Airlock 2FA Usernameless Authentication Step
Step for Airlock 2FA Usernameless QR Code authentication.
This step allows authentication without requiring the user to enter their username. Instead, a QR code (identifying the session) is displayed on the login page and can be scanned by any user with the Airlock 2FA app. The app then authenticates this session on the server and thus enables Airlock IAM to connect the browser session with the user who scanned the QR code.
airlock2faSettings) messageProvider) Creates the message that will be displayed on the user's device when using Usernameless QR Code. If no message provider is configured, the default title of Futurae will be shown (without any additional information items).
Note that since no user ID is known when creating a username-less QR code, no message providers relying on user-specific data can be used.
qrCodeValidity) maxRenewals) QR codes will be renewed already before they expire. This ensures that users can complete ongoing authentication seamlessly even if they scan a QR code shortly before it is refreshed.
Fewer renewals do not lead to enhanced security. The only reason not to renew indefinitely is to save server resources.
timeoutGoto) respectCooldownPeriod) If enabled, devices in cooldown cannot be used for authentication.
If disabled, the step ignores the "Cooldown Period" for new devices configured in the "Airlock 2FA Settings". This is typically used for authentication steps that protect low-risk applications, such as a portal page, which can also be accessed using devices in cooldown.
If no "Cooldown Period" is defined, enabling this property has no effect.
interactiveGotoTargets) dynamicStepActivations) skipCondition) If this condition is configured and fulfilled, the step is skipped and the flow execution continues with the subsequent step.
preCondition) requiresActivation) tagsOnSuccess) stepId) onFailureGotos) If the step fails (no retry) and a goto target for the error code is defined here, the flow does not fail and instead a "goto" to the specified target step is executed. Note that even when the "goto" is executed, any error codes that are considered a failed factor attempt will still increment the "failed attempts" counter, and may lead to the user being locked. Therefore, this may still result in a failed flow.
A typical application of this feature is switching to an alternative authentication factor step, if an external service (e.g. Futurae server, SMS gateway) is not available (error code EXTERNAL_SERVICE_UNAVAILABLE with "Strict Counting" disabled, which will not increment the "failed attempts" counter). Other error codes can be found in the IAM REST documentation, in both the general "Error Codes" section and in the documentation of specific endpoints.
customResponseAttributes) A list of custom attributes that are returned in the REST response in addition to the standard attributes the step already returns. The custom attributes defined here are only returned if the step result does not lead to an error response.
Custom attributes are added to the response when a step is initialized and when actions are executed on the step. They will therefore be available in the response leading to this step, and in any responses from endpoints specific to this step. For non-interactive steps, custom attributes are accumulated and added to the response leading to the next interactive step.
Custom attributes are not returned for 'retrieve' endpoints.
customFailureResponseAttributes)
type: Airlock2FAUsernamelessQrCodeAuthenticationStep
id: Airlock2FAUsernamelessQrCodeAuthenticationStep-xxxxxx
displayName:
comment:
properties:
airlock2faSettings:
customFailureResponseAttributes:
customResponseAttributes:
dynamicStepActivations:
interactiveGotoTargets:
maxRenewals: 10
messageProvider:
onFailureGotos:
preCondition:
qrCodeValidity: 60
requiresActivation: false
respectCooldownPeriod: true
skipCondition:
stepId:
tagsOnSuccess:
timeoutGoto: