Username Password with FIDO Authentication Step
Configuration of an authentication flow step, where users can either authenticate themselves with username and password or use a FIDO authenticator to authenticate passwordless, using Webauthn conditional UI.
The FIDO authentication requires the use of a resident key, where the key material is stored on the FIDO authenticator. This needs to be enforced at registration by ensuring that "Require Resident Key" in "FIDO Settings" is enabled. Please refer to the documentation for more details about the requirements of FIDO passwordless authentication. Furthermore, transports cannot be restricted in passwordless mode.
passwordRepository) policyToCheckOnLogin) The password policy that is checked when authenticating. If the policy is violated, a mandatory password change is required.
Only applies when using Username/Password authentication.
passwordChangeRedFlag) tagsOnPasswordAuthSuccess) tagsOnFidoAuthSuccess) authenticationMethodId) Example: a system tracks two passwords per user. Password 1 is used in flow A, password 2 in flow B. These two steps must have distinct 'Authentication Method Ids', e.g. PASSWORD1 and PASSWORD2.
If only one identifier (e.g. "PASSWORD") is used, this may allow brute force attacks on the password as follows. Assuming an attacker knows the user's password 1, they get an unlimited number of attempts on flow B, as the 'PASSWORD' counter can repeatedly be reset to 0 by performing a successful login on flow A.To prevent such attacks, use two different counters by setting the authentication methods, for example, to PASSWORD1 and PASSWORD2, respectively.
This identifier is used if the user tries authenticating with their username / password. If FIDO is used, the FIDO Authentication Method ID is used instead.
passwordAttributeKey) The optional key under which this password will be available in the identity propagation, if any only if password authentication was used.
The value can also be retrieved from the session using the "User Passwords Map" value map provider.
If no key is configured, the password will not be made available in the flow attributes, and cannot be used by identity propagators.
Important: Multiple Password Authentication steps or Mandatory Password Change steps which have the same value for this property might override each others passwords.
If you have configured a Mandatory Password Change step, you might consider to use the same key.
Note: This feature will not work together with end-to-end encryption.
onFailureGotos) If the step fails (no retry) and a goto target for the error code is defined here, the flow does not fail and instead a "goto" to the specified target step is executed. Note that even when the "goto" is executed, any error codes that are considered a failed factor attempt will still increment the "failed attempts" counter, and may lead to the user being locked. Therefore, this may still result in a failed flow.
A typical application of this feature is switching to an alternative authentication factor step, if an external service (e.g. Futurae server, SMS gateway) is not available (error code EXTERNAL_SERVICE_UNAVAILABLE with "Strict Counting" disabled, which will not increment the "failed attempts" counter). Other error codes can be found in the IAM REST documentation, in both the general "Error Codes" section and in the documentation of specific endpoints.
This step can return the following error codes:
USERNAME_PASSWORD_WRONG: The Username/Password authentication failed for any reason.FIDO_AUTHENTICATION_FAILED: The FIDO authentication failed for unspecified reasons (either in the browser/client or during server-side verification).FIDO_AUTHENTICATION_TIMEOUT: The response from the browser/client has timed out.FIDO_AUTHENTICATION_ABORTED: The authentication has been aborted in the browser/client.FIDO_AUTHENTICATION_NOT_ALLOWED: The browser/client did not allow authentication with the given credentials.FIDO_WEB_AUTHN_NOT_AVAILABLE: The client/browser is not capable of performing WebAuthn/FIDO authentication.
fidoSettings) interactiveGotoTargets) dynamicStepActivations) skipCondition) If this condition is configured and fulfilled, the step is skipped and the flow execution continues with the subsequent step.
preCondition) requiresActivation) stepId) customResponseAttributes) A list of custom attributes that are returned in the REST response in addition to the standard attributes the step already returns. The custom attributes defined here are only returned if the step result does not lead to an error response.
Custom attributes are added to the response when a step is initialized and when actions are executed on the step. They will therefore be available in the response leading to this step, and in any responses from endpoints specific to this step. For non-interactive steps, custom attributes are accumulated and added to the response leading to the next interactive step.
Custom attributes are not returned for 'retrieve' endpoints.
customFailureResponseAttributes)
type: UsernamePasswordFidoStep
id: UsernamePasswordFidoStep-xxxxxx
displayName:
comment:
properties:
authenticationMethodId: PASSWORD
customFailureResponseAttributes:
customResponseAttributes:
dynamicStepActivations:
fidoSettings:
interactiveGotoTargets:
onFailureGotos:
passwordAttributeKey:
passwordChangeRedFlag:
passwordRepository:
policyToCheckOnLogin:
preCondition:
requiresActivation: false
skipCondition:
stepId:
tagsOnFidoAuthSuccess:
tagsOnPasswordAuthSuccess: