policyExecute (Command)

The number of days before the first activation message expires.

Applies if Secure Channel is supported.

A comma-separated list of authenticator applications that may be used.

Up to 255 characters.

Specifies the method of automated authenticator assignment that will be used for this policy, if any.

Possible values:

• Default. Use the setting of the parent policy.
• Auto-Assignment. Use the auto-assignment method. Do not reset the server PIN.
• Self-Assignment. Use the self-assignment method. Do not reset the server PIN.
• Auto-Assignment-Pin-Reset. Use the auto-assignment method and reset the server PIN during assignment.
• Self-Assignment-Pin-Reset. Use the self-assignment method and reset the server PIN during assignment.
• Neither. Do not use either method of automated assignment.

Specifies the time span in seconds during which authentication via a particular push notification message is possible, i.e. the time span between sending a push notification message to a mobile device and the response from the OneSpan Mobile Authenticator app. When the timeout period has elapsed, authentication using the push notification message will fail.

Possible values: 0–300

When an authenticator is used for the first time, OneSpan Authentication Server calculates the initial deviation between the authenticator time and the server time, based on the initial synchronization time window (specified by POLICYFLD_SYNCWINDOW).

POLICYFLD_AVOID_INITIAL_SYNC allows you to avoid this time shift initialization on the server side.

Possible values:

• Default. Use the setting of the parent policy.
• No. The initial time synchronization is never omitted. OneSpan Authentication Server handles the time shift for all authenticator types.
• Software DIGIPASS only. This avoids the initialization for time-based software authenticators on the server side. This can be useful, because the time shift is usually handled by the mobile app, so it can be omitted on the server side. For hardware authenticators the time shift is still handled on the server side.

Default value: Software DIGIPASS only

Specifies the protocol to be used for back-end authentication.

Up to 32 characters.

Supported values:

• Windows
• RADIUS
• e-Directory
• Active Directory
• Tivoli

The keyword to use when a user wants to request a backup Virtual Mobile Authenticator login.

The request is made in the password field during login. The request will be ignored if the user does not have an authenticator assigned that is activated for the backup Virtual Mobile Authenticator feature, or if other policy or authenticator settings do not permit to use backup Virtual Mobile Authenticator.

Up to 16 characters.

The keyword to use when a user wants to request a 2-step Challenge/Response login. Used where POLICYFLD_CHALLENGE_REQUEST_METHOD is set to Keyword, KeywordPassword, or PasswordKeyword.

Up to 16 characters.

Can be blank.

This setting is used for advanced control over time-based Challenge/Response authentication.

Possible values:

• 0. No check is made. Required for 1-step Challenge/Response.
• 1. The challenge presented for verification must be the last one that was generated specifically for that authenticator. The regular operation mode for 2-step Challenge/Response. Should be used for standard RADIUS Challenge/Response authentication.
• 2. The challenge presented for verification is ignored. The last one generated specifically for that authenticator is used.
• 3. Only one verification is permitted per time step. This option only applies to time-based Challenge/Response.
• 4. If the same challenge and response are presented for verification twice in a row during the same time step, they are rejected.

Default value: 1

The delayed activation period (in hours), i.e. the time span after the activation until an activated (software) authenticator can effectively be used for authentication and signature operations.

Possible values: 0–4,294,967,295 (UInt32.MaxValue)

A comma-separated list of authenticator models that can be used. The Type field in your authenticator records will display the model number of each authenticator type loaded.

Example values:

• DPEMV
• DIGIPASS 300
• DIGIPASS GO 7

Up to 255 characters.

List of comma-separated key-value pairs that define the maximum number of assigned authenticators allowed per user for a specific authenticator type. The key and value are separated by a semicolon, each key/value pair is separated by a comma.

If you set the limit for a specific authenticator type to 0, no instances for that authenticator type can be assigned. If this attribute is set to NULL, no additional limits per authenticator type are set, except for the default ones, e.g. specified by POLICYFLD_DIGIPASS_TYPES.

Up to 1024 characters.

Example value: DP300;5,DP270;8,

Default value: NULL

Availability: 3.22 and later

Controls the maximum number of events' variation allowed between an authenticator and OneSpan Authentication Server during logon. This only applies to event-based authenticator applications. It always applies when verifying a one-time password (OTP), but for signature validation, it depends on the online signature level setting whether the event window is used or not.

Default value: 20

Specifies whether and how Windows Group Check is to be used.

Possible values:

• Default
• No Check
• Pass Back
• Reject
• Back-End

Specifies the number of consecutive failed authentication attempts allowed before the authenticator application is locked for future authentication attempts. Once the authenticator application is locked, the DIGIPASSAPPLCMD_UNLOCK command is required to unlock it.

Specifies whether authentication requests using the policy will be handled by OneSpan Authentication Server using local authentication.

Possible values:

• Default. Use the setting of the parent policy.
• None. No local authentication is performed.
• Digipass Only. The users can only authenticate using their authenticators.
• DIGIPASS/Password. As long as the grace period for the authenticator has not expired, users can use either their authenticators or their static passwords to log in. After the grace period has expired, only authentications with authenticator can be performed.
• DIGIPASS or Password: Users can use both their authenticator or their static password to authenticate, independent of the grace period. In the context of the authentication scenario, use of this authentication mode is subject to licensing. For provisioning, this authentication mode is license-free.

