Manage authenticators
An authenticator helps protect an application from unauthorized access by requiring users to complete an authentication step, such as a password, OTP, or push approval, during sign-in.
If you are deciding which authenticators to use, start with the Authenticator selection guide.
If you are planning password recovery, help desk recovery, user unlock, or first-time authenticator enrollment, start with Account recovery and authenticator readiness.
User authenticators
The following points describe how authenticators are assigned in IDaaS:
- Users can be assigned multiple authenticators.
- Users must have at least one authenticator to sign in to IDaaS.
- Users can select OTP delivery by voice, email, or SMS when the corresponding contact details are registered in their profile.
- Assigned tokens have a state of Active or Inactive. Only Active tokens can be used for authentication.
- Resource rules determine which authenticators can be used to sign in to an application.
- Users created locally in IDaaS or synchronized from Active Directory (AD) can be assigned authenticators automatically.
This section explains how to configure global settings on the General page and how to configure authenticator policies. To apply different settings for specific groups, use Group policies.
Push transaction queuing
The push transaction queuing feature supports users who need to verify multiple transactions during the day and may need time to complete other steps before confirming each transaction.
For example, bank loan officers can use this feature during the loan approval process. When enabled, IDaaS can send multiple transactions to a user's mobile soft token app and allow the user to respond within a configured time period.
If the queue size set to 1, only one transaction can be active at a time for a soft token identity. A new transaction overwrites the previous one. Additionally, transactions typically expire after a short time.
Example of queued transactions
A loan officer at AnyBank is asked to approve about 15 loans a day. The approval is granted by responding to a transaction challenge sent to loan officer's mobile soft token identity being used for transaction queuing.
The administrator configured the push transaction to expire after two days (Push Transaction Lifetime). To handle spikes in activity, the administrator also set the Maximum Queued Transactions to twice the typical daily transaction volume. As a result, the loan officer can have up to 30 transactions queued for this identity.
When the queue reaches this limit, the system removes expired transactions first, or deletes the oldest transactions to make room for new ones. Ideally, the queue never reaches this limit, and the loan officer responds to each transaction before the system deletes it.
For more information, see Manage General settings.
Assigning user authenticators
To assign authenticators to users, see the following:
For information about how users authenticate with applications, see Applications and SSO.
Topics in this section
Selection guide
Use this guide to compare Entrust Identity as a Service (IDaaS) authenticators, understand the strengths and limitations of each option, and choose where to use each authenticator in your authentication flows.
Account recovery and readiness
Use this guide to plan account recovery with the available IDaaS capabilities. Account recovery includes the following:
Lockout behavior
The authenticators allowed to access applications are set by the resource rules (see Create and manage resource rules). If a user enters an incorrect authentication response more times than the value set in the Lockout Count, the authenticator is locked and the user cannot access the application using that authenticator. See Manage General settings for more information about account lockout.
General settings
After you create a user, you must assign one or more authenticators to that user. The General settings control how authenticators work and whether the system automatically assigns authenticators when you create a user account.
Device fingerprint attributes
Device fingerprint attributes help IDaaS recognize a browser or device when Device Fingerprint Required is selected in the machine authenticator settings. When the collected values match the stored fingerprint closely enough, the sign-in attempt is treated as lower risk. When key values change, IDaaS can assign more risk or treat the device as unfamiliar.
Face biometrics
2 items
Grid cards
6 items
Hardware tokens
4 items
Knowledge-based authentication
5 items
Machine authenticator settings
Machine Authentication captures identifying information about the Web browser used to access an application. Resource rules can use this information during risk evaluation. When configured, IDaaS compares the browser's current Machine Authentication attributes with the attributes previously stored in the user's IDaaS account.
Magic Links
2 items
One-time password settings
A one time password (OTP) authenticator is a random series of characters that are sent to a user's mobile device number or email address during authentication. If you are using WeChat or WhatsApp for OTP delivery, ensure that you have completed the prerequisites.
Pass-through
2 items
Passkeys and FIDO2
2 items
Passwords
4 items
Password reset
1 item
Risk-based authentication
3 items
Smart credentials
7 items
Soft tokens
9 items
Temporary access codes
2 items
User certificates
1 item