6.10.4 Configuring an Example Device Fingerprint Policy

Let us assume that you want to associate the user's distinguished name with the device. So, that anyone else other than the registered user must provide additional authentication to log in. Also, if the user DN matches, but other parameters do not match as expected, you want to perform additional authentication. This can be achieved by configuring a risk policy with the Device Fingerprint rule. For the first time after implementing the policy, the intended user needs to provide additional authentication. Afterward, if the rule matches, the user does not need to authenticate twice.

This example is applicable only for risk-based post-authentication scenarios.

You can create a risk policy for this example as follows:

  1. On the Home page, click Risk-based Policies > Plus icon.

  2. Under New Risk Policy, specify example-DFP-class as the name of this policy.

  3. In the Assign Policy To, select Identity Server cluster, and then select an authentication class. You can select the class from the list of existing classes, or you can create a new class.

    NOTE:If you select an existing class, settings of the selected class are overwritten with values of this policy.

  4. To create a new Device Fingerprinting rule, perform the following actions:

    NOTE:You cannot have more than one Device Fingerprint rule in an Access Manager setup. If a rule is already configured, use the existing rule or modify it based on the requirement.

    1. Under Rule Evaluation Order, click Plus icon > Add New Rule.

    2. Specify a name for the rule and select Device Fingerprint Rule.

    3. Specify the number of days for which you want the fingerprint to be valid.

    4. In Store Fingerprint in, select Browser.

    5. Click Parameter Settings, move the required parameters from Available Parameters to Enabled Parameters - Evaluate Individually and to Enabled Parameters - Evaluate as a Groups as follows:

      Parameter

      Evaluation Type

      User DN

      Evaluate Individually

      To meet the rule criteria, this parameter must match 100%.

      Language Set

      Evaluate as a Group

      Specify 80%.

      To meet the rule criteria, at least four out of Language Set, Screen Resolution, TimeZone Offset, User Agent, and Operating System Parameters must match.

      Screen Resolution

      TimeZone Offset

      User Agent

      Operating System Parameters

    NOTE:For information about these parameters, see Understanding Device Fingerprint Parameters.

  5. Click Next.

  6. Under Action to Perform, select If rule condition is met, then Exit with Risk Level as.

  7. Select Risk Level as Low.

    NOTE:You can also create a risk level here, and then assign it to the rule. See Step 10.

  8. In If rule condition is not met, add risk score, specify 30.

  9. Click Finish.

  10. Under Risk Levels, click Plus icon and configure the risk levels with the following details:

    Risk Level

    Risk Score

    Action

    Low

    Less than 30

    Allow Access

    Medium

    Greater than or equal to 30

    Additional Authentication.

    Select a class to configure step-up authentication.

    Use the step-up to a method when branding, overwriting of users, or a change of user store is required. If the user store for the additional authentication is same as the risk-based authentication and no additional branding is needed, use a class.

  11. Configure a method for example-DFP-class as follows:

    1. On the Home page, click Identity Servers > [cluster name] > Authentication > Methods > Plus icon.

    2. Specify the name as example-DFP-method.

    3. In Class, select example-DFP-class.

    4. Turn off Identify Users.

    5. Select a user store.

  12. Configure a contract for example-DFP-method as follows:

    1. On the Home page, click Identity Servers > [cluster name] > Authentication > Contracts > Plus icon.

    2. Specify the name as example-DFP-contract.

    3. Select example-DFP-method in Authentication Methods. You must select one more method and list example-DFP-method as a second method.

    4. Click the Plus icon under Authentication Card to configure a card for the contract.

      For more information, see Configuring Authentication Contracts.

    5. For more information about risk-based policies, see Risk-based Authentication.

After you implement this risk policy, the following are possible scenarios:

Scenario

Risk Level

Result

When a user logs in the first time

Medium

Prompt for additional authentication because no fingerprint exists to match.

When the fingerprint matches completely

Low

Allow Access

When individual parameters match, but a parameter in the group does not match the specified percentage.

Medium

Prompt for additional authentication

When individual parameter does not match, but parameters in the group match completely

Medium

Prompt for additional authentication

When both individual parameter and parameters in the group do not match

Medium

Prompt for additional authentication

When the fingerprint is expired

Medium

Prompt for additional authentication