Logon policies
The logon policy applies to every logon agent that is configured on the Applications tab in STA and deployed. The policy does not apply to SafeNet Agent for Windows Logon that are not configured on the Applications tab.
The logon policy is evaluated only when the user's machine is running the logon agent. It allows you to specify whether the user must provide their one-time password (OTP) on the lock screen.
If there is a machine that is shared by users from multiple virtual servers, you can share the Windows Logon agent from a parent virtual server to child virtual servers. In that case, the logon policy from the parent applies to the virtual servers that the agent is shared with.
Configure the global logon policy
By default, the global logon policy applies to all users and to every SafeNet Agent for Windows Logon that is configured on the Applications tab.
You can configure whether the user must provide their OTP for re-authentication.
-
On the STA Access Management console, select the Policies tab.
-
Select the Logon tab.
-
If this is your first time setting up a global logon policy, select Set Your Global Logon Policy.
After you save the global logon policy, this prompt no longer displays.
-
If the Set Your Global Logon Policy prompt doesn't display, on the Global Logon Policy for STA, select Edit.
By default, the global logon policy for STA applies to all users and all logon agents. When a logon or unlock attempt occurs, then access is granted after authenticating with the domain password and OTP. The Password and OTP for logon options are selected by default and you cannot clear these checkboxes. You can configure only the options under OTP for logon and the OTP for unlock option.
-
Under Authentication Methods, select the requirements for authenticating with OTP for logon:
-
Every access attempt: Prompt users for their OTP every time they log on.
-
Once every <amount of time>: After the selected amount of time passes, prompt users for their OTP. STA supports periods of: 1, 2, 3, 8, 9, 10, 11, or 12 hours; 1, 2, or 3 days; or 1 week.
-
-
To require an OTP at unlock, under Authentication Methods, select the OTP for unlock check box, and then select requirements for authenticating:
-
Every access attempt: Prompt users for their OTP every time they unlock their machine.
-
Once every <amount of time>: After the selected amount of time passes, prompt users for their OTP. STA supports periods of: 1, 2, 3, 8, 9, 10, 11, or 12 hours; 1, 2, or 3 days; or 1 week.
-
-
Select Save.
-
To add a scenario that checks the IP addresses of your users, continue with Specify IP addresses.
The logon policy has no effect until you configure SafeNet Agent for Windows Logon on the Applications tab and then deploy it.
Specify the IP addresses to synchronize with the policy or configure the SafeNet Agent for Windows Logon.
Specify IP addresses
The SafeNet Agent for Windows Logon allows you to base the unlock policy on the IP addresses of your users. The IP address condition checks whether the access attempt originates from inside or outside the IP address ranges that you specify.
The re-authentication time for Windows unlock is determined based on the public IP range that is specified in the policy. After the re-authentication time expires, users who are enabled with this policy are prompted for an OTP.
-
If you are still in the first configuration flow for the global logon policy, select Ok, let's add a scenario.
-
If the scenario prompt doesn't display, below the Global Logon Policy for STA, select Add Scenario.
-
Enter the Scenario name.
-
In the Conditions section, ensure that the IP Address condition is selected and expanded.
-
Select one of the following options:
-
Inside these networks: Checks whether the access request originates from an IP address that is included in the network.
-
Outside these networks: Checks whether the access request originates from an IP address that is not included in the network.
-
-
In the text box, enter each IP address or IP address range on a new line, and use these formats:
-
Single IP address: 1.1.1.1
-
Range of IP addresses: 1.1.1.1-1.1.1.255
-
-
Select Save.
The logon policy has no effect until you configure SafeNet Agent for Windows Logon on the Applications tab and then deploy it.
Set a passwordless logon policy or configure SafeNet Agent for Windows Logon.
Set the passwordless logon policy
The passwordless logon policy defines who can use Passwordless Windows Logon. Passwordless Windows Logon provides strong authentication and an enhanced user experience when accessing workstations. The passwordless logon policy does not support scenarios.
The passwordless logon policy applies to the selected user groups only if the requirements are met:
-
Passwordless authentication is enabled on the machine.
-
Version 4.0 and later of SafeNet Agent for Windows Logon is installed on the machine.
-
The user completes the passwordless enrollment.
By default, the global logon policy applies to all the users of a tenant. However, the passwordless logon policy takes precedence over global logon policy for the group/groups of users, if it is enabled for them. Also, for all fallback from passwordless to password scenarios, the global logon policy will be applicable.
You can set the scope of the passwordless logon policy to apply to all users or to specific user groups. The global logon policy applies to any users who are within the scope of the passwordless logon policy.
-
If you are still in the first configuration flow for the global logon policy, select Set Your Passwordless Logon Policy.
-
If the passwordless logon policy prompt doesn't display, select Passwordless Logon Policy.
-
Set the scope for the passwordless logon policy:
-
All Users
-
Any of these User Groups and then enter the user group names.
-
-
Select Save.
-
On the Congratulations screen, select I'm Done.
-
The passwordless logon policy has no effect until you enable it.
The logon policy has no effect until you configure SafeNet Agent for Windows Logon on the Applications tab and then deploy it.
