Prerequisites

Before configuring risk score-based authentication, ensure that you have completed the following prerequisites:

• Configure the following components:

  • SAS PCE, deployed in your environment.

  • SafeNet Access Exchange (SAE), deployed in your environment, with a realm created as described in Realm creation and authentication flow.

• Ensure that the SafeNet Access Exchange version includes the SAE Risk Score Evaluator. In the SafeNet Access Exchange admin console, go to Realm settings > Provider info and verify that sae-risk-score-evaluator and sae-risk-score-conditional are listed.

• Configure an LDAP or Active Directory User Federation provider in the realm and ensure that users can sign in through it. Refer to User Federation Setup.

• Ensure that the users also exist in SAS PCE to complete the SafeNet OTP or FIDO factor.

• Identify the directory attribute for the risk score. The attribute must meet the following requirements:

  • It must be an attribute of the user object federated by SafeNet Access Exchange.

  • It must contain a single whole number, such as 450. Decimal values (such as 450.5), text, and blank values cause access to be denied.

  • It must be readable by the bind account configured in the SafeNet Access Exchange LDAP provider.

  • It must not be used for any other purpose. In Active Directory, you can use an existing integer attribute, such as codePage, or extend the schema with a dedicated attribute.

• Determine the score range used by your IGA platform, such as 0–1000. SafeNet Access Exchange compares the configured thresholds with the raw score, so both must use the same scale.

• Ensure that you have an administrator account in SafeNet Access Exchange that can modify user federation, user profile, and authentication flows in the realm.