HID Token Configuration for Mideye

Mideye supports HID Mini Token cards as a second authentication factor. Instead of receiving one-time passwords on a mobile phone, users obtain OTPs from a physical token card.

Token cards are ordered from Mideye Support. These tokens are integrated into the Mideye system — the only difference compared to phone-based authentication is that the user is assigned a token serial number (e.g., AI0123456789) instead of a mobile number.

Note

These token cards differ from on-premise TOTP hardware tokens and are not interchangeable.

---

Setting authentication type

For LDAP users, there are two ways to assign token authentication:

Option A — Token serial in the mobile phone field

Register the token serial with the AI prefix (e.g., AI0750123456) in the mobile phone field. Mideye Server automatically assigns the Token authentication type. Set the Token Number parameter in the User tab to the mobile phone field.

Option B — Separate field with authentication type

In addition to the token serial field, assign another vacant LDAP attribute to indicate the authentication type:

Value	Type
1	Password
2	Mobile
3	Token
4	Concatenated
5	Plus
6	Touch
7	Touch-Plus
8	Touch-Mobile

Configure this via the LDAP profile → Authentication tab → Authentication Type Attribute. Check Read Optional Attributes.

---

Provisioning an HID token

1. Obtain the serial number from the back of the token. All Mideye-dispatched tokens start with AI.

2. Add the serial to the user repository. By default, Mideye Server searches the ipPhone attribute. In Active Directory, open the user properties → Telephones tab → enter the serial in the IP Phone field.

3. Set authentication type to Token. In the LDAP profile → Authentication tab, check Read Optional Attributes and specify an attribute (e.g., pager) for the Authentication Type Attribute.

   

4. Set the value to 3 in the user’s pager field (3 = Token). See Authentication Types for all values.

---

Re-synchronization

Token cards generate OTPs in a sequence unique to each token (time and event synchronous). If more than 10 OTPs are generated without being validated by the server, the token becomes out of sync.

• Automatic re-sync: Within a window of 100 OTPs — enter a new OTP for verification.
• Manual re-sync: If out of sync by more than 100 OTPs — contact Mideye Support with the serial number and counter value.

---

Obtaining token information

Serial number

If the printed serial is not readable:

1. Press and release the button to generate an OTP.
2. While the OTP is displayed, press and hold the button until you see alternating strings:
   • SN
   • 1= XXXXX
   • 2= YYYYY
3. The serial number is AIXXXXXYYYY.

Clock value

1. Follow the serial number steps above.
2. When the serial is displayed, release and press-hold again until:
   • SN
   • 1= XXXXX
   • 2= YYYYY
3. The clock value is XXXXXYYYYY.

Counter value

1. Follow the clock value steps above.
2. When the clock value is displayed, release and press-hold again until:
   • Count
   • 1= XXXXX
   • 2= YYYYY
3. The counter value is XXXXXYYYYY.

Note

Older token cards are event-synchronous only and do not have a clock value.

---

Related links

• Authentication Types — All authentication type values
• YubiKey Administration — YubiKey provisioning guide
• On-premise TOTP Tokens — Software and hardware TOTP tokens