Skip to main content

Modify hardware token settings

Use this page to configure policy values for standard hardware token authentication. These settings affect how long token responses remain valid and how much variation is allowed during authentication and reset operations.

Modify hardware token settings in IDaaS​

Before you make large changes, test with a small user group. If the allowed time is too short, more users can fail sign-in. If the allowed time is too long, security risk can increase.

  1. Click > Policies > Authenticators. The Authenticators page appears.

  2. Select the Hardware Token tab. The Hardware Token settings appear.

  3. Set the Max. Time Steps to the amount of time (in 30 second intervals) that the token response is valid. The default is 10 (5 minutes).

  4. Set the Max. Reset Time Steps to the amount of time (in 30 second intervals) for a token reset. The default is 120 (60 minutes), which is the allowable time difference between the token and the server clocks.

  5. For event-based tokens (HOTP tokens), configure the following settings:

  6. Set Max Event Window to the numbers of token responses that are searched to find a matching user response during authentication.

    The value entered must be less than the Max Reset Event Window. The value must be between 1 and 25. The default value is 10.

  7. Set Max Reset Event Window to the number of token responses that are searched to find a matching user response during a token reset operation. The value must be between 1 and 100. The default value is 80.

    note

    If the token reset does not work, depending on the type of token you are using, try increasing the Max. Reset Time Steps or Max. Reset Event Window and then try to reset the token again. If the problem continues, call the Entrust customer support team.

  8. Click Save to confirm changes to your Hardware Token authenticator settings.

Validate your changes​

After you save, verify the following:

  1. A test user can complete normal token authentication with the configured Max. Time Steps and Max Event Window values.
  2. Token reset succeeds with the configured Max. Reset Time Steps and Max Reset Event Window values.
  3. Authentication failure rates do not increase unexpectedly after the policy change.
info

To use a TokenCR (Token Challenge/Response) hardware token, you additionally need to create a custom user login authentication flow that uses Token/Challenge Response for second-factor authentication. See Create authentication flows.