Configuring Authentication Methods
Authentication methods let you associate authentication classes with user stores. You use a particular authentication class to obtain credentials about an entity, and then validate those credentials against a list of user stores.
After the system locates the entity in a particular user store, no further checking occurs, even if the credentials fail to validate the entity. Typically, the entity being authenticated is a user, and the definition of an authentication method specifies whether this is the case. You can alter the behavior of an authentication class by specifying properties (name/value pairs) that override those of the authentication class.
To configure a method for an authentication class:
1
In the Administration Console, click
Devices > Identity Servers > Edit > Local > Methods.
2
To delete a method, select the method, then click
Delete
.
A method cannot be deleted if a contract is using it.
3
To modify an authentication method, click its name, or to create one, click
New
.
4
Fill in the following fields:
Display Name:
The name to be used to refer to the new method.
Class:
The authentication class to use for this method. See
“Creating Authentication Classes” on page 283 .
Identifies User:
Specifies whether this authentication method must be used to identify the user.
Usually, you must enable this option. When configuring multiple methods for a contract, you might need to disable this option for some methods.
If you enable this option on two or more methods in a contract, these methods need to identify the same user in the same user store.
If you enable this option on just one method in the contract, that method identifies the user when the authentication method succeeds. The other methods in the contract must succeed, but might not authenticate the user. For example, the method that identifies the user could require a name and a password for authentication, and the other method in the contract could prompt for a certificate that identifies the user’s computer.
To achieve SSO on back end web application when the passwordfetch class is enabled, see TID .
NOTE:
If the policy is using Risk-based Pre-Auth Class, this options must be selected at least in one method of the contract.
Overwrite Temporary User:
If you select this check box, then the temporary user credentials profile got form previous authentication method in the same session will be overwritten with real user credentials profile got from this authentication method.
Overwrite Real User:
If you select this check box, then the real user credentials profile got form previous authentication method in the same session will be overwritten with real user credentials profile got from this authentication method.
5
Add user stores to search.
You can select from the list of all the user stores you have set up. If you have several user stores, the system searches through them based on the order specified here. If a user store is not moved to the
User stores
list, users in that user store cannot use this method for authentication.
<Default User Store>:
The default user store in your system. See
“Specifying Authentication
Defaults” on page 297
.
Configuring Authentication
287
