Specifies whether the Dynamic User Registration (DUR) feature is enabled for the policy. If this feature is used, it will automatically create a user account, if OneSpan Authentication Server receives an authentication request for a user for the first time, and if back-end authentication is successful.

If DUR is used together with auto-assignment, an authenticator will be assigned to the new user account immediately.

This setting also determines whether the provisioning registration process is allowed to perform DUR or not.

Specifies whether the password autolearn feature is allowed by the policy. This feature enables OneSpan Authentication Server to update the password stored in the user account when back-end authentication is successful.

This setting also determines whether the provisioning registration process will update the password after successful back-end authentication or not.

Specifies the number of invalid logon attempts that are allowed before a user account is locked. For example, if User Lock Threshold is 3, the account will become locked on the third failed logon attempt. Unlocking the account requires administrator action or user auto-unlock enabled.

Note that not all types of logon failure will result in locking. For example, if the user ID is incorrect or the account is disabled, the failure would not count for the lock threshold. Locking is used mainly for incorrect OTPs and static passwords.

The locking mechanism is also used for provisioning and signature validation.

The multiplier factor to increase the lock duration after each unsuccessful authentication. The initial value is specified by Minimum Lock Duration. The multiplier value is given in percent. For example, a value of 200 effectively doubles the lock duration after each unsuccessful authentication.

Applies only if user auto-unlock is enabled, effectively by setting Maximum Unlock Tries.

Possible values: 100–500

This setting specifies the number of days a user account can remain inactive before it is suspended. If the account has been suspended the user will not be able to log on. The user will be notified during authentication that the user account has been suspended. By default, a user account expires when no operations have been performed during the last 90 days.

You can reactivate a suspended user account with the Reset Last Authentication Time action in the USERS > User Account tab.

Setting this value to 0 effectively disables this feature. User accounts that are suspended at the time the feature is being disabled will become active again with the next successful user authentication.

This setting specifies the type of access to non-administrative tasks for a user who has administrative privileges.

Possible values:

• Default. Use the setting of the parent policy.
• Accept. Allow this user to proceed through the transaction
• Reject. Do not allow this user to proceed through the transaction
• Required. This user must have administrative privileges to proceed with processing.

Determines whether nested groups can be used for Windows group check during user authentication.

Possible values:

• Default. Use the setting of the parent policy.
• No. Nested groups are not used.
• Yes. Nested groups are used.

This implementation changes the behavior of Windows back-end in regards to the following:

• When upgrading to a later version of OneSpan Authentication Server, the administrator must re-add local domain groups, as the Windows naming conventions have been changed.
• Local (non-domain) users and groups can no longer be used after upgrading to a later version of OneSpan Authentication Server.

For more information about nested groups, refer to the Microsoft documentation.

The options in this section allow you to define password complexity and age rules for the local static password of the associated user.

The effective password policy settings are based on the server component and depend on the user type. If the password of an administrative user is changed, the effective policy values for password strength rules apply. If the password of a regular user is changed, the values defined in the base policy of the applicable policy apply.

Specifies the minimum number of lowercase characters required in the password.

Possible values: 0–9999

Specifies the minimum number of numerical digits required in the password.

Possible values: 0–9999

Specifies how many different passwords must be used before a previously used password can be used again.

Possible values: 0–24

Specifies the maximum amount of time in days during which a local static password is valid. After this time, the password expires. Applies to the local authentication mode DIGIPASS or Password only.

If set to 0, the local static password never expires. You should set this value to disable local static password expiration if you are using back-end authentication, and rather rely on the back-end system to enforce password expiration.

Possible values: 0–9999