Authentication Policy

Integrator

Admin

Manager

The Authentication Policy determines which Credential types are accepted for Door Access. Authentication Policies are required when creating Access Rules. PDK recommends enforcing the Authentication Policy at the Group level to limit Integrator support and deliver the most flexibility to Admins. Access Rules can be created at the Groups/People or Device level. Groups and People Rules can be managed by an Admin. Because Device configurations require Integrator permissions and Admins have no visibility into them, PDK recommends against applying rules at the Device level. 

Recommendations: 

1. Set Policies at the Access Rule: 

Set Authentication Policies when creating or editing Groups (or People) Access Rules

2. Remove Device Authentication Policies: 

Remove all Device-level Authentication Policies to prevent access inconsistencies.

Primary Authentication Policy - At least one must be selected

• Card or Bluetooth: Requires a physical card or a Bluetooth credential through the PDK Access App scan at the reader.
• PIN: Requires entering a PIN on a reader keypad. 
• Mobile Button: Requires tapping the door name in the PDK Access App. Geofenced boundaries can also be configured.

NOTE: If PIN or Mobile Button is selected as the only Primary Policy, it will disable the Secondary Policy option 

Secondary Authentication Policy - Optional: adds an extra layer of security 

• PIN: If the Primary Authentication Policy is set to Card or Bluetooth, a PIN is required as a second step. The user must scan their credential and then enter their PIN.

Important Note: Setting Authentication Policies at both the Device level and Access Rules at the Group or People Level may create access restrictions that require an Admin to contact the Integrator to determine why some groups or users can’t access doors, creating inconsistencies and access issues.