Multi-Factor Authentication Using Advanced Authentication

Configure the Advanced Authentication Server

1. Log in to Advanced Authentication as an administrator.

2. Verify that the NAM event is available in Events.

   NOTE:The NAM event is created by default when you install Advanced Authentication. Re-install Advanced Authentication if this event is not available.

3. Set up a central user store that both Advanced Authentication and Access Manager will use during authenticating a user. You can add a new repository in Advanced Authentication server or configure details of an existing Access Manager user store. If you add a new repository in Advanced Authentication, configure the same repository when you Configure the Advanced Authentication Server Details in Access Manager.

   For more information about how to add a repository, see Adding a Repository.

4. Configure methods.

   An Advanced Authentication method verifies the identity of a user who tries to access resources. You can configure the methods depending on your requirement. For example, in an Email OTP method, you can specify the values of different parameters, such as OTP period, OTP format, subject, and error message.

   For more information, see Configuring Methods.

5. Create a chain.

   A chain is a combination of methods. A user needs to execute and succeed all methods of a chain to be authenticated. While creating a chain, add the methods in the order of priority of execution. In Roles and Groups, assign the chain to the role that is specified in the repository. For example, specify XYZ\Allowed RODC Password Replication Group, where XYZ is the name of the repository.

   For more information about configuring chains, see Creating a Chain.

6. (Required only for the OAuth-based approach) Configure an event.

   Advanced Authentication provides authentication events for Access Manager. An event leverages the Advanced Authentication functionalities for Access Manager. Access Manager triggers the respective authentication event when a user tries to access it.

   Perform the following steps to configure an event:

   1. Click Events > Add.

   2. Specify a name for the event.

   3. Select OAuth2 in Event type.

   4. Select the required chains.

      NOTE:You need Client ID and Client secret while configuring the Advanced Authentication server in Access Manager. You cannot view Client secret later, therefore you must make a note of this value.

   5. Specify https://<identity server-url>:<port>/nidp/oauth/nam/callback in Redirect URIs.

      For example, if the Identity Server URL is https://domain.example.com:8443/nidp, where domain.example.com is the domain name and 8443 is the port, specify https://domain.example.com:8443/nidp/oauth/nam/callback.

   NOTE:For the Plug-in based methods, you do not need to create the OAuth 2.0 event, because a default NAM event is created when you install Advanced Authentication.

7. (Required only for the Plug-in-based approach) Assign the created chain to the NAM event in the Advanced Authentication server.

Configure the Advanced Authentication Server Details in Access Manager

1. Click Devices > Identity Servers > Shared Settings > Advanced Authentication.

2. Specify the domain name or IP address of the Advanced Authentication server and port in Server Domain.

   NOTE:When using the Plug-in-based methods, skip to step 5.

3. (Required only for OAuth-based approach) Select Integrate using OAuth under OAuth Event Configuration.

4. (Required only for OAuth-based approach) Specify the following details:

   Field	Description
   Event Name	Specify an event name. This event name must be identical to the event name specified in the Advanced Authentication administration portal.
   Client ID	Specify the client ID that was generated while creating the OAuth 2.0 event in the Advanced Authentication administration portal.
   Client Secret	Specify the client secret that was generated while creating the OAuth 2.0 event in the Advanced Authentication administration portal.

   Access Manager uses the endpoint links to retrieve token and user details from the Advanced Authentication server. These are default endpoint links. If the values of the URIs change because of modification of the Advanced Authentication authorization server, then you can change the values here.

   Field	Description
   Authorization URL	Access Manager uses this URL to retrieve the authorization code from the Advanced Authentication server.
   Token URL	Access Manager uses this URL to exchange the authorization code with the access token.
   User Info URL	Access Manager sends the access token to this URL to get the user details from the Advanced Authentication server.

   The fields under Integration URLs are auto-populated after you specify the server domain address.

   Field	Description
   Enrollment Page URL	If the user is not enrolled in the Advanced Authentication server, then Access Manager uses this URL to redirect the user to the enrollment page.
   Sign Data URL	Access Manager uses this URL to retrieve the signed data from the Advanced Authentication server.

