This policy replaces the SAML 2.0 options policy. The Web Authentication policy allows you to configure the following settings:
The Identity provider URL displays the default Public external URL. Also, the tenant_base URL if configured in the Public external URLs policy. If the Identity provider URL is set to default Public external URL, then the users must prefix TENANT\repository\ to the username during login. If you select the URL in the https://tenantName.tenant_base/ format, then the users can access the Advanced Authentication portals using the short username without prefixing the TENANT\repository\. The tenant_base represents the domain name. The domain name is shared among the tenants to generate a unique URL for each tenant.
For example, consider top tenant URL is caf.aacloud.com, here the domain base is aacloud.com. If the name of a new tenant is cyberres then the tenant URL becomes cyberres.aacloud.com.
Click ldP SAML 2.0 Metadata to download SAML 2.0 metadata. You can download the SAML 2.0 metadata file only when the Identity Provider's URL is configured. The downloaded SAML 2.0 metadata file is used to configure the Service Provider.
For more information about SAML 2.0, see SAML 2.0.
Specify the following details to configure timeouts:
Session Timeout: Specify the time in seconds. By default, this value is set to 1200 seconds. This is the timeout value for authenticating to the Web Authentication session. If the session is idle for more than the specified time, then the session expires and the user must authenticate again before any action which requires an authenticated session. This timeout value is applicable for OAuth2 / OpenID Connect and SAML events.
NOTE:Advanced Authentication user enrollment uses Web Authentication for authenticating users. After the authentication, the OSP session is not in use and Advanced Authentication manages its sessions. An OAuth2 / OpenID Connect application might use the Web Authentication session.
Authorization Code Timeout: Specify the time in seconds. By default, this value is set to 120 seconds. This timeout value indicates how long the authorization code is valid. The request for an Access Token or an ID Token fails if the Authorization Code has expired and is no longer valid. The Authorization code becomes invalid if the client does not request for Token ID from the server within the specified time.
For security reasons, some OAuth2 / OpenID Connect code flow schemes require that first an Authorization Code be requested. The Authorization Code is then used to request an Access Token and ID Token.
Access Token Timeout: Specify the time in seconds till when the access token is valid. By default, this value is set to 120 seconds. Once the token expires, a new token is required before accessing the protected resources. The application might create a new token by using a Refresh Token and the client secret, or else the user is required to authenticate again.
Refresh Token Timeout: Specify the time in seconds till when the token is valid. Once the token expires it can no longer be used to create a new Access Token. By default, this value is set to 2592000 seconds.
Public Refresh Token Timeout: This timeout value is for refreshing token timeout for public clients. When there are two client types, private and public. By default, this value is set to 3600 seconds.
Session Token Revocation Timeout: Specify the timeout value till when the session-based refresh token revocation entries are retained. Retained entries are removed when the session is properly logged out or after the refresh token expires. By default, this value is set to 172800 seconds.
The Enable client event selection option is set to OFF by default and the third-party service provider cannot select a preferred event for any client such as Windows Client, Mac OS X Client, and Linux PAM Client workstation. You can set this option is set to ON to allow third-party service providers to select a preferred event that is configured in the authcfg.xml file that user can access post authentication.
The syntax to select a specific event in the authcfg.xml file is as follows:'AuthnContextClassRef' => array( 'AuthnContextClassRef' => 'urn:uuid:519a6c73-f092-43d3-ab11-8d789ebc2f79?=internal.osp.oidp.aa.event-name=<event name>')
NOTE:If you configure an incorrect event name and a user tries to authenticate to the event, an error message authentication failed appears.
The Enable client chain selection option is set to OFF by default and the third-party service provider cannot select a preferred chain for any client such as Windows Client, Mac OS X Client, and Linux PAM Client workstation. You can set this option is set to ON to allow third-party service providers to select a preferred chain that is configured in the authcfg.xml file that user can use during authentication.
The syntax to select a specific chain in the authcfg.xml file is as follows:'AuthnContextClassRef' => array( 'AuthnContextClassRef' => 'urn:uuid:519a6c73-f092-43d3-ab11-8d789ebc2f79?=internal.osp.oidp.aa.chain-name=<chain name>')
NOTE:If you configure an incorrect chain and a user tries to authenticate by using that chain, an error message authentication failed appears.
You can customize the messages and authentication methods name for the Web Authentication events in the Custom Messages policy. By default, Use Custom Messages is set to OFF. Set Use Custom Messages to ON to enable using the custom messages for the OAuth, SAML 2.0, or Open ID Connect events. You must customize the messages in the Custom messages
policy.
NOTE:If you modify non-English messages or method name in the Custom Messages policy With Use Custom Messages is set to OFF, then customized messages does not reflect on the Web Authentication events page.