All available options for this migration selection. For each option, a condition can be configured that determines if it is available in a specific situation and for a particular user. If no option is available the step fails.

Advanced Migration Selection Option Simple Migration Selection Option

Activate the feature "Never Migrate" allowing the user to permanently reject the migration.

If this property is enabled, it is possible for a user to reject the migration if:

• No migration date is set for the user OR
• A migration date is set and the property "Allow 'Never Migrate' Despite Migration Date" is enabled.

false

Enables the feature "Never Migrate" even if there is a migration date set for the corresponding user.

Whether it is possible to "Never Migrate" depends on whether or not a migration date is set and whether the authentication is happening during the "Never Migrate Period" (if set at all).

false

Defines the period before the migration date in which the feature "Never Migrate" is active.

Prerequisites for this property to take effect:

• A migration date must be set for the user.
• "Never Migrate Possible" must be enabled.
• "Never Migrate Possible Despite Migration Date" must be enabled.
• At least one available option must define a "Hint Period" greater or equal to this property.

If this property is not set, the feature "Never Migrate" is possible (if enabled) during and after the entire "Hint Period".

The duration must be specified in the format "(d)ays (h)ours (m)inutes (s)econds" e.g. "2d 4h 10m 5s" (any part can be omitted).

7d

30d

14d 6h 30m

By default the "Never Migrate" condition is considered to decide whether it is possible for a user to reject the migration. This default condition can be overwritten by configuring a custom condition.

Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)

By default the "Never Migrate" step is executed if the "Never Migrate" condition is fulfilled. This default step can be overwritten by configuring a custom step.

Abort Step Acknowledge Message Step Airlock 2FA Activation Letter Order Step Airlock 2FA Activation Step Airlock 2FA Activation Step (with additional Activation) Airlock 2FA Activation Trusted Session Binding Step Airlock 2FA Authentication Step Airlock 2FA Delete Devices Step Airlock 2FA Device Edit Step Airlock 2FA Mobile Only Authentication Step Airlock 2FA Recovery Trusted Session Binding Step Airlock 2FA Usernameless Authentication Step Apply Changes Step Complete Migration Step Cronto Activation Step Cronto Authentication Step Cronto Device Reset Step Cronto Letter Order Step CrontoSign Swiss Push Activation Step Delete All Device Tokens Step Device Token Authentication Step Device Token Registration Step Email Change Verification Step Email Notification Step Email OTP Authentication Step FIDO Authentication Step FIDO Credential Display Name Change Step FIDO Passwordless Authentication Step FIDO Registration Step Failure Step HTTP Basic Authentication Step Kerberos Authentication Step Legacy Email OTP Authentication Step Login From New Device Step Mandatory Password Change Step Matrix Checking Step Migration Selection Step Missing Account Link Step Never Migrate Step No Operation Step OATH OTP Activation Step OATH OTP Authentication Step OAuth 2.0 Consent Step OAuth 2.0 SSO Step OAuth 2.0 Session Reset Step OTP Check via RADIUS Step Password Letter Order Step Password-only Authentication Step Realm Assignment Step Red Flag Raising Step Remember-Me Reset Step Remember-Me Token Generating Step Remember-Me User Identifying Step Representation SSO Ticket Identifying Step Risk Assessment Step Role-based Tag Acquisition Step SAML 2.0 SP User Identifying Step SSI Authentication Step SSI Issuance Step SSI Passwordless Authentication Step SSI Verification Step SSO Ticket Authentication Step Scriptable Step Secret Questions Provisioning Step Selection Step Set Context Data Step Set Password Step Tag Removal Step Terms Of Services Step User Data Edit Step User Identification By Data Step User Identification Step User Identification with FIDO Authentication Step User Lock Step Username Password Authentication Step Username Password with FIDO Authentication Step Vasco OTP Authentication Step Voluntary Password Change Step mTAN Authentication Step mTAN Token Registration Step mTAN Verification Step

By default the "No Operation Step" step is executed if the "Skip Migration" condition is fulfilled. This default step can be overwritten by configuring a custom step.

