Following are the generic steps to configure an existing event:
Click Events > New Event.
Specify a name of the event in Name.
Ensure that Is enabled is set to ON if you want to use the event.
Select the Event type.
For most of the predefined events, you cannot change the Event type.
This option is only applicable for Windows logon, Linux logon, and Mac OS logon events. You can change the Event type from OS Logon (domain) to OS Logon (local) if the workstations are not joined to the domain.
Select OS Logon (domain) to allow only the domain joined users to login to the event.
Select OS Logon (local) to allow any Advanced Authentication user from any repository to access the event. However, users must map themselves to a local user account during their first login by providing the credentials.
Enable the reCAPTCHA option to ON if you want the Google reCAPTCHA option to be displayed in the login page for the particular event.
The reCAPTCHA option is displayed only when you enable the Google reCAPTCHA Options policy.
NOTE:The reCAPTCHA option is supported only for the Admin UI event, Authenticators Management event, Helpdesk event, Helpdesk user event, Report logon event, Tokens Management event, and the Search Card event.
By default, All Categories is set to ON. When the multiple event categories are created, users can enroll an authentication method multiple times (one enrolled method per category).
When All Categories is set to ON, users can authenticate to the event using any of the supported methods (Card, FIDO U2F, HOTP, Password, and TOTP) and Advanced Authentication automatically chooses an appropriate authentication method.
To use other methods, Advanced Authentication prompts for the category selection.
The All Categories option is displayed only if you have added categories in the Event categories
policy.
For example, an administrator has configured two categories CAT1 and CAT2. The Default category is predefined in the Administration portal. Users can enroll three devices. The All Categories is set to ON for the Windows logon event. A user has three cards and enrolls each to a category as follows:
Card 1 to Default
Card 2 to CAT1
Card 3 to CAT2
After enrolling cards, the user can authenticate to the Windows event by using one of the enrolled cards.
You can set All Categories to OFF if you want to disable support for multi-enrollment of supported methods.
The Authenticator category is displayed when All Categories is set to OFF. Select the preferred category from Authenticator category.
Select the chains that you want to assign to the current event.
In an event, you can configure a prioritized list of chains that can be used to get access to that specific event.
The top chain (first chain) in the list of selected chains will be considered as a high-priority or high-security chain for that specific event.
You can reorder or remove methods in the chain using the up and down arrows, as well as the remove button next to the Used list.
(Conditional) In Risk Policy, select the policy that you want to assign to this event for assessing the risk associated with a login attempt.
(Conditional) Click Create New Policy to create a new risk policy for this event.
Clicking this option opens the Risk Settings page.
IMPORTANT:Risk Policy and Create New Policy options are available when you enable Risk Settings. For more information, see Section III, Configuring risk settings.
(Conditional) Set the Enable chain selection with one of the following options on your requirements:
ON: Select this option to allow users to select their preferred authentication chain from all the chains that are available to them. By default, this option is set to ON.
OFF: Select this option to force users to use the chain that has the highest priority for authentication.
OPTIONAL: Select this option to display the high-priority chain with the ability to select the other chains from the list. If the user doesn’t wish to continue with the highest priority chain, they can click the Select Chain button to select their preferred chain from all the chains that are available to them.
NOTE:This option is available only for the Authenticators Management (New Enrollment UI), OOB UI Logon, and Smartphone Enrollment. It is also available for OAuth2 / OpenID Connect and SAML2 events.
If you want to restrict access of some endpoints to the event, add all the endpoints that must have access to the Endpoints whitelist. The remaining endpoints are blacklisted automatically. If the Endpoints whitelist blank, all the endpoints are considered for authentication.
IMPORTANT:Endpoints whitelist supports only the Windows Logon, Linux Logon, and Mac OS Logon events.
Set Geo-fencing to ON to enable geo-fencing. Move the permitted zones from Available to Used. For more information about configuring geo-fencing, see the Smartphone method.
IMPORTANT:You must enable the Geo fencing options policy to use the geo-fencing functionality.
