4.5.11 Troubleshooting Risk Rule Configuration

After configuring a risk policy and the corresponding risk scores and actions, use Validate to emulate total risk score, risk level, and action in event of rule failure. Based on the results, you can modify the configuration, if required.

Let us consider a case where you have configured a risk policy that includes five rules. The rules and the corresponding risk scores are as follows:

Now, open the risk policy for which you want to emulate total risk score, risk level, and action in event of rule failure. In the risk policy page, click Actions > Toggle Validate. Specify the rules as pass or fail to see the result along with a graphical reperesentation.

For example, specify pass and fail for rules as follows:

In this case, the validation result is as follows:

You can similarly specify any other rule as failed or passed to emulate the risk score and risk levels.

After configuring a risk policy, you can use the Risk Rule Validation utility to evaluate the configuration of rules. This helps you understand how rules are evaluated in a risk policy.

During rule evaluation if there is a match with the values configured for the rules, the rule evaluation is successful. If no match is found, the rule evaluation fails.

Using the Risk Rule Validation Utility to Test Risk Configuration

To use the risk rule validation utility for testing risk configuration, perform the following steps:

If you encounter any error during risk-based authentication, check the log files to review the error code. The log file location is:

Linux: /opt/novell/nam/idp/logs/catalina.out

Windows: \Program Files\Novell\Tomcat\logs\stdout.log

Ensure that you have enabled logging at the application level. For more information, see Enabling Logging for Risk-Based Authentication.

By using the following rules as examples, let us try to understand how to use the details in the catalina.out file and how rules are evaluated:

The following are possible scenarios:

Scenario 1: User Profile Rule Fails

In this scenario, the User Profile rule fails to evaluate successfully. All other rules in the risk policy evaluate successfully.

The following tracelist detail from the catalina.out file provides information about rule evaluation, risk score, and action:

This log entry indicates that the as per the risk level/action configuration, the action taken is to allow authentication to the user and the risk score is 30.

Scenario 2: User Profile Rule Evaluates Successfully

In this scenario, the User Profile rule evaluates successfully. As this rule is a configured to exit when the condition is met, all other rules in the risk policy are not considered for evaluation.

The following tracelist detail from catalina.out file provides more information about the rule evaluation, risk score, and action:

This log entry indicates that the as per the risk level/action configuration, the action taken is to allow authentication to the user and the risk score is 0.

Scenario 3: Two rules fail and the user is asked to authenticate using additional authentication

In this scenario, the User Profile rule and the IP address rule fail to evaluate successfully. The HTTP Header rule evaluates successfully.

The following tracelist detail from the catalina.out file provides more information about the rule evaluation, risk score, and action:

This log entry indicates that the as per the risk level/action configuration, the action taken is additional authentication and the risk score is 55.

Scenario 4: All Rules Fail

In this scenario, all rules fail to evaluate successfully.

The following tracelist detail from the catalina.out file provides more information about the rule evaluation, risk score, and action:

This log entry indicates that as per the risk level/action configuration, the action is to deny access to the user and the risk score is 75.