Skip to main content

Manage machine authenticator settings

Machine Authentication captures identifying information about the Web browser used to access an application. Resource rules can use this information during risk evaluation. When configured, IDaaS compares the browser's current Machine Authentication attributes with the attributes previously stored in the user's IDaaS account.

The user receives risk points for each difference found between the machine authentication attribute values in the web browser and the values stored in the IDaaS account. The risk points from this test are combined with points from other risk-based authentication tests to produce a total risk score. This score determines the level of authentication required to access the application, based on the Authentication Decision settings in each resource rule.

IDaaS validates the Web browser by using a machine secret generated when the user creates a Machine Authentication on that browser. IDaaS stores the machine secret from each Machine Authentication in its repository.

Modify machine authenticator settings​

  1. Click > Policies >Authenticators.

  2. Select Machine Authenticator. The Machine Authenticator settings appear.

  3. To allow users to use Machine Authentication, click Enabling this feature allows users to register a Machine Authenticator. If selected, when a user logs in using the minimum authentication level or higher, a Remember Me option appears on the log in screen for the user to assign machine authentication.

  4. If you select the allow users to use Machine Authentication, modify the following settings as required:

    1. From the Authenticator Required for Machine Registration drop-down list, select the authenticator that is the minimum level used to register a Machine authenticator to a Web browser when logging in.

      note

      Password + OTP, Password + Token, Password + Token Push, and Password + Mobile Smart Credential Push authentications can only be performed when logging in to specific applications. If any of these options are selected, a Machine authenticator cannot be registered when logging in to an IDaaS account.

  5. Set Maximum Number of Machine Secrets to the number of computers a user can have registered. Setting the value to 1 disables machine secret storage and machine authentication. The maximum value is 20.

  6. Under Machine Authenticator Security Level, select one of the following:

    • Machine Nonce Required to require a machine nonce be part of the machine secret used for authentication. This is the default setting.

      Including a machine nonce as part of the machine authentication allows those willing to have cookies stored on their Web browser to leverage machine authentication. The machine nonce (and/or sequence nonce) is stored in the local storage folder of the Web browser. IDaaS references that number during machine authentication to validate that the number included matches the number recorded by IDaaS. Machine authentication is successful when both numbers match. The unique number sent to the Web browser used when creating each machine authentication also allows IDaaS to differentiate between Web Browsers with highly similar attributes.

    • Sequence Nonce Required to require a sequence nonce for authentication. This increases security by reducing the validity period for the machine information and making it more difficult for an attacker to steal a machine secret without being detected.

      Including a sequence nonce makes it very difficult for an unwanted party to copy a machine authenticator from one Web browser to another. A sequence nonce is created after each successful authentication and stored on your Web browser for the next one. Copying over a machine secret from one Web browser to another is insufficient to log in successfully if the latest sequence nonce is not included.

    • Device Fingerprint Required to require a device fingerprint for authentication. See Manage device fingerprint attributes.

      note

      Entrust recommends including a machine nonce as it provides the highest level of security. Only disable this setting if machine secrets cannot be stored on your users' computers. Machine secrets cannot be stored on the client computer if cookies or Flash are disabled. If this setting is disabled, you must enable Device Fingerprinting Required for Machine Authentication to be available.

  7. Set Machine Secret Lifetime in Hours to set the lifetime, in hours, of a machine secret. A value of 0 gives the machine secret an infinite lifetime. The maximum value is 876,000 hours, or 100 years.

  8. Select Count Failed Machine Authentication to count every failed machine authentication as a failed login attempt, which counts toward the number of failed attempts required to lock a user out of their account.

  9. Click Save.

Validate your changes​

After you save, verify the following:

  1. Updated machine authenticator settings remain selected after refresh.
  2. A test user can register a machine authenticator when the configured minimum authenticator requirement is met.
  3. Machine authentication risk behavior matches the selected security level (machine nonce, sequence nonce, or device fingerprint).
  4. Machine secret limits and lifetime settings are enforced as configured.
  5. If enabled, failed machine authentication attempts count toward account lockout as expected.