UniOTP Credential Provider Agent
This document details how to install and use the UniOTP Windows Logon Agent, intended for end users who want to use UniOTP authentication to log onto their system.
The UniOTP Windows Logon Agent is used to integrate the UniOTP dynamic password authentication system with Windows. There are two versions of the UniOTP Windows Agent: GINA (Windows 2000, XP); and Credential Provider (Windows Vista, 7, Windows Server 2008). Both use two different Windows logon architecture models. This document covers the installation and usage of the Credential Provider agent.
Installation
Preparation
Before implementing the UniOTP Windows Logon Agent, please verify the following requirements:
- The UniOTP authentication server is already configured and running.
- The administrator has and is already using an active account for the agent on the server
- The aforementioned account has been bound to the UniOTP device used.
UniOTP Windows Logon Agent Installation
1. Once the UniOTP Windows Distributable Package has been downloaded and installed, find the installation file [setup.exe] inside the package and double-click it to launch the installation process.
2. Click on [Next] in the InstallShield Wizard welcome screen.
3. Input your User Name and Company Name and click on [Next].
4. Select [Complete] and click on [Next].
5. Click on [Install] to begin the installation of the PKI package. After verifying the InstallShield Wizard has completed successfully and click on [Finish]. Once the installation completed, the User Management Tool UniOTPManager will open automatically.
6. Important: It is strongly advised that a user account is added for this machine at this point. A new user account must be created before exiting this tool. If a functioning user account is not configured and added on the computer, users will not be able to log into the machine. Uninstall the UniOTP Windows Logon Agent immediately if any unresolvable errors appear in the following steps.
7. In the "UniOTPManager" window, click [Add] to add a UniOTP account to be authenticated with on the computer.
8. Under the "Add Account" window, in the fields: "Account", input a valid UniOTP account name; "Auth Server", input the IP address of the UniOTP authentication server; "Port", input the service port of the above server (default is 1812); "Share", input the shared key (used by the UniOTP authentication server); and "Max Wait Time", input the number of seconds the computer should wait for the server response.
9. After the account has been added, and any other additional modifications made, click [Apply]. The [Apply] button must be clicked to submit and apply user information.
10. The below dialog box will appear if updating account information was successful.
11. After successfully installing the UniOTP Windows Authentication Agent and adding a new user, performing a two-factor user logon can be tested to ensure all processes are functioning correctly. Choose a user in the account list then click [Test] to perform an authentication test.
12. Input the OTP password generated from the corresponding OTP device (If the authentication method is set to OTP+PIN, input the PIN directly after the OTP password in the same field), then click [OK]. If the password entered is correct, the following dialog will be displayed.
If the entered password is incorrect, the following dialog will be displayed instead.
13. There will be a popup note shows that the implementation for UniOTP dynamic password authentication is succeeded , Otherwise you need to find the error by referring to the prompted note (please don't reboot , shutdown, lock screen, etc during the operation), until successfully pass the authentication test (If the error can't be resolved, please uninstall the UniOTP Windows Logon Agent Immediately).
14. After verifying the two-factor authentication test completed successful, the user account is now secured with UniOTP's dynamic password authentication. All user accounts identified with UniOTP require the corresponding OTP to successfully authenticate onto the computer. To add additional users, repeat the above steps from step 7.
Usage
15. Choose a user to enter the logon interface.
16. In the password field, input your password used to log on the system. In the UniOTP Account drop-down list, choose your UniOTP account. In the OTP[PIN] password field, input your dynamic password (If the authentication method is set to OTP+PIN, input your dynamic password followed by your PIN in the field. )
Click on the arrow button to achieve the authentication.
If the OTP[PIN] password that you input is wrong, you will get the following error.
If the OTP [PIN] is correct but the Windows account password is incorrect, the following error will appear.
By now, we succeeded in implementing UniOTP dynamic password authentication protection for this computer.
Important Points
1. When you finish installing UniOTP Windows Authentication Agent, if you cannot pass the authentication test, uninstall the software immediately to avoid being unable to log on the operating system and all the inconvenience it will cause.
2. If you failed to authenticate many times consecutively(if more than 5 times, ask an operator to check the configuration), please wait 10 minutes before attempting to authenticate again, if you still cannot authenticate for a long time, you need to ask an administrator to repair your device.
3. Please to try to modify or delete the SYSROOT\secuagt_cp.conf by yourself, this file is used as the configuration file for UniOTP Windows authentication agent, if this file is deleted or damaged, you might be unable to log on the operating system.
