Adaptive Authentication tab configuration

Service Disruption Handling

When there is a service disruption to the SecureAuth Cloud Services, this impacts the ability of SecureAuth IdP to process adaptive authentication risk checks and provide secure authentication login methods to end users.

Select the risk check action to authenticate the end user.

For more information about the actions to take, see the risk check action definitions.

IPv6 Handling

When an IPv6 address is detected, to which SecureAuth IdP cannot process, this impacts the ability of SecureAuth IdP to process adaptive authentication risk checks and provide secure authentication login methods to end users.

Select the risk check action to authenticate the end user.

For more information about the actions to take, see the risk check action definitions.

The default selection (Require two-factor authentication) requires end users to use a two-factor authentication method which does not involve SecureAuth Cloud Services such as: email, knowledge-based answers, HID hard tokens (including YubiKey devices), or timed passcodes from a desktop or mobile app. These two-factor authentication methods must be configured on this realm.

Factor Analysis

List includes all enabled adaptive authentication risk checks factors.

The list is in order by processing sequence; you can drag and drop selections to reorder the processing sequence.

Risk Ranges

Configure the risk ranges for Minimum, Medium, High, and Maximum risk scores.

By default, a low score indicates a good user, and a high score indicates a risky user.

Alternatively, you can set the risk ranges in reverse order by moving the slider to enable Use Inverted Risk Ranges.

With inverted risk ranges, a low score indicates a risky user, and a high score indicates a good user.

Image example of inverted risk ranges

Risk Score Provider Name

Set the descriptive name for the risk provider.

Base URL

Set the base URL of the risk provider instance in this format: https://services.company.com:59.

Get Profile Relative URL

Set the endpoint of the REST API provider in this format: /api/user/{username}/info.

Insert the {username} variable in the position the endpoint expects the userID to be in the string.

Authentication Method

Set the authentication method supported by the REST service. Options are:

Username

Set the username of the risk provider service account to which it has access to retrieve user profile information.

Password

Provide the password associated with the Username.

Risk Score User Identifier

Set the target user ID in the format to which the user risk provider expects to identify end users. It most cases, it is the same value as the default User Authenticated ID. In other cases, the user risk provider might use a different user ID; for example, the end user logs in with a sAMAccount name, but the user risk provider uses an email address as the user identifier.

To use another user identifier, you must map that field to a property in the Data tab. Then, from the Risk Score User Identifier list, select the mapped Property.

For example, on the Data tab, in the Profile fields section, Email 1 field is mapped as a Default Provider source with a field entry of mail. So, for the Risk Score User Identifier field, you would select Email 1.

Data tab mapping example

Risk Score JSON Path

Set the risk score JSON path values used to parse the JSON string returned to SecureAuth IdP and to extract the numeric score value from it. See the following table for example JSON path values.

{
 "status": true,
 "user": "rfobber",
 "userInfo": {
   "riskScore": 90,
 },
}

{  
"status": found,  
"userID": "rfobber",  
"risk_score": 0
}