Select Allow Kerberos SSO if you want to enable single sign-on (SSO) to the Advanced Authentication portals. Kerberos SSO is supported for AdminUI, Authenticators Management, Helpdesk, and Report logon events.
Set Logon with Expired Password with one of the following options based on your requirement:
Allow: Select this option to allow users to log in to the event with the expired LDAP password.
Ask to change: If the password has expired this option prompts users to change the password during logon. Change in the LDAP Password is supported only for the Active Directory repositories. However, the LDAP Password change in Advanced Authentication is not allowed when the LDAP Servers in the Repository settings are configured with port 389. The LDAP server rejects the new password.
Deny: Select this option to deny access to the event with the expired LDAP password. When the access is denied, the following message is displayed to users:
You must change your password to logon.
Set Bypass user lockout in repository to ON, users, who are locked in the repository, must select and authenticate with the chain that does not include the LDAP Password method. By default, Bypass user lockout in repository is set to OFF and locked users cannot authenticate by using any chain.
To use this functionality, it is required to have more than one chain without the LDAP Password method assigned to the event. This is to provide more options to users.
NOTE:All authentication chains irrespective of whether it includes the LDAP Password method or not are displayed to users who are locked in the repository.
Set Allow token re-use to ON, if you want to allow users to apply the OTP multiple times within the Allow re-sending after (seconds) duration for authentication. This option is applicable for Email OTP, SMS OTP, and Voice OTP methods.
By default, Allow token re-use is set to OFF and users are not allowed to apply the OTP more than once within the Allow re-sending after (seconds) duration that has been set for Email OTP, SMS OTP, and Voice OTP methods.
Set Return groups on logon to ON if you want to retrieve the group details of users who authenticated to the event in the authentication response.
With Return groups on logon set to ON, if Groups is empty, all the groups that the users are associated with are returned in the response. However, to return the required groups, specify the preferred groups in Groups.
Sometimes, the authentication response of RADIUS event is lengthy if a user is associated with several groups. Therefore, it is recommended to use Groups to limit the groups' in the response.
By default, Return groups on logon is set to ON for all events except for Authenticators Management, Smartphone Enrollment, and SAML 2.0 events.
When this option is set to OFF, the groups of users authenticated to the event are not returned in the response.
Select the Allow to logon to this event by shared authenticator option to allow users to login using shared authenticators. By default this option is disabled for the Authenticators Management, Helpdesk, Helpdesk User, AdminUI, Search Card, Token Management, and Report Logon events and enabled for all the other events.
NOTE:The Allow to logon to this event by shared authenticator option is displayed if you enable the Enable sharing of authenticators option in Authenticator management options policy.
Click Save.
Click Initialize default chains to revert the changes that are applied to the default configuration.
NOTE:If you have configured more than one chain using one method (for example, Smartphone + LDAP Password, LDAP Password) and assigned to the same group of users and the same event, then the top chain (first chain in the list) is always used if the user has enrolled all methods in the chain.
HINT:It is recommended to have a single chain with the Emergency Password method at the top of the chains list in the Authenticators Management event and other events, which are used by users. The chain will be ignored if the user does not have the Emergency Password enrolled. The user can use the Emergency Password immediately after the helpdesk administrator enrolls the user with the Emergency Password authenticator.
By default, Advanced Authentication contains the following events:
This event is used to integrate Advanced Authentication with ADFS using the previous ADFS plug-in for Advanced Authentication 5.x.
For 6.0, you can use the new ADFS MFA plug-in. For more information see the Configuring the Advanced Authentication server for ADFS Plug-in guide.
For more information about ADFS event configuration options, refer the Generic Options detailed in Configuring an existing event.
Use this event to access the Administration portal. You can configure the chains that can be used to get access to the /admin URL.
IMPORTANT:You must be careful when changing the default chains that are assigned to this event. You may block the access to the Administration portal.
