Manage pass-through authenticators
Pass-through authenticators use an HTTP connector to call an external service during authentication. After you configure them, you can use them as a second-factor authenticator in IDaaS.
For example, a user signs in to a portal that asks a security question, such as the user's father's name, that IDaaS does not store. IDaaS sends the user's answer to the external service through the connector. The service returns an HTTP status code. A success code such as 200 allows authentication. Any other code blocks authentication.
To use a pass-through authenticator, you need to first create the pass-through authenticator definitions, and then configure the pass-through authenticator policies.
Use this section in the following order:
- Create the pass-through authenticator definition for your external endpoint.
- Configure policy settings, including request behavior and response handling.
- Add the pass-through authenticator to the required authentication flows and resource rules.
Before you deploy to production, test the external endpoint with expected and unexpected responses so you can confirm that authentication is allowed only when the service returns the intended success status.
Topics in this section:
Create pass-through authenticator definitions
Pass-through authenticator definitions specify what information IDaaS sends to an external service through an HTTP connector. The external service checks that information when a user tries to complete second-factor authentication with a pass-through authenticator. If the user provides the expected information, the connector returns a success response code and IDaaS allows authentication.
Manage pass-through authenticator policies
Use this page to select which pass-through authenticator definition is active for pass-through authentication. The selected definition controls which connector request and response logic is used when IDaaS evaluates pass-through authenticator challenges.