Two-factor authentication protects enterprise environments by replacing static credentials with dynamic credentials. If a password leaks, an attacker still needs a secondary token response to breach a network. The Defender software token, developed by One Identity, turns desktop computers, tablets, and smartphones into secure authentication devices. Organizations deploy these soft tokens to secure VPNs, web apps, and local workstations without shipping physical key fobs to every remote worker.
Implementing software tokens requires careful planning around provisioning, lifecycle management, and active directory synchronization. This guide breaks down how the Defender software token architecture functions, how to configure it correctly, and how to avoid common operational pitfalls.
Core Architecture and Token Mechanics
Understanding how soft tokens interact with backend authentication servers helps administrators design resilient login workflows. Defender relies on a central security server integrated directly with Active Directory.
When a user initiates a login request, the system prompts for a combination of credentials:
- Username: The user's Active Directory account identity.
- PIN: A confidential personal identification number known only to the user.
- Token Response: A time-based or event-based one-time password (OTP) generated by the mobile or desktop app.
The Defender security server validates these inputs against enterprise directories. Because the one-time password changes every thirty to sixty seconds, intercepted codes become useless moments after generation.
Push Notification Integration
Modern deployments often bypass manual OTP entry by utilizing push notifications. Instead of opening an application, reading a six-digit code, and typing it into a login prompt, users receive an alert directly on their mobile device.
Tapping approve completes the authentication handshake instantly. This mechanism reduces friction and closes the window for prompt-fatigue attacks when paired with contextual matching, where the login screen displays a verification number that the user must select on their phone.
Step-by-Step Deployment Guide
Deploying soft tokens across an organization involves preparing the infrastructure, generating activation profiles, and onboarding users. Follow these steps to establish a clean rollout.
Step 1: Initialize Defender Security Server and Active Directory Objects
Before issuing any tokens, the backend environment must recognize the schema extensions.
- Install the core Defender security components on a dedicated server member.
- Configure the Active Directory container to store Defender-specific attributes, ensuring user profiles map correctly to security tokens.
- Establish communication policies between your remote access gateways (such as firewalls or VPN concentrators) and the Defender security server using RADIUS or AAA server groups.
Step 2: Configure the Self-Service Portal
Manually assigning tokens creates heavy administrative overhead. Instead, enable the Defender Self-Service Portal so employees can provision their own devices.
- Deploy the web interface on an internal or perimeter-secured IIS server.
- Define access policies that require multi-factor verification or corporate credentials just to enter the portal.
- Test the token request workflow by logging in with a test account and requesting a software token license.
Step 3: Install and Activate the Client Application
Once the backend is ready, end users install the client software on their designated endpoints.
- Direct users to download the official Defender Soft Token app from the Apple App Store, Google Play, or supported desktop repositories.
- Users open the self-service web portal from a web browser and select the option to request a new software token.
- The portal generates a secure activation QR code or an alphanumeric activation code.
- Open the mobile app, select the option to scan a QR code or enter an activation code manually, and capture the data.
- Verify token generation by viewing the active one-time password display inside the app interface.
For more details on product features and enterprise deployment, consult the One Identity Defender Documentation.
Managing the Token Lifecycle
Tokens require maintenance throughout their operational lifespan. Devices break, employees leave, and application caches corrupt. Establishing rigid lifecycle policies prevents orphaned authenticators from lingering in Active Directory.
Handling Device Migrations
Software tokens are bound to specific device hardware IDs to prevent cloning. When an employee upgrades their smartphone, their existing token will not automatically transfer.
Administrators must revoke the old token serial number within the management console before issuing a fresh activation link via the self-service portal. Allowing users to self-decommission old tokens via the portal reduces helpdesk ticket volumes.
Synchronization Drift
Time drift can occasionally occur between mobile devices and the authentication server, causing valid-looking OTPs to fail authentication. Ensure your enterprise time servers rely on secure Network Time Protocol (NTP) synchronization. If drift persists, configure the Defender security server to accept window tolerances that account for minor clock discrepancies on client phones.
Common Pitfalls and Misconfigurations
Deployments often stall due to preventable oversights during initial setup. Watch out for these operational traps:
- Neglecting Backup Authentication Paths: If a user loses their phone and the self-service portal requires the exact same phone for initial verification, they face a permanent lockout. Always maintain an alternative emergency authentication method, such as temporary administrative overrides or hardware tokens for critical personnel.
- Exposing the Self-Service Portal Directly to the Public Internet: Publishing the enrollment page without pre-authentication or web application firewall protection invites automated enumeration attacks. Restrict portal access behind corporate VPNs or conditional access policies.
- Failing to Set Automated Cleanup Policies: Leaving inactive or disabled user tokens active in Active Directory expands the organization's attack surface. Set up automated scripts or group policies to purge unassigned or expired token records regularly.
Frequently Asked Questions
Can a single Defender software token be installed on multiple devices?
No. Security policies restrict each software token instance to a single hardware device to prevent credential sharing and token duplication. Each unique device requires its own assigned token object.
What happens if a user's smartphone battery dies during a remote login session?
If the device is completely powered down, the user cannot generate a dynamic OTP or approve a push notification. Organizations should provision a secondary authentication channel, such as an SMS token fallback or a hardware YubiKey, for high-availability accounts.
How do users reset their PIN if they forget it?
PIN management is tied to the enterprise directory. Users typically must contact their internal helpdesk or use an authenticated self-service workflow to reset their PIN before generating new token responses.
Does the soft token application require an active cellular or internet connection to generate OTPs?
Time-based one-time passwords run entirely offline based on the device's internal clock and a shared cryptographic seed. Users can generate valid OTP codes even while their device is in airplane mode, though push notifications still require data connectivity.