Abort Step Acknowledge Message Step Airlock 2FA Activation Letter Order Step Airlock 2FA Activation Step Airlock 2FA Activation Step (with additional Activation) Airlock 2FA Activation Trusted Session Binding Step Airlock 2FA Authentication Step Airlock 2FA Delete Devices Step Airlock 2FA Device Edit Step Airlock 2FA Mobile Only Authentication Step Airlock 2FA Recovery Trusted Session Binding Step Airlock 2FA Usernameless Authentication Step Apply Changes Step Complete Migration Step Cronto Activation Step Cronto Authentication Step Cronto Device Reset Step Cronto Letter Order Step CrontoSign Swiss Push Activation Step Delete All Device Tokens Step Device Token Authentication Step Device Token Registration Step Email Change Verification Step Email Notification Step Email OTP Authentication Step FIDO Authentication Step FIDO Credential Display Name Change Step FIDO Passwordless Authentication Step FIDO Registration Step Failure Step HTTP Basic Authentication Step Kerberos Authentication Step Legacy Email OTP Authentication Step Login From New Device Step Mandatory Password Change Step Matrix Checking Step Migration Selection Step Missing Account Link Step Never Migrate Step No Operation Step OATH OTP Activation Step OATH OTP Authentication Step OAuth 2.0 Consent Step OAuth 2.0 SSO Step OAuth 2.0 Session Reset Step OTP Check via RADIUS Step Password Letter Order Step Password-only Authentication Step Realm Assignment Step Red Flag Raising Step Remember-Me Reset Step Remember-Me Token Generating Step Remember-Me User Identifying Step Representation SSO Ticket Identifying Step Risk Assessment Step Role-based Tag Acquisition Step SAML 2.0 SP User Identifying Step SSI Authentication Step SSI Issuance Step SSI Passwordless Authentication Step SSI Verification Step SSO Ticket Authentication Step Scriptable Step Secret Questions Provisioning Step Selection Step Set Context Data Step Set Password Step Tag Removal Step Terms Of Services Step User Data Edit Step User Identification By Data Step User Identification Step User Identification with FIDO Authentication Step User Lock Step Username Password Authentication Step Username Password with FIDO Authentication Step Vasco OTP Authentication Step Voluntary Password Change Step mTAN Authentication Step mTAN Token Registration Step mTAN Verification Step

Manually selectable Goto targets. These are steps to which the user can chose to jump when this is the current flow step.

Interactive Goto Target

Steps that can be dynamically activated while in this step.

Dynamic Step Activation

If this condition is configured and fulfilled, the step is skipped and the flow execution continues with the subsequent step.

Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)

This step is executed only if the configured pre condition is fulfilled. If the condition is not fulfilled, the step and flow execution fail immediately. The step is not initialized and no step method can be called. If no condition is configured, the behavior is that of a fulfilled pre condition.

Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)

If enabled, this step is only executed if it has been dynamically activated from a previous step. If it has not been activated, the step is skipped (equivalent to when the skip condition is fulfilled).

false

ID of this step. This is only needed if this step is the target of a goto action or if this step requires activation.

Step ID

If the step fails (no retry) and a goto target for the error code is defined here, the flow does not fail and instead a "goto" to the specified target step is executed. Note that even when the "goto" is executed, any error codes that are considered a failed factor attempt will still increment the "failed attempts" counter, and may lead to the user being locked. Therefore, this may still result in a failed flow.

A typical application of this feature is switching to an alternative authentication factor step, if an external service (e.g. Futurae server, SMS gateway) is not available (error code EXTERNAL_SERVICE_UNAVAILABLE with "Strict Counting" disabled, which will not increment the "failed attempts" counter). Other error codes can be found in the IAM REST documentation, in both the general "Error Codes" section and in the documentation of specific endpoints.

Step ID

A list of custom attributes that are returned in the REST response in addition to the standard attributes the step already returns. The custom attributes defined here are only returned if the step result does not lead to an error response.

Custom attributes are added to the response when a step is initialized and when actions are executed on the step. They will therefore be available in the response leading to this step, and in any responses from endpoints specific to this step. For non-interactive steps, custom attributes are accumulated and added to the response leading to the next interactive step.

Custom attributes are not returned for 'retrieve' endpoints.

Additional Password Check Attribute Map Airlock 2FA Authentication Data Map Airlock 2FA Login ID Parameter Authentication Data Map Conditional Value Map Provider Context Data Map Edited Context Data Map Generic Session Attribute Value Map Provider HTTP Request Information Map OAuth 2.0 Credential Context Data Map OAuth 2.0 Tokens Map Roles Provider SSI Verification Data Provider SSO Ticket Context Data Provider Script Execution Result Value Map Provider Transaction Approval Parameters Map Transforming Value Map Provider User Identity Map User Passwords Map User Statistics Map Value Provider Map mTAN Token Flow Value Map

A list of custom attributes that are added to the REST response in case of a step failure during step execution. Unexpected failures leading to HTTP response status code 500 do not contain these attributes.

Additional Password Check Attribute Map Airlock 2FA Authentication Data Map Airlock 2FA Login ID Parameter Authentication Data Map Conditional Value Map Provider Context Data Map Edited Context Data Map Generic Session Attribute Value Map Provider HTTP Request Information Map OAuth 2.0 Credential Context Data Map OAuth 2.0 Tokens Map Roles Provider SSI Verification Data Provider SSO Ticket Context Data Provider Script Execution Result Value Map Provider Transaction Approval Parameters Map Transforming Value Map Provider User Identity Map User Passwords Map User Statistics Map Value Provider Map mTAN Token Flow Value Map