Managing Administrative and User Settings

This section provides information on the following:

• Understanding the Configuration Hierarchy
• Configuring SecureLogin Settings

Understanding the Configuration Hierarchy

You can apply SecureLogin settings to a Container object, a User object, or a workstation.

• Container object

  Settings applied to a Container object affect all users and objects in and below that Container object.

• User object

  Settings applied to a User object supersede the settings applied to a Container object or to a workstation.

• Workstation

  You can give users the ability to apply settings to a workstation. However, any settings applied to a User object supersede settings applied to a workstation.

Configuring SecureLogin Settings

You can set up SecureLogin for users by changing default values on the Settings page. Some settings are user settings. Others are administrative settings. Users can change (override) user settings on their workstations. Even if an administrator makes a user setting, users can override it. However, users can't override administrative settings.

1. Click Settings.

   
   

2. Click a setting, click Edit, change the value by using the drop-down list, then click OK.

   To customize text for the passphrase setup dialog box, type the text. The customized text replaces the default text.

3. Save changes by clicking OK or Apply.

To access the Settings tab for Active Directory:

1. Select a Container or User object from the Active Directory Users and Computers in MMC, then select Properties.

2. Select the Settings tab from the SecureLogin SSO tab of the properties dialog box.

The following table provides information on the settings. If you are running in standalone mode, not all settings are displayed.

Preventing Users from Accessing SecureLogin

1. Click Settings.

   
   

2. Click Disable Single Sign-On, click Edit, then set the value to Yes.

Managing Passphrases

SecureLogin uses an underlying security mechanism, known as a passphrase. A passphrase is actually two parts:

• A passphrase question

  The passphrase question should provide a good level of security for the actual answer. For example, a question of "What is 2 times 3?" would obviously not provide a secure passphrase answer. The same could be said for questions that pertain to a user's personal information, such as parents' names.

  To apply an acceptable level of security, the SecureLogin administrator can set the passphrase question.

  Passphrase questions can have 255 characters.

• A passphrase answer

  The passphrase answer is a value that is unique to each user and should only be known by the account owner.

The figure in Entering a Passphrase Question and Answer illustrates the dialog box that collects your passphrase question and answer.

The passphrase should not be confused with the normal login. A passphrase is used to protect the user's single sign-on credential information.

To prevent a rogue administrator from resetting a user's password and attempting to gain access to a user's single sign-on information, SecureLogin prompts for the passphrase whenever SecureLogin recognizes that tampering or an administrative password change has been performed on the user's account.

This passphrase is also used when the user accesses cached login data while not authenticated to the directory.

The passphrase question and answer help you access your login data in the following situations:

• You aren't authenticated to the directory.
• The network connection is lost.
• You are using a laptop computer and are out of contact with the network
• You forget your eDirectory password and have it reset for you.
• Your credential store was locked when an administrator inappropriately reset your eDirectory password.

NOTE:  You can't manage passphrase security in standalone mode.

Entering a Passphrase Question and Answer

As the following figure illustrates, a dialog box enables you to provide a passphrase question and answer. You encounter this dialog box after you install and first run SecureLogin.

SecureLogin uses the question and answer to ensure that no one else uses your login credentials to access your applications. Choose passphrase information that you'll be able to recall months or years from now.

NOTE:   For a passphrase to display properly on multi-byte platforms (for example, Japanese and Chinese), users must use single-byte characters when entering a passphrase.

If you use Novell SecretStore, a specially-designated SecretStore Administrator might unlock your directory-based data stores on your behalf. When you next log in, you encounter a passphrase answer prompt. For more information, see "Setting Up a SecretStore Administrator" in the Novell SecretStore 3.3.0 Administration Guide.

Providing Passphrase Questions

You can provide preset passphrase questions for users to respond to or enable users to enter their own passphrase question.

1. In ConsoleOne, right-click a Container object, then click Properties.

   You can provide passphrase questions for User objects, provided a user has used SecureLogin and set a passphrase question.

2. Click Novell SecureLogin, then select Advanced Settings.

   
   

3. In the Passphrase Questions dialog box, click New.

   
   

   To edit a passphrase question, select it, click Edit, make changes, click OK, then click Apply.

4. Type a question, then click OK.

   
   

5. Click Apply.

Disabling User-Set Passphrase Questions

By default, users can enter their own passphrase questions. To disallow user-set questions and require users to select a preset question:

1. In an administrative tool, select Novell SecureLogin > General Settings, then click Settings.

   
   

2. Click Prevent Users from Entering a Passphrase Question, click Edit, select Yes from the drop-down list, click OK, then click Apply.

Customizing Introductory Text

When users first encounter SecureLogin, SecureLogin prompts them to enter a passphrase question and answer. See Entering a Passphrase Question and Answer. You can edit that text and provide customized instructions.

1. Click Settings.

   
   

2. Select Customize Text for the Passphrase Setup Dialog Box, then click Edit.

   NOTE:  Because the primary data store is unavailable in standalone mode, many SecureLogin management features are not available in that mode.

3. Type text in the Value pane, then click OK.

   
   

   Although your introductory text can have 8 lines with 64 characters in each line, limit your text to 415 characters. If you type too many lines, the text boxes for the passphrase question and answer will hide them.

4. Click Apply.

Using a Passphrase Policy

By default, SecureLogin requires a passphrase that has at least six characters. To set other requirements:

1. Click Settings.

2. Scroll to and select Use a Passphrase Policy.

   
   

3. In the Editing a Setting dialog box, require a passphrase policy by changing the value to Yes.

   
   

4. (Optional) To edit the passphrase policy, click Edit Policy.

   1. Select a setting, then click Edit.

      The following figure illustrates some passphrase policy settings that you can change:

      
      

      To view all the settings, select All from the drop-down list.

   2. In the Editing a Setting dialog box, change the value, then click OK twice.

5. Save the setting by clicking OK twice.

Displaying the System Tray Icon

During installation, you encountered a Post-Install screen that displayed the following options:

If you checked the Start SecureLogin on Windows Startup check box, SecureLogin places the SecureLogin icon on the system tray whenever you start the computer.

To prevent users from displaying and accessing the system tray icon:

1. Click Settings.

2. Select Display the System Tray Icon, then click Edit.

3. Using the drop-down list, change the value to No.

If you turn off the SecureLogin icon on the system tray and then use another tool to change the data, the changes won't take effect until the workstation is restarted.

Disabling the Local Cache

To use login data when you work offline, you can store login data in encrypted files on your workstation. By default, these cache files are located in the \documents and settings\[profile]\application data\securelogin\cache directory.

To disable the cache by using SecureLogin:

1. Right-click the SecureLogin icon on the system tray, select Advanced, then select Change Settings.

2. Select Settings > Enable Cache File.

3. Click Edit, set the value to No, then click OK twice.

To disable the cache by using administrative tools:

1. Right-click the Container or User object, then click Properties > Novell SecureLogin > General Settings > Settings.

2. Select Enable File Cache, click Edit, then set the value to No.

3. Save the changes by clicking OK twice.