TID Local Authentication with Static Password (Policy)

Local Authentication

This specifies whether authentication requests using the policy will be handled by the Authentication component using local authentication.

When local authentication is used, there are two factors that determine whether an authenticator is used for authentication – any policy restrictions on authenticator types and/or applications that can be used and whether the user account has any assigned authenticator that meets the restrictions. For example, if the policy requires a certain authenticator type, but the user has a different type, they cannot use the authenticator for authentication under that policy.

This setting also affects the provisioning registration process.

Possible values:

• Default. Use the setting of the parent policy.

• None. The Authentication component will not use local authentication under this policy. The authentications may be handled using back-end authentication or not handled at all by the authentication service.

• DIGIPASS Only. The Authentication component will always use local authentication under this policy, using authenticator authentication. If authentication with authenticator is not possible, the user cannot log in. Back-end authentication may also be used.

• DIGIPASS/Password During Grace Period.  The Authentication component will always use local authentication under this policy. The static password can only be used within a (configurable) grace period until an authenticator is used the first time. Back-end authentication may also be used.

• DIGIPASS or Password. This authentication mode allows users to permanently use their static password or their authenticator. This is possible even after the grace period has expired and/or they have previously already used their authenticator for authentication. The grace period also expires after a successful MDL activation, either using an OTP or a signature validation.