The default application that is selected if a user/client directly accesses an authentication flow resource without explicitly selecting a flow by using the authorization resource.

Target Application

List of other protected applications. The default application must not be part of this list.

Target Application

Applications to be accessed via the one-shot access endpoint.

One-Shot Target Application

Maximal number of allowed login attempts. The user is locked if the number of failed attempts for some credential exceeds this limit.

5

Locks users temporarily after unsuccessful authentication attempts. This helps to prevent password brute force attacks.

This configuration can be enabled or disabled in each "Authentication Flow" with the setting "Enable Temporary Locking".

Temporary Locking

Configuration enabling the Remember-Me feature. This feature allows a user to skip certain authentication steps if a valid token is presented with the request.

Remember-Me Settings

Repository to store the history of successful logins. Login history entries are only written in flows where the corresponding flow processor is enabled.

Database Login History Repository

Defines what action is taken when a user already has another authenticated Airlock Gateway session when logging in or logging out. For example, this can happen if the user left a previous session without an explicit logout or attempts to authenticate multiple concurrent sessions (with different devices or browsers).

The configured behavior may depend on the user store being able to read (and write) the session ID to/from the database/directory. Verify that the corresponding column or attribute is mapped in the used user store ("Col Latest GSID" for default database plugins; "Last GSID Value Attribute" in LDAP plugins).

Destroy Multiple Existing Sessions Destroy Other User Session Ignore Existing User Sessions

Disables the "Behavior Upon Existing Session" for represented sessions: no stored session IDs are updated, nor are existing sessions terminated. This prevents any interference with regular sessions from the represented user.

true

Enables the REST endpoint used for interpreting a forward location URI prior to starting an authentication flow (REST endpoint /<loginapp-uri>/rest/public/authentication/location/interpret/).

This endpoint could extract the display language or other information from the given URI so that the client can configure itself.

The order of the configured plugins is relevant. The first plugin which can handle the forward location URI is used, all remaining plugins are ignored. If no plugins are configured or no plugin can handle the provided URI, an empty interpretation result is returned.

Location Interpretations Configuration

Condition for allowing unauthenticated access to the /public/authentication endpoint. Once a user is authenticated, access to this endpoint is always allowed, regardless of this setting.

By default, access to the information endpoint is not allowed for unauthenticated users.

Security Note: If publicly available, this endpoint could be exploited for user enumeration attacks. To prevent these attacks, it is recommended that access to the endpoint is restricted to authenticated users only.

Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)