Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo

All

  • All
back

Risk Score-Based Authentication Flows

Verify Authentication

search

Please Note:

Verify Authentication

Use the test users prepared in LDAP Directory Setup to verify each risk band.

  1. In the SafeNet Access Exchange administrator console, click Users, open each test user, and verify the riskScore value in the User metadata section of the Details tab.

  2. Open a private browser window and navigate to an application that uses the flow containing the SAE Risk Score Evaluator, or open the SafeNet Access Exchange account console at the following URL:

    https://<access_exchange-server>:<port>/realms/<realm-name>/account

  3. Sign in as each test user and verify the result. The following results apply when using the default thresholds and outcomes with the SafeNet LDAP OTP Flow and FIDO Authentication Form as the step-up factor:

    Test user's risk score Expected result
    100 (LOW) The user enters the password and OTP, and is signed in.
    500 (MEDIUM) The user enters the password and OTP, completes FIDO authentication as the step-up factor, and is signed in.
    900 (HIGH) The user enters the password and OTP, and an access-denied page is displayed.
    Not set The user enters the password and OTP, and is signed in.
    abc (invalid) The user enters the password and OTP, and an access-denied page is displayed.

  4. Verify that changes to the risk score take effect. Change the directory attribute of the LOW-band test user to 900, then sign in again using a new private browser window. Access is denied.

    If you use the RiskScore flow with SSO re-evaluation, open another application in the same browser window instead. User access is denied without signing out of applications that are already open.

A denied user sees the following message in the user's configured language:

Your sign-in request could not be approved. Please check with your local administrator.

The message does not disclose that the risk score caused the denial.

Risk Score

SafeNet Authentication Flows

Risk score evaluation can be added to any SafeNet authentication flow. For information about the structure of each flow and the recommended step-up factor, see Risk Score-Based authentication flows:

On this page