10.1 Configuring Identity Governance for Two-Factor Authentication

To configure Advanced Authentication for two-factor authentication:

1. Log in to the Advanced Authentication Administration portal using administrator credentials. For more information, see Logging In to the Advanced Authentication Administration Portal.

2. Create a repository for the LDAP identity service for OSP. For more information, see Adding an LDAP Repository.

3. (Optional) To change default attributes or collect a new attribute, change the Advanced Settings. For more information, see Advanced Settings.

4. Find the new repository that you just created, then click Edit > Full synchronization to synchronize the users and groups from the LDAP server.

5. Define the method for two-factor authentication of EMail OTP and LDAP Password. For more information, see:

   • Email OTP

   • LDAP Password

6. Configure the policy for the mail sender for the Email OTP method. For more information, see Mail Sender.

7. Create a chain to make the authentication methods available for OSP. For more information, see Creating a Chain.

8. Create an event to define the type of authentication event you use. You can use an existing event or create a custom event. For more information, see Configuring Events.

1. Run the Identity Governance Configuration Update utility. For more information, see Section 15.1.5, Using the Identity Governance Configuration Update Utility.

2. Click the Authentication tab, and then click Show Advanced Options.

3. Under Authentication Method, select the Enable two factor authentication option.

4. Click the Second factor tab, then fill out the following fields:

   Advanced Authentication Administrator > Admin Name

   Specify the repository-qualified name of the Advanced Authentication administrator account that OSP uses to interface with Advanced Authentication. Typically, the account is in the LOCAL repository.

   The default Advanced Authentication administrator account is named admin. If you used this account, then the Admin name value is:

   LOCAL\admin (repository name\admin name)

   Advanced Authentication Administrator > Admin Password

   Specify the password of the Advanced Authentication administrative user you specified above.

   Advanced Authentication Repository > User repository name

   Specify the name of the repository in Advanced Authentication you created in Configure the Advanced Authentication Server for Two-Factor Authentication. This repository corresponds to the LDAP identity service for Identity Governance.

   Advanced Authentication Servers

   Click Enter host name or address, then specify the DNS name or IP address of the Advanced Authentication server. If you use a different port than 443, specify that port as well.

   (Conditional) If you have clustered the Advanced Authentication server, then click Add, and specify each DNS name or IP address for each server in the cluster with the corresponding port.

   Advanced Authentication Endpoint

   An Advanced Authentication endpoint is an identifier and secret that ensures that it is an authorized entity performing authentication with the Advanced Authentication server.

   If no endpoint data is found in the configuration (or if the endpoint data in the configuration cannot be resolved with the Advanced Authentication server) then the Identity Governance Configuration Update utility selects Create new endpoint.

   You must specify a name and description for the new endpoint for Advanced Authentication. The name and description appear in the Endpoints section of the Advanced Authentication Administration portal.

   If you have already created an endpoint, and the endpoint information is in the configuration, and Identity Governance can resolve the endpoint data with the Advanced Authentication server, then the Identity Governance Configuration Update utility does not select the Create new endpoint option and it displays the endpoint identifier and a representation of the endpoint secret.

   Second Factor Conditions

   If you want to require all users to supply a second authentication factor at all times, then select All users, all the time.

   Otherwise deselect the option, then specify conditions for your environment using the following information:

   User Login Condition

   When you deselect All users, all the time, the User Login Condition editor appears. This editor allows you to configure an expression that defines under which conditions Identity Governance uses the second factor authentication.

   For example, if users do not have mobile devices then you should use Email OTP as a second factor authentication.

   You build a login condition of expressions that evaluate various operands including user LDAP attributes, server attributes like time-of-day, date, and HTTP request values like originating IP address, session attributes like session age, and so forth. You can negate the expressions and combine the expressions using logical AND and OR operators.

   Second Factor Authentication Methods

   Use this advanced option to enable and disable the available second factor methods and define the relative priority of each method you want to set.

   If you disable a method by deselecting the box next to the method name, then that method is not available for authentication even if a user is enrolled in that method.

   Identity Governance uses the relative priority of second factor methods to determine which method it should use if a user is enrolled in more than one method.

   For example, using the default values configuration the Email OTP has a higher priority than the LDAP password method. Therefore, even if a user has enrolled in both methods, Identity Governance selects the Email OTP method for that user. You can change the behavior such that Identity Governance selects the LDAP password by making the TOTP priority higher than Email OTP.

   NOTE:Email OTP methods do not need enrollment to be available for a user. It is enabled by default.

5. Click OK to save the configuration, then the Identity Governance Configuration Update utility automatically closes.

1. Log in to the Advanced Authentication server as an end user.

2. View the Enrolled and Not Enrolled methods.

3. Enroll the methods for the test user by clicking on the appropriate method, then click Test.

4. Ensure that the test is successful, then save the method for the user.

5. Log in to Identity Governance and OSP redirects you to use the second factor authentication.