Extracts credential (e.g. basic auth, bearer token, cookie) from the request received from the Airlock Gateway (one-shot flow). The credential serves as input for the authenticator.

Basic Auth HTTP Header Extractor Bearer Token HTTP Header Extractor (as Token Credential) Certificate Token Credential Extractor Client Certificate (X.509) Credential Extractor HTTP Header Token Extractor (as SSO Credential) HTTP Header Token Extractor (as Token Credential) HTTP Signature Verification Credential Extractor Kerberos SPNEGO Extractor Static Username Password Extractor

Validates the credential from the credential extractor in order to authenticate the HTTP request.

Note:

• Only non-interactive authentication steps (there is no way to interact with the HTTP client at this point - use the REST authentication API to do so if desired) may be configured.
• The authenticator must know how to handle the credential type provided by the credential extractor.

A common use-case is to verify JWT tokens issued by an upfront authentication process (as "Authorization Bearer" header):

• Extract bearer token from HTTP header (using the "HTTP Header Token Extractor (as SSO Credential)").
• Authenticate the request using the "Lookup and Accept Authenticator" or the "SSO Credential Authenticator".

Accepting Authenticator Active Directory Connector Airlock 2FA Authenticator Certificate Authenticator Certificate Token Authenticator Configuration-based Authenticator Credential-based Authenticator Selector Denying Authenticator Dummy Matrix Authenticator Dummy Polling Authenticator Dummy Two Step Authenticator Email Otp Authenticator Fallback Authenticator LDAP Connector LDAP Password Authenticator Lookup and Accept Authenticator MTAN/SMS Authenticator Main Authenticator Matrixcard Authenticator (TAN Challenge) Meta Authenticator NextGenPSD2 Certificate Authenticator OATH OTP Authenticator OAuth 2.0 Access Token Authenticator Password Authenticator RADIUS Authenticator SSO Credential Authenticator STET PSD2 Authenticator Selection Authenticator Static Authenticator Token Authenticator User-based Authenticator Selector

Defines how to respond if authentication fails (for wrong credentials and other errors).

Basic Auth Error Mapper Configurable Error Mapper Kerberos SPNEGO Error Mapper

Defines how to transport information about the authenticated user to the target application/service.

Access Cookie Identity Propagator Chaining Identity Propagator Conditional Identity Propagator Cookie Ticket Identity Propagator HTTP Basic Auth Identity Propagator HTTP Header Identity Propagator HTTP Response Header Identity Propagator Kerberos Identity Propagator (requires Airlock Gateway) NTLM Identity Propagator No Identity Propagator On Behalf Login Identity Propagator Plain Cookie Identity Propagator SAML Access Cookie Identity Propagator SAML Assertion Cookie Identity Propagator SSO Ticket Identity Propagator Username Cookie Identity Propagator

If enabled, a message is logged to the user trail log for every successful or unsuccessful authentication.

Caution: If the Airlock Gateway (WAF) is used in stateless mode, every single request may have to be authenticated by IAM due to missing roles. Hence, every request may generate a message in the user trail log depending on the Airlock Gateway configuration.

true

The URL pattern (regular expression pattern) to identify this target application.

The first pattern (in the list of target applications) that matches the forward URL is used.
The matching is case-insensitive.

The URL pattern is ignored for the default target application.

If a user can have a different username at this target application, it can be specified here how the other username should be obtained. The following options are possible:

• The name of the context data field in which this username is stored. Note that this field needs to be made persistent via the User Persister.
• A fixed username (which is the same for all users). This should start with FIXED: followed by the username. E.g.: if the username is "admin", set this to "FIXED:admin".
• Leave this empty, if no username is required or the standard username should be used.

The resulting username can be transformed further by using the Username Transformation property.

SubIdentities

applA_username

email

FIXED:admin

List of transformation plugins which allow various mutations of the username. The transformations are applied in order. Note that some username transformer stop the transformation chain after successful application.

These transformations are applied after the "Use Different Username" property.

Airlock 2FA Username Transformer Context Data Username Transformer Identity Username Transformer Lowercase Transformer Primary Key Lookup Regex Username Transformer Template-based Username Transformer Token Data Username Transformer Uppercase Transformer

If a user needs a password for this target application, it can be specified here how it should be obtained. This is not supported by all plugins though. The following options are possible:

• If no password is required for this application: leave empty.
• If the user has (or can have) a different password at this application: The name of the context data field in which this password is to be stored. Remember that this field needs to be made persistent via the User Persister.
• If a fixed password is used that is the same for all users: Prefix with FIXED: followed by the password, e.g. "FIXED:123456".
• If the user's main password (i.e. the password used to login to Airlock IAM) is used: Leave the field empty, but see the notes below.

If the user's main password is also used to sign on to target applications, please note the following points:

• The main password can only be used if the user was required to enter the password upon login. This is not the case for Kerbos and other SSO-Logins. In those cases, this option is not possible.
• Normally, the user's password is only available directly after login. If the user comes back to the Loginapp later, e.g. to access a different application, the password is normally not available anymore.
• If only one target application is configured, this should not be a problem, since the user only needs to be authenticated at the very beginning (directly after the authentication).
• If the user's password is needed for several target application, then it is has to be available every time the user wants to access another application in the same session. In this case, the password should be saved in the session ticket (see Security Settings).

SubIdentities

applA_password

FIXED:123456

The type of password encryption used to decrypt this password.
Leave empty if the password is not encrypted (not recommended if the password is read from a context data field).

SubIdentities

Password-based Encryption RSA Encryption Unsupported Encryption (to be replaced)

A list of roles used to access this target application.

The user needs at least one of the roles in order to get access to the application.

If no roles are configured, all authenticated users may access the application.

The user's roles may be transformed before being compared to this list using the Role Transformation Rules (see separate property).

If the user doesn't have any of these roles, the "Step-Up Authenticators" (in Authentication Settings) are consulted in order to find out whether they can be obtained using a Step-Up.

The Airlock Gateway (WAF) roles that should be set when accessing this target application, instead of using the users roles as Gateway roles.

The name of the role can be followed by a colon and the idle timeout of the role in seconds, e.g. "myrole:300" sets the role "myrole" that will expire after 5 minutes of client inactivity.

With a second colon and a second number, the life-time can be set, e.g. "myrole:300:3600" will set the role "myrole" for a maximum of 1 hour, but it will also expire after 5 minutes of client inactivity.

Note: If you want to replace (instead of add) target application's Gateway roles in the session upon the first visit of each target application, you have to disable the "Add Credentials To Session" flag in the "Airlock Gateway (WAF) Settings" of the Login Application.

A list of transformation rules used to modify user roles before being compared to the "Required Roles" of an application.

Role Transformation Rule

A list of regular expressions. Any role matching one of these expressions is not propagated to the target application, unless it also matches one of the "Propagated Roles To Keep". The matching is performed before any transformation.

A list of regular expressions. If set, only roles matching at least one of these expressions are propagated to the target application, even if they match one of the "Propagated Roles To Delete". Notice that any "Propagated Roles To Add" are always added. The matching is performed before any transformation.

A list of transformation rules used to modify roles names that are sent to an application by the identity propagator. All transformations are applied to every role that has not been deleted before as a pipeline.

Role Transformation Rule

The static roles that will always be added to the final list of propagated roles (no transformation is applied to those).