (see picture below)</p>
5. Click on Install to begin the installation of the PKI package. After verifying the InstallShield Wizard has completed successfully then click Finish. Once the installation completed, the User Management Tool UniOTPManager will open automatically.


[[Image:uniotpcp img04.jpg|370px]]
[[Image:uniotpcp img04.jpg|500px|alt=UniOTPManager main window]]


<p>6. As there is not any user account added for this machine, you need to use this tool to add a UniOTP account. (If there is no valid account added, it is not possible to close the tool normally)</p>
6. '''Important:''' It is strongly advised that a user account is added for this machine at this point. A new user account must be created before exiting this tool.  If a functioning user account is not configured and added on the computer, users will '''not''' be able to log into the machine. '''Uninstall the UniOTP Windows Logon Agent immediately if any unresolvable errors appear in the following steps.'''


[[Image:uniotpcp img05.jpg|370px]]
[[Image:uniotpcp img05.jpg|500px|alt='it is dangerous if you do not add a UniOTP account for this computer' message]]


<p>7. Click the “Add” button to add a UniOTP account.</p>
7. In the UniOTPManager window, click Add to add a UniOTP account to be authenticated with on the computer.


[[Image:uniotpcp img06.jpg|370px]]
[[Image:uniotpcp img06.jpg|500px|alt=adding new account]]


<p>8. In the field “Account”, enter a valid UniOTP account name. In the field “Auth Server”, type the UniOTP authentication server address. In “Port”, enter the service port (default is 1812). In “Share”, enter the shared key (attributed by UniOTP authentication server). In “Max Wait time”, enter the longest waiting time for server response.</p>
8. Under the Add Account window, in the fields:
* Account, input a valid UniOTP account name;
* Auth Server, input the IP address of the UniOTP authentication server;
* Port, input the service port of the above server (default is 1812);
* Share, input the shared key (used by the UniOTP authentication server);
* and Max Wait Time, input the number of seconds the computer should wait for the server response.


<p>9. Once the account added, you need to click “Apply” to submit user information.</p>
9. After the account has been added, and any other additional modifications made, click Apply. The Apply button must be clicked to submit and apply user information.
[[Image:uniotpcp img07.jpg|370px]]


<p>10. The dialog box below indicates that the user was added successfully.</p>
[[Image:uniotpcp img07.jpg|500px|alt=UniOTPManager new account and authentication server added]]
[[Image:uniotpcp img08.jpg|370px]]


<p>11. By now, we already implemented successfully UniOTP Windows Authentication Agent. Now, we can choose a user in the list and click the button “Test” to perform UniOTP authentication test. (picture below)</p>
10. The dialog box below will appear if updating account information was successful.
[[Image:uniotpcp img09.jpg|370px]]


<p>12. Input OTP password (If the authentication method is set to OTP+PIN, input the PIN just after the OTP password in the same field), click the OK button, if the password is correct, the following dialog will be displayed.
[[Image:uniotpcp img08.jpg|250px|alt='update account information successfully' message]]
</p>
[[Image:uniotpcp img10.jpg|370px]]


<p>If password is wrong:</p>
11. After successfully installing the UniOTP Windows Authentication Agent and adding a new user, performing a two-factor user logon can be done to ensure all processes are functioning correctly. Choose a user in the account list then click Test to perform an authentication test.
[[Image:uniotpcp img11.jpg|370px]]


<p>13. There will be a prompt note shows that the implementation for UniOTP dynamic password authentication is succeeded , Otherwise you need to find the error by referring to the prompted note (please don't reboot , shutdown, lock screen, etc during the operation), until successfully pass the authentication test (If the error can't be solved , please uninstall the UniOTP windows logon agent immediately )</p>
[[Image:uniotpcp img09.jpg|500px|alt=authentication test on a user account]]


<p>14. Once the implementation succeeded, you can restart or lock the computer to begin experiencing the security provided by UniOTP dynamic password authentication. See below the logon screen when the computer is locked. Below you can see the screenshot of the locked screen.</p>
12. Input the OTP password generated from the corresponding OTP device (If the authentication method is set to OTP+PIN, input the PIN directly after the OTP password in the same field), then click OK. If the password entered is correct, the following dialog will be displayed.


[[Image:uniotpcp img12.jpg|370px]]
[[Image:uniotpcp img10.jpg|250px|alt='authenticated successfully' message]]


<p>15. Choose a user to enter the logon interface.</p>
If the password entered is incorrect, the following dialog will instead be displayed.