The maximum number of attempts to unlock a locked user account during authentication (user auto-unlock) before it is permanently locked. A locked user account with no unlock attempts left can only be unlocked manually by an administrator.

Setting this value to 0 effectively disables user auto-unlock.

Possible values: 0–999

The time span a locked user account remains locked before a user can try to authenticate again and unlock it using user auto-unlock. The value is given in minutes.

Applies only if user auto-unlock is enabled, effectively by setting POLICYFLD_MAX_UNLOCK_TRIES.

Possible values: 0–99999

Determines whether the Nested Groups feature is to be used for Windows Group Check during user authentication.

Possible values:

• Default. Use the setting of the parent policy.
• No. Nested group are not used.
• Yes. Nested groups are used.

A check digit may be added to the generated challenge. This allows the authenticator to identify invalid challenges more quickly.

Possible values:

• Default
• No
• Yes

Controls whether 1-step Challenge/Response logins will be enabled for the current policy and, if so, where the challenge should originate from.

POLICYFLD_CHECKCHALLENGE must be included and set to 0.

Not available in a RADIUS environment.

Possible values:

• Default
• No
• Yes - Server Challenge
• Yes - Any Challenge

Specifies the parent policy. Settings set to Default or left blank will use settings from the parent policy.

Cannot be the same as POLICYFLD_POLICY_ID, i.e. a policy cannot inherit from itself.

Up to 60 characters.

Unique policy identifier.

The following characters are not allowed: /\:;,|'"<>[]&@=+*?#.

Up to 60 characters.

The method if and how a user can request a primary Virtual Mobile Authenticator login when this policy is effective. The request is made in the password field during login. The request will be ignored if the user does not have an authenticator assigned that allows primary Virtual Mobile Authenticator login.

Possible values:

• None
• Default
• Keyword
• Password
• KeywordPassword
• PasswordKeyword

The text that will be used as the subject of push notifications sent for authentication and signature operations.

Up to 255 characters.

Availability: 3.17 and later

The keyword to use when a user wants to request a push notification for authentication. Used where POLICYFLD_PUSH_NOTIFICATION_REQUEST_METHOD is set to KeywordOnly, KeywordPassword, or PasswordKeyword.

Up to 16 characters.

May be blank.

OneSpan Authentication Server supports various character encodings that are used to display formatted text of Secure Channel messages on a device. If an authenticator implements multiple font tables, you can set the font table index to specify the font table (character encoding) to use.

Applies if Secure Channel is supported.

Possible values:

• 0. ISO-8859-15.
• 1. Katakana.
• 2. Central and Eastern Europe.
• 3. Greek.

Selects the template in the authenticator which specifies the layout of a page with transaction data.

Applies if Secure Channel authentication is supported.

Possible values: 0–15

OneSpan Authentication Server supports various character encodings that are used to display formatted text of Secure Channel messages on a device. If an authenticator implements multiple font tables, you can set the font table index to specify the font table (character encoding) to use.

Applies if Secure Channel is supported.

Possible values:

• 0. ISO-8859-15.
• 1. Katakana.
• 2. Central and Eastern Europe.
• 3. Greek.

If true, the response will be displayed on the authenticator.

Applies if Secure Channel signature is supported.

Possible values:

• Default
• No
• Yes 

Selects the template in the authenticator which specifies the layout of a page with transaction data.

Applies if Secure Channel signature is supported.

Possible values: 0–15

The character (or short sequence of characters) that will be included at the end of the authenticator serial number during a self-assignment login.

Up to 8 characters.

The period (in days) before a static password expires and the end user must be notified to update the static password. Applies to the local authentication mode DIGIPASS or Password only.

Default value: 8

Possible values: 0–9999

If the value for this field is set to 0, this effectively means that the Notify-before-Expiration feature of the static password is not used.

The minimum number of days a static password must be used before it can be changed again. Applies to the local authentication mode DIGIPASS or Password only.

Default value: 1

Controls the maximum number of time steps' variation allowed between an authenticator and OneSpan Authentication Server during digital signature verification. This only applies to time-based authenticator applications when validating a signature. Only used if POLICYFLD_ONLINESG is set to 1 or 2.

Default value: 24

Controls the maximum time variation allowed between an authenticator and OneSpan Authentication Server, the first time that the authenticator is used. The time is specified in hours. This initial time window is also used directly after a DIGIPASSAPPLCMD_RESET_APPL operation, which can be used if it appears that the internal clock in the authenticator has drifted too much since the last successful logon.

The maximum number of days within which a user must log on again for the user account to remain valid. If a user does not log on within this period, the account will be locked due to inactivity.

A locked account can be unlocked using the USERCMD_RESET_LAST_AUTH_TIME operation.

This specifies the number of consecutive failed login attempts that will cause a user account to become locked.

This field specifies how OTP values are sent via Message Delivery Component (MDC)

Possible values:

• Email
• SMS

This field provides the user-specific override of the virtual signature message delivery method as defined in the policy, i.e. it defines how the virtual signature messages will be delivered to the end user.

Possible values:

• Default
• Email
• Email and Voice
• SMS
• SMS and Email
• SMS and Voice
• Voice

Optional (deprecated)