NOTE:You can promote users or group of users from a repository to the FULL ADMINS role in Repositories > Local. After this, you must assign chains in which the methods are enrolled for users with the AdminUI event (at a minimum with an LDAP Password).
WARNING:If you have enabled the Google reCAPTCHA policy for the Admin UI event, you must consider the following guidelines. Otherwise, a deadlock scenario might happen and you cannot access the Administration portal without the cluster re-installation:
If the site key or secret key gets deleted at the Google server, you will not be able to get the same site key or secret key. The site key and secret key used on the Administration portal are no more valid and there is no way to bypass the reCaptcha on the Administration portal.
If you have registered the reCAPTCHA for one domain name and you change the domain name or migrate the Advanced Authentication server to another domain name, the site key or secret key used on the Administration portal are no more valid.
For more information about AdminUI event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to enable a login to the Authentication Agent for Windows in Advanced Authentication 6.3 SP4 and prior versions.
From Advanced Authentication 6.3 SP5, the OOB UI Logon event is used instead of this event.
For more information about Authentication Agent event configuration options, refer the Generic Options detailed in Configuring an existing event.
Use this event to access the Self-Service portal. In the Self-Service portal, users can enroll to any of the methods that are configured for any chain and they are a member of the group assigned to the chain.
For more information about Authenticators Management event configuration options, refer the Generic Options detailed in Configuring an existing event.
In addition to the generic steps, perform the below event specific configuration:
Add an LDAP Password chain as the last chain in the list of chains to ensure secure access to the portal for users who have methods enrolled.
IMPORTANT:If the Administration portal uses a repository that does not have any user, you must enable a chain with Password only (Authenticators Management - Password) for this event. This action enables you accessing the Self-Service portal or changing the password in the Self-Service portal.
You can also perform basic authentication with Advanced Authentication. To achieve basic authentication, set the Allow basic authentication option to ON in the Event Edit screen for Authenticators Management.
NOTE:The basic authentication is supported only for the Authentication Management event and for the Password, LDAP Password, and HOTP methods.
You must specify /basic with the URL to login to the enrollment page. The Login page appears and the format of the Username you must provide is: username:PASSWORD|LDAP_PASSWORD|HOTP:1. For example: admin:PASSWORD:1.
When you log in to the Self Service portal, by default the chain with the highest priority is displayed. To display the other chains with the enrolled methods, set Show chain selection to ON. This option is applicable only for the Old Enrollment UI.
NOTE:If you enable to show the chain selection, but a chain is not displayed in the list of available chains in the Self-Service portal, ensure that all the methods of the chain are enrolled by the user.
For more information, see Managing authenticators
in the Advanced Authentication- user guide.
Click Save.
Use this event to enroll the TOTP method using the OTP Desktop tool. This event supports a chain with either LDAP Password or Password method as a single factor authenticator.
For more information about OTP Desktop Tool event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to enable the Helpdesk administrator to access the Helpdesk portal. One of the roles of a Helpdesk administrator is to set an emergency password for users. An emergency password is a temporary password for users when they lose their smart card or smart phone. Some companies restrict self-enrollment and have the Helpdesk administrator who does the enrollment after hiring. You can promote the repository administrators or users as Helpdesk administrators in the Repositories > LOCAL > Edit > Global Roles > ENROLL ADMINS section.
For more information about Helpdesk event configuration options, refer the Generic Options detailed in Configuring an existing event.
You can manage the enrollment and re-enrollment of the authenticators in one of the following ways:
Restrict the self-enrollment and force users to enroll through the Helpdesk. Or
Restrict only the re-enrollment or deletion of authenticator from the Self-Service portal using the Disable re-enrollment option.
For more information, see Managing Authenticators
in the Advanced Authentication- Helpdesk Administrator guide.
Configure the settings of this event to enable the Helpdesk administrator to authenticate users in the Helpdesk portal. This event is applicable for the User to manage screen that appears on the Helpdesk portal.
NOTE:You must enable the Ask credentials of management user option in the Helpdesk Options policy before using this event.