[[Image:uniotpcp img13.jpg|370px]]
[[Image:uniotpcp img11.jpg|250px|alt='authentication failed' message]]


<p>16. In the password field, input your password used to log on the system.
13. A popup message indicating the result of the UniOTP authentication test will appear. If unsuccessful, refer to the displayed message to solve the error. '''Do not log off, switch user, lock, shutdown, reboot, or otherwise interact with Windows user credentials until successfully completing the authentication test. If an encountered error cannot be resolved, please uninstall the UniOTP Windows Logon Agent immediately.''' Failure to do so will result in the user being unable to log back into Windows. It is recommended to uninstall the UniOTP Windows Logon Agent until the error, if present, has been identified and rectified.
In the UniOTP Account drop-down list, choose your UniOTP account. In the OTP[PIN] password field, input your dynamic password (If the authentication method is set to OTP+PIN, input your dynamic password followed by your PIN in the field. )</p>
<p>Click on the arrow button to achieve the authentication.</p>
<p>If the OTP[PIN] password that you input is wrong, you will get the following error.</p>


[[Image:uniotpcp img14.jpg|370px]]
14. After verifying the two-factor authentication test has completed successful, the user account is now secured with UniOTP authentication. All user accounts identified with UniOTP require the corresponding OTP to successfully authenticate with the user account. To add additional users, repeat the above steps from step 7.


<p>If the OTP[PIN] is right but the operating system password is wrong, you will get the following error.</p>


[[Image:uniotpcp img15.jpg|370px]]
== Usage ==


<p>By now, we succeeded in implementing UniOTP dynamic password authentication protection for this computer.</p>
[[Image:uniotpcp img12.jpg|750px|alt=Windows user select screen]]


== Important Points ==
1. In the Windows login screen, select a user to log into with.


<p>1. When you finish installing UniOTP Windows Authentication Agent, if you cannot pass the authentication test, uninstall the software immediately to avoid being unable to log on the operating system and all the inconvenience it will cause.</p>
[[Image:uniotpcp img13.jpg|750px|alt=Windows user login screen]]
<p>2. If you failed to authenticate many times consecutively(if more than 5 times, ask an operator to check the configuration), please wait 10 minutes before attempting to authenticate again, if you still cannot authenticate for a long time, you need to ask an administrator to repair your device.</p>
 
<p>3. Please to try to modify or delete the SYSROOT\secuagt_cp.conf by yourself, this file is used as the configuration file for UniOTP Windows authentication agent, if this file is deleted or damaged, you might be unable to log on the operating system.</p>
2. In the password field, input the Windows password for the user account to log onto Windows.
 
3. In the UniOTP Account drop-down list, select the corresponding UniOTP account. In the OTP[PIN] password field, input the generated one-time password (if the authentication method is set to OTP+PIN, by default, input your dynamic password followed by your PIN immediately afterwards in the field. Refer to your administrator as to how OTP+PIN authentication is set up).
 
4. Press Enter or click the arrow button to authenticate.
 
If the OTP[PIN] password entered is incorrect, the following error will appear.
 
[[Image:uniotpcp img14.jpg|750px|alt='error code 13' message]]
 
If the OTP[PIN] entered is correct, but the Windows user account password is incorrect, the following error message will appear.
 
[[Image:uniotpcp img15.jpg|750px|alt='incorrect password or username' message]]
 
If authentication was successful, the Windows user account is secured with UniOTP dynamic password authentication.
 
== Important Remarks ==
 
# After installing the UniOTP Windows Authentication Agent, if none of the UniOTP user accounts pass the authentication test, uninstall the UniOTP Windows Authentication Agent '''without delay''', otherwise no user account on the computer will be able to log in.
# If authentication has failed numerous times in succession (, more than five consecutive attempts, refer to the administrator to inspect configuration settings), wait ten minutes before attempting to authenticate again. If authentication is still unsuccessful, refer to the administrator to repair your device.
# Do not modify or delete the "%SYSTEMROOT%\secuagt_cp.conf" file as this is the configuration file for the UniOTP Windows Authentication Agent. Deletion or modification of this file may result in a locked operating system.

Latest revision as of 12:12, 16 August 2016


This document details how to install and use the UniOTP Windows Logon Agent, intended for end users who want to use UniOTP authentication to log onto their system. The UniOTP Windows Logon Agent is used to integrate the UniOTP dynamic password authentication system with Windows. There are two versions of the UniOTP Windows Agent: GINA (Windows 2000, XP); and Credential Provider (Windows Vista, 7, Windows Server 2008). Both use two different Windows logon architecture models. This document covers the installation and usage of the Credential Provider agent.

Note: UniOTP MGS Win Logon currently does not work with Windows 7 Home Premium and Pro.

Installation

Preparation

Before implementing the UniOTP Windows Logon Agent, please verify the following requirements:

  • The UniOTP authentication server is already configured and running.
  • The administrator has and is already using an active account for the agent on the server
  • The aforementioned account has been bound to the UniOTP device used.

