---

---

Pledge Overview

Being able to securely access critical data is imperative, but for many organisations the standard authentication method for accessing information is with a username and a password. This is too weak for protecting corporate assets.

The Pledge system solves this problem by securing the login with two-factor authentication.

Pledge turns mobile devices into security tokens and is available for most devices. The product comes with a complete infrastructure for automation of key enrollment and customizable profiles. Instead of using a security token when logging in, you simply use your preferred device. Using Pledge, you can log in securely to different applications and even sign different transactions.

This guide describes how to implement the Nordic Edge Mobile Client Pledge together with Nordic Edge One Time Password Server version 3 (OTP Server).

The Pledge system consists of three components:
- Pledge Profile Factory
- Pledge Enrollment
- Pledge Client

Pledge Profile Factory

Pledge Profile Factory is the environment where administrators can configure and customize their Pledge corporate profile. A designer tool is available to customize logos, background pictures, colors as well as configure PIN-code settings, contact information such as text and service desk URL and check Pledge licensing information.

Pledge Profile Factory is a web service provided by Nordic Edge.

Pledge Enrollment

Pledge Enrollment is a service to automate the delivery of Pledge User Profiles to end-users.

There are two ways to enroll for Pledge, end-users can self-enroll or Pledge administrators can enroll end-users.

Pledge enrollment generates an OATH key and sends a request to Pledge Profile Factory to provide a Pledge ID to the end-user or the administrator.

The Pledge Enrollment service is embedded into the Nordic Edge OTP Server but can also be downloaded and installed separately into a DMZ solution.

Pledge Client

Pledge is a mobile client used to generate one-time passwords based on the OATH algorithm.

The Pledge Client can be installed on most devices and generates One-time passwords used for two factor authentication with the Nordic Edge OTP Server or other OATH compliant systems. 

The Pledge Client supports multiple profiles which makes it useful for authentication to multiple services or ISP-solutions. 

The Pledge client is available from all major App Stores, search for "Pledge" or nordicedge.com/pledge

TERMINOLOGY

Term	Description
Pledge	Pledge is a software token from Nordic Edge following the HOTP (RFC 4226) OATH standard.
Pledge Profile Factory	A Nordic Edge web service for corporations to design and customize their corporate Pledge profile. Pledge Profile Factory receives enrollment request from Pledge Enrollment service and is responsible for distributing Pledge Profiles to Pledge clients.
Pledge Corporate Profile	A Pledge Corporate profile is designed following a corporation's branding and security standard and is the template for all Pledge User Profiles downloaded onto Pledge Clients.
Pledge User Profile	The Pledge User Profile is a copy from the corporate profile combined with a profile ID, also called Pledge Profile.
Pledge ID	A Pledge ID is offered by Pledge Enrollment and is representing a unique Pledge User Profile which is used when downloading it.
Pledge Enrollment	Pledge Enrollment is a service to automate the delivery of Pledge User Profiles to end-users. Must be able to contact Pledge Factory and OTP Server.
Pledge Client	Pledge is a software client used to generate one-time passwords based on the OATH algorithm.
Pledge Web service account	A web service account corresponding to a Pledge Profile Factory account must exist prior to configure Pledge Enrollment. Used to access Pledge Factory.
Pledge Profile Factory Administrator account	Administrative accounts used to access Pledge Profile Factory to customize and configure corporate profiles.
OATH	Open Authentication (OATH) is an open standard designed to offer strong authentication to devices from multiple vendors. OTP Server is supporting Tokens using both OATH standards, HOTP and TOTP. http://support.nordicedge.se/nordic-edge-one-time-password-server-oath-integration/
OTP Server	Nordic Edge One Time Password Server.
Pledge Enrollment Database	A LDAP or SQL database for storing OATH keys. Usually the User Store, for example the Active Directory.
OTP Client Native Client	Nordic Edge Client that uses the OTP Server APIs to communicate with the OTP Server.

---

1 Overview of Pledge Enrollment Process

The Pledge Enrollment process generates an OATH-key and combines this OATH-key with a copy from the corporate profile to generate a unique Pledge User Profile including a Pledge ID. 