For more information about Helpdesk User event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to enable login to the Linux Client.
NOTE:If you want to use Linux Client on non-domain joined workstations, change the Event type from OS Logon (domain) to OS Logon (local).
For more information about Linux Logon event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to enable login to the Mac OS Client.
NOTE:If you want to use Mac OS Client on non-domain joined workstations, change the Event type from OS Logon (domain) to OS Logon (local).
For more information about Mac OS Logon event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to enable login to the Mainframe system.
Example of Mainframe logon event is Advanced Authentication Connector.
For more information about Mainframe Logon event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to facilitate the integration of Advanced Authentication with OpenText Access Manager.
For more information about NAM event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to facilitate the integration of Advanced Authentication with OpenText CloudAccess. CloudAccess must be configured to use Advanced Authentication as an authentication card and user stores must be added for the repositories for the integration to work. For more information, see the CloudAccess documentation.
For more information about NCA event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure this event to log in to the Advanced Authentication OOB portal, Authentication Agent for Windows, and Authentication Agent for Web. These components enable users to manage the authentication requests of the Out-of-band method to authenticate to a specific event for which a chain with the Out-of-band method is assigned.
NOTE:You must not assign a chain containing the Out-of-band method to the OOB UI logon event.
For more information about OOB UI Logon event configuration options, refer the Generic Options detailed in Configuring an existing event.
The Advanced Authentication server contains a built-in RADIUS server to authenticate any RADIUS client using one of the chains configured for the event. For more information about configuring the RADIUS Server event, see RADIUS server
.
For more information about RADIUS Server event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to log in to the Advanced Authentication Reporting portal. For more information about the Reporting portal, see Reporting
.
For more information about Report Logon event configuration options, refer the Generic Options detailed in Configuring an existing event.
IMPORTANT:The SCIM (System for Cross-domain Identity Management) API event is applicable only for Advanced Authentication as a Service (SaaS).
Configure the settings of this event to access the SCIM API. This event enables administrators to handle the SCIM operations for the cloud deployments through SCIM API. SCIM operations include tasks related to user identity and access management, such as creating, updating, or deleting user accounts, as well as managing user groups.
For more information about the SCIM API calls, see SCIM.
For additional information about SCIM API event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to log in to the Advanced Authentication Search Card portal. The Search Card functionality helps you to get the card holder’s contact information by inserting the card in the card reader. For more information about searching a card holder’s information, see Searching a card holder’s information
.
For more information about Search Card event configuration options, refer the Generic Options detailed in Configuring an existing event.
The Smartphone method can be enrolled in two ways:
By scanning a QR code that is shown in the Self-Service Portal.
By using an enrollment link that can be manually sent through SMS or Email.
This event allows managing enrollment using the enrollment link. For more information about preparing the enrollment link, see Configuring enrollment link.
This event supports a chain with either LDAP Password or the Password method as a single factor authenticator.
To enroll the Smartphone method using an enrollment link, users are required to click the link on their smartphone with the OpenText Advanced Authentication application installed, then specify their user name and password. The users of LDAP repositories can use the LDAP password, the local users and users of other repo (for example, SQL repo) who do not have an LDAP password can use their enrolled password to enroll in the Smartphone method by link. If the app is not installed on the user's smartphone, the user will be prompted to install the app. After entering the credentials the authenticator is enrolled automatically and is ready to use.
For more information about Smartphone Enrollment event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to log in to the Advanced Authentication Tokens Management portal. The Tokens Management functionality allows you to assign each token to specific user. For more information about assigning a token to user, see Managing Tokens.
For more information about Token Management event configuration options, refer the Generic Options detailed in Configuring an existing event.
Configure the settings of this event to log in to the Windows Client.
NOTE:If you want to use Windows Client on non-domain joined workstations, change the Event type from OS Logon (domain) to OS Logon (local).
For more information about Windows Logon event configuration options, refer the Generic Options detailed in Configuring an existing event.