Dynamic User Registration (DUR)

Dynamic User Registration (DUR) allows to create a new user account automatically when the user credentials are validated using back-end authentication. The correct static password is sufficient to create a new user account. DUR saves the administrative work of manually creating or importing a user account.

DUR is typically used together with the following features:

• auto-assignment. OneSpan Authentication Server Appliance selects a random authenticator and assigns it to the new user account as it is created..

  If maker–checker authorization is enabled, assigning an authenticator requires the approval of a checker administrator. In that case, auto-assignment is not available.

• self-assignment. This allows new users to assign an authenticator to their accounts as part of their logon process.

For more information about authenticator assignment features, see  Assigning authenticators to users.

To control the creation of new accounts, DUR can be used with the following features:

• Windows name resolution. This prevents that more than one user account is created for the same Windows user account, when they use different user ID formats to authenticate.
• Windows group check. This allows a staged creation of user accounts and assignment of authenticators.

A typical DUR process using auto-assignment and Windows group check is illustrated in Figure: Dynamic User Registration (Process).

Figure:  Dynamic User Registration (Process)

If the data store is case-sensitive and OneSpan Authentication Server Appliance has not been configured to convert user IDs and domains to upper or lower case, it is possible for multiple user accounts to be created for a single user (if Dynamic User Registration is also enabled and configured).

Example: OneSpan Authentication Server Appliance is not configured to convert user IDs and domains to upper case. If a user logs in with jsmith one time and with JSmith another time, then two user accounts can be created, i.e. jsmith and JSmith.

LDAP synchronization can be used as an alternative to Dynamic User Registration (see LDAP user synchronization). However, there is a difference between these two methods:

• Dynamic User Registration is a one-off synchronization. Deletion or modifications to a user account are not updated in the back-end authentication system.
• LDAP synchronization supports ongoing synchronization of deletions or modifications to a user account in the back-end authentication system.