This Pledge ID is sent to Administrators or Users and is used to download Pledge User Profiles into Pledge Clients.

Self-enrollment process

1. Install Pledge Client on device.
2. User browse to the Pledge Enrollment service. Eg. https://OtpServerIP:8080/PledgeEnrollment/enroll.jsp
3. User enter its username and password to receive a Pledge ID.
4. User start Pledge Client app and enter Pledge ID.
5. Pledge User Profile is downloaded into Pledge app.

Admin-Enrollment process

1. User install Pledge Client on device.
2. Administrator browse to the Pledge Enrollment service. Eg. https://OtpServerIP:8080/PledgeEnrollment/supportenroll.jsp
3. Administrator enter its username and password plus the username from end-user. Pledge Enrollment service presents a Pledge ID on Administrator's screen.
4. Administrator send Pledge ID to User via e-mail for example.
5. User start Pledge Client app and enter Pledge ID.
6. Pledge User Profile is downloaded into Pledge app.

Technical description of the enrollment process

When enrolling for a Pledge Profile the Pledge Enrollment service sends a web service request to the Pledge Profile Factory asking for a Pledge profile. The Pledge Profile Factory will perform the following steps:

1. Generate a unique symmetric key and a corresponding counter.
2. Package the corporate profile into a zip-file.
3. Generate a unique Profile ID.
4. Combine all the above information into an XML message and associate it with the Profile ID.
5. Reply to the Pledge Enrollment Service with the unique symmetric key, corresponding counter and the Pledge ID.

The Pledge Enrollment Service is presenting the Pledge ID to end-user or administrator. End-user starts the Pledge Client on the device, clicks on the key symbol in the down left corner and enters Pledge ID. The Pledge Client contacts to Pledge Profile Factory via an HTTPS connection and download the Pledge User Profile.

The Pledge Client is now ready to generate One-time passwords.

---

Overview of Pledge enrollment

---

2 Implementing Pledge Overview

The process of implementing Pledge begins with the configuration of the corporate profile in Pledge Profile factory and ends by installing and configuring Pledge Enrollment.

1. Register for a Administrator account in Pledge Profile Factory

2. Configure the Pledge profile in Pledge Profile Factory

3. Request a Pledge Web service account

4. Configure the OTP Server and Pledge Enrollment

3 Implementing Pledge Overview Step by Step

3.1 Register Pledge Profile Factory account

• Browse to Pledge Profile Factory https://services.nordicedge.se/pledge-im
• Click "Register here"

• Enter OTP received via email.
• Click "OK"

---

---

5 Configure OTP Server for Pledge Enrollment Service

The configuration steps are:

- Configure a Pledge Enrollment Database to assign a Pledge OATH key attribute to user accounts.

- Configure a Pledge Enrollment Client for the Pledge Enrollment service.

Configure Pledge Enrollment Database

The Enrollment Database is storing Pledge OATH keys.

In this guide Microsoft Active Directory is used as the enrollment database.

• Start OTP Server and click "Configuration"

• Click on Databases and then on the LDAP Database button.

5.1.1 Configure LDAP Settings

Active Directory is installed on the same server as OTP Server. Internal IP-address used is (127.0.0.1) for host address and standard LDAP port 389 to communicate with Active Directory is selected.

INFO: 

Admin DN user needs rights to read the user objects attributes and write the OATH-key into selected attribute to store the users OATH-key.

To use the Disable Account feature from OTP Server, Admin DN user also needs rights to modify the disable account attribute.

• Choose a name for the database. Eg. Pledge Enrollment Database.
• Must select "Uses HOTP (OATH)".
• Enter IP adress from Active Directory server (127.0.0.1).
• Port number, use default 389.
• Enter Admin DN.
• Enter Admin DN password.
• Click on Test Connection (You should get a message saying “LDAP connection success”)

5.2 Configure the LDAP database settings

The BASE DN is the search base where user objects are stored in Active Directory.

• Click on the button with three dots on the right side of the Base DN field to browse Active Directory Database.
• Click on the Organization Unit or Organization where user objects are stored and click OK.