5. Click Apply.

6. Verify that the config.xml file is available at each Identity Server node at the following location:

   Linux: /etc/aaplugin/

7. Go to Advanced Authentication and verify that the hostname of the Identity Server is displayed as the endpoint under Endpoints.

8. In Access Manager, go to Dashboard and click Certificates > Trusted Roots to verify if the Advanced Authentication server certificate is available in Access Manage.

   If the certificate is not available, then perform the following steps to import the certificate:

   1. Click Certificates > Trusted Roots > Auto-Import From Server.

   2. Specify the server IP/DNS, port, and certificate name.

   3. Click OK.

9. Configure the same user store or repository that you added in the Advanced Authentication server. See Step 3.

   1. Click Devices > Identity Servers > Servers > Edit > Local > User Stores > New.

   2. Specify the details and click Finish.

   3. Update Identity Server.

   Skip this step if you have configured an existing Access Manager user store in the Advanced Authentication server.

1. Create a class.

   1. Click Devices > Identity Servers > Edit > Local > Classes.

   2. Click New, then specify the following details:

      Display name: Specify a name for the class

      Java class: Select Advanced Authentication Generic Class. The Java class path is configured automatically

   3. Click Next > Finish.

2. Create a method for this class.

   1. Click Devices > Identity Server > Edit > Local > Classes > New.

   2. Select a chain in Advanced Authentication Chains. If you do not specify any chain, the user is prompted to select the chain with which the user wants to authenticate.

      NOTE:If no chain is listed in Advanced Authentication Chains, create a chain in the Advanced Authentication server. If a chain is available in the Advanced Authentication server, but the chain is not listed in Advanced Authentication Chains, then assign the chain to the configured Access Manager OAuth Event in the Advanced Authentication administration portal.

3. Create a contract for the method.

   1. Click Devices > Identity Servers > Edit > Local > Contracts > New.

   2. In URI, specify a value that uniquely identifies the contract from all other contracts. This value is used to identify this contract for external providers and is a unique path value that you create. For example, specify /nam/AAgenericcontract or /mycompany/name/password/form.

   3. In Methods, first add an Access Manager's authentication method (for example, Secure Name/Password - Form) and then the Advanced Authentication method that you created in the preceding step.

      NOTE:You can use more than one Advanced Authentication methods.

   4. Click Apply > OK.

   5. Update Identity Server.

Perform the following steps at Access Manager:

1. Create an Advanced Authentication class. You can use a Dynamic class or any other class except the Generic class.

2. Create a method and include the class created in the previous step, add a repository, and add the Advanced Authentication Enrollment URL property.

   Specify the URL of Advanced Authentication portal for authenticator enrollments.

   For example:

   URL of the portal when it is not protected by Access Gateway: https://<Advanced Authentication hostname or IP address>/account

   URL of the portal when Access Gateway protects Identity Server and Advanced Authentication: https://<Access Gateway hostname>/account

3. Create a contract. First add an Access Manager-specific method that supports LDAP credential-based authentication, such Secure Name/Password - Form and Name/Password - Basic and then add the Advanced Authentication method that you created in the previous step.

4. Using the dummy user’s account, access Identity Server or a protected resource to which this contract has been assigned and execute this contract. (https://<identity server-url>:<port>/nidp)

   The user must be able to authenticate to each method: first to Access Manager's method and then to the Advanced Authentication’s method.

   If authentication succeeds, the integration is successful.

Perform the following steps at Access Manager:

1. Create a class using Advanced Authentication Generic class.

2. Create a method with this class and select the required chain in Advanced Authentication Chains.

3. Create a contract. First add an Access Manager-specific method that supports LDAP credential-based authentication, such Secure Name/Password - Form and Name/Password - Basic and then add the Advanced Authentication method that you created in the previous step.

4. Using the dummy user’s account, access Identity Server or a protected resource to which this contract has been assigned and execute this contract. (https://<identity server-url>:<port>/nidp)

   Specify the user name and password for first factor authentication. And then Identity Server redirects the login request to Advanced Authentication OSP for chain execution.

   On the OSP page, you can select the chain that you want to authenticate with. If you have selected a chain while configuring the method, then you will be prompted with the same chain on the OSP page.

   If authentication succeeds on the OSP page and you are redirected to Identity Server or protected resource, the integration is successful.