Configuring the ActivID AAA Server

A profile is a list of parameters (sets of attributes or attribute/value pairs) that determines user authentication and device policies – including policies on PINs, unlocking PINs, and authenticating.

• The AAA Server checks Authorization profiles as users request access, then either checks data or sends data back to the Access Controller. When a user attempts a connection, an Authorization profile specifies what data to check or send back to the Access Controller.
• The AAA Server stores Accounting profiles on the AAA Server for the purpose of keeping records concerning connections (on a single authentication server or on multiple servers). An Accounting profile defines connection data that the Access Controller returns and which the AAA Server can log.

A query is the primary way in which the AAA Server identifies your users and which device they are assigned.

It enables the AAA Server to search your LDAP directory for the users that belong in the specified group.

A user group is a logical grouping within the AAA Server that enables the AAA Server to efficiently manage user authentication. A group specifies how a set of users may authenticate to a resource(s) protected by the AAA Server, including which gate(s) they may use to access a resource.

The AAA Server uses the LDAP query you’ve assigned to the group, as well as any additional filter you’ve defined for the group, to search your LDAP directory for the users that belong in the group. User groups in the AAA Server can mirror the user groups you have already created in your LDAP directory or not, as needed for authentication purposes. Users can belong to only one group in AAA.

(Remember that a user group is only a logical grouping within the AAA Server. You continue to manage your users in your LDAP directory.)

A device repository is a logical store of authentication devices (smart cards, tokens and USB keys).

When you import pre-initialized devices, the AAA Server automatically stores authentication devices in the root device folder. You can create additional repositories in the root directory for storing devices, instead of the AAA Server automatically storing all devices in the root.

Whether you have a large user database or a relatively small one, it’s easier to manage devices if you store them in an organized way.

Some general categories to consider are:

• Partners, Employees, Customers, Suppliers.
  
• Device-specific categories (for example, smart cards, type of token).
  
• Mirror of your company structure (for example, by department) or by region (for example, Asia Pacific), or by physical location of authentication servers (for example, London, Paris, New York).

Create a New RADIUS Accounting Profile