Static password management

Static passwords can be managed in the following ways:

• If you are using LDAP-based Microsoft Active Directory back-end authentication and want to prevent the use of static passwords entirely, password randomization can be used (see Static password randomization). Password randomization replaces the user's static password with a randomized password, unknown to the user. This enforces the use of the authenticator for future authentication.

• If you have certain applications that do not allow integrating OTP authentication, so that password randomization is impossible (as users would no longer know their static passwords), OneSpan Authentication Server Appliance needs to learn and update the static password.

  There are two methods for this:

  • Manually by setting up LDAP back-end authentication. Users can enter their static password and OTP on first logon, and whenever the static password is changed. OneSpan Authentication Server Appliance recognizes from the password length if a password needs to be stored or updated.
  • Automatically using Password Synchronization Manager (PSM). Password Synchronization Manager is installed on the domain controller and allows to automatically synchronize password changes from Windows user accounts to the OneSpan Authentication Server Appliance database (see Static password synchronization).