UniOTP Windows Logon Agent Installation

1. Once the UniOTP Windows Distributable Package has been downloaded and installed, find the installation file setup.exe inside the package and double-click it to launch the installation process.

2. Click on Next in the InstallShield Wizard welcome screen.

installation wizard initial screen

3. Input your User Name and Company Name and click on Next.

inputting user and company name

4. Select Complete and click on Next.

selecting installation type

5. Click on Install to begin the installation of the PKI package. After verifying the InstallShield Wizard has completed successfully then click Finish. Once the installation completed, the User Management Tool UniOTPManager will open automatically.

UniOTPManager main window

6. Important: It is strongly advised that a user account is added for this machine at this point. A new user account must be created before exiting this tool. If a functioning user account is not configured and added on the computer, users will not be able to log into the machine. Uninstall the UniOTP Windows Logon Agent immediately if any unresolvable errors appear in the following steps.

'it is dangerous if you do not add a UniOTP account for this computer' message

7. In the UniOTPManager window, click Add to add a UniOTP account to be authenticated with on the computer.

adding new account

8. Under the Add Account window, in the fields:

  • Account, input a valid UniOTP account name;
  • Auth Server, input the IP address of the UniOTP authentication server;
  • Port, input the service port of the above server (default is 1812);
  • Share, input the shared key (used by the UniOTP authentication server);
  • and Max Wait Time, input the number of seconds the computer should wait for the server response.

9. After the account has been added, and any other additional modifications made, click Apply. The Apply button must be clicked to submit and apply user information.

UniOTPManager new account and authentication server added

10. The dialog box below will appear if updating account information was successful.

'update account information successfully' message

11. After successfully installing the UniOTP Windows Authentication Agent and adding a new user, performing a two-factor user logon can be done to ensure all processes are functioning correctly. Choose a user in the account list then click Test to perform an authentication test.

authentication test on a user account

12. Input the OTP password generated from the corresponding OTP device (If the authentication method is set to OTP+PIN, input the PIN directly after the OTP password in the same field), then click OK. If the password entered is correct, the following dialog will be displayed.

'authenticated successfully' message

If the password entered is incorrect, the following dialog will instead be displayed.

'authentication failed' message

13. A popup message indicating the result of the UniOTP authentication test will appear. If unsuccessful, refer to the displayed message to solve the error. Do not log off, switch user, lock, shutdown, reboot, or otherwise interact with Windows user credentials until successfully completing the authentication test. If an encountered error cannot be resolved, please uninstall the UniOTP Windows Logon Agent immediately. Failure to do so will result in the user being unable to log back into Windows. It is recommended to uninstall the UniOTP Windows Logon Agent until the error, if present, has been identified and rectified.

14. After verifying the two-factor authentication test has completed successful, the user account is now secured with UniOTP authentication. All user accounts identified with UniOTP require the corresponding OTP to successfully authenticate with the user account. To add additional users, repeat the above steps from step 7.


Usage

Windows user select screen

1. In the Windows login screen, select a user to log into with.

Windows user login screen

2. In the password field, input the Windows password for the user account to log onto Windows.

3. In the UniOTP Account drop-down list, select the corresponding UniOTP account. In the OTP[PIN] password field, input the generated one-time password (if the authentication method is set to OTP+PIN, by default, input your dynamic password followed by your PIN immediately afterwards in the field. Refer to your administrator as to how OTP+PIN authentication is set up).

4. Press Enter or click the arrow button to authenticate.

If the OTP[PIN] password entered is incorrect, the following error will appear.

'error code 13' message

If the OTP[PIN] entered is correct, but the Windows user account password is incorrect, the following error message will appear.

'incorrect password or username' message

If authentication was successful, the Windows user account is secured with UniOTP dynamic password authentication.

Important Remarks

  1. After installing the UniOTP Windows Authentication Agent, if none of the UniOTP user accounts pass the authentication test, uninstall the UniOTP Windows Authentication Agent without delay, otherwise no user account on the computer will be able to log in.
  2. If authentication has failed numerous times in succession (, more than five consecutive attempts, refer to the administrator to inspect configuration settings), wait ten minutes before attempting to authenticate again. If authentication is still unsuccessful, refer to the administrator to repair your device.
  3. Do not modify or delete the "%SYSTEMROOT%\secuagt_cp.conf" file as this is the configuration file for the UniOTP Windows Authentication Agent. Deletion or modification of this file may result in a locked operating system.
Retrieved from "https://esecutech.com/wiki/index.php?title=UniOTP_Credential_Provider_Agent&oldid=1972"