11.1 Configuring an Existing Event

Click Events > New Event.

Specify a name of the event in Name.

Ensure that Is enabled is set to ON if you want to use the event.

Select the Event type.

For most of the predefined events, you cannot change the Event type. For events such as Windows logon, Linux logon, and Mac OS logon, you can change the Event type from OS Logon (domain) to OS Logon (local) if the workstations are not joined to the domain.

Enable the reCAPTCHA option to ON if you want the Google reCAPTCHA option to be displayed in the login page for the particular event.

The reCAPTCHA option is displayed only when you enable the Google reCAPTCHA Options policy.

By default, All Categories is set to ON. When the multiple event categories are created, users can enroll an authentication method multiple times (one enrolled method per category).

When All Categories is set to ON, users can authenticate to the event using any of the supported methods (Card, FIDO U2F, HOTP, Password, and TOTP) and Advanced Authentication automatically chooses an appropriate authentication method.

To use other methods, Advanced Authentication prompts for the category selection.

The All Categories option is displayed only if you have added categories in the Event Categories policy.

For example, an administrator has configured two categories CAT1 and CAT2. The Default category is predefined in the Administration portal. Users can enroll three devices. The All Categories is set to ON for the Windows logon event. A user has three cards and enrolls each to a category as follows:

After enrolling cards, the user can authenticate to the Windows event by using one of the enrolled cards.

You can set All Categories to OFF if you want to disable support for multi-enrollment of supported methods.

The Authenticator category is displayed when All Categories is set to OFF. Select the preferred category from Authenticator category.

Select the chains that you want to assign to the current event.

In an event, you can configure a prioritized list of chains that can be used to get access to that specific event.

(Conditional) In Risk Policy, select the policy that you want to assign to this event for assessing the risk associated with a login attempt.

(Conditional) Click Create New Policy to create a new risk policy for this event.

Clicking this option opens the Risk Settings page.

If you want to restrict access of some endpoints to the event, add all the endpoints that must have access to the Endpoints whitelist. The remaining endpoints are blacklisted automatically. If the Endpoints whitelist blank, all the endpoints are considered for authentication.

Set Geo-fencing to ON to enable geo-fencing. Move the permitted zones from Available to Used. For more information about configuring geo-fencing, see the Smartphone method.

Select Allow Kerberos SSO if you want to enable single sign-on (SSO) to the Advanced Authentication portals. Kerberos SSO is supported for AdminUI, Authenticators Management, Helpdesk, and Report logon events.

Set Logon with Expired Password with one of the following options based on your requirement:

Set Bypass user lockout in repository to ON, if you want to allow users who are locked on repository to authenticate on the Advanced Authentication. By default, Bypass user lockout in repository is set to OFF and users who are locked on repository are not allowed to authenticate.

Set Allow token re-use to ON, if you want to allow users to apply the OTP multiple times within the Allow re-sending after (seconds) duration for authentication. This option is applicable for Email OTP, SMS OTP, and Voice OTP methods.

By default, Allow token re-use is set to OFF and users are not allowed to apply the OTP more than once within the Allow re-sending after (seconds) duration that has been set for Email OTP, SMS OTP, and Voice OTP methods.

Set Return groups on logon to ON if you want to retrieve the group details of users who authenticated to the event in the authentication response.

With Return groups on logon set to ON, if Groups is empty, all the groups that the users are associated with are returned in the response. However, to return the required groups, specify the preferred groups in Groups.

Sometimes, the authentication response of RADIUS event is lengthy if a user is associated with several groups. Therefore, it is recommended to use Groups to limit the groups' in the response.

By default, Return groups on logon is set to ON for all events except for Authenticators Management, Smartphone Enrollment, and SAML 2.0 events.

When this option is set to OFF, the groups of users authenticated to the event are not returned in the response.

You as a top administrator can enforce the configuration of events (except the RADIUS Server event) on secondary tenants. After configuring the settings for the event, you can freeze those settings for a specific tenant. The tenant cannot edit the settings in the tenant administrator console that have been enforced by the top administrator for that event.

To enforce the configurations for a specific tenant, perform the following steps:

Select the Allow to logon to this event by shared authenticator option to allow users to login using shared authenticators. By default this option is disabled for the Authenticators Management, Helpdesk, Helpdesk User, AdminUI, Search Card, Token Management, and Report Logon events and enabled for all the other events.

Click Save.

Click Initialize default chains to revert the changes that are applied to the default configuration.