hid_authchain_select

Stage Number

(int) The policy engine will run checks in stages. Each stage completes before rules in the next stage are tested; only after all stages are completed, or a rule finalizes processing, are the final results passed.

Rule Number

(int) Within each stage, the engine processes the rules in number order. Note that this is not necessarily table entry order.

SkipRemaining

This field can have three values:

Comment

(string) Used to explain what the rule means in English. Like all comments, very useful if kept correct, and actively dangerous if not.

CfgId

The GUID or blank and determines which module the rule apply to. Each module is assigned a GUID on creation. To determine a module’s GUID see Obtaining the GUID .

If the rule’s CfgId is blank, it will run on every invocation of the selection plugin. This should only be used when the selector is only invoked in one place.

Note: It is recommended that you do not leave the CfgId blank.

When the selector is used in two places in authentication, knowing which rules should be tested for each invocation is critical, and therefore each rule should have the CfgId of its module. For example; in Bravura Workforce Pattern , DEFAULT_CHAIN is a selector, to determine if two-factor authentication is required, or if this is the first login for a user; then the 2FACTOR chain is a selector, determining what second factor types are possible for this user; and FIRST_LOGIN is also a selector, determining if we can use SMS or PII to authenticate the user for the first time.

MatchType, MatchKey, MatchCondition, MatchValue

Optional . Within a plugin run, each module rule is then further evaluated based on optional values configured for matching parameters in these four fields.

Example; if the rule must match authenticating users based on their membership in a user class:

MatchType

This field can have one of the following restricted values:

MatchCondition

This field can have one of the following restricted values:

MatchKey

The key to match based on the MatchType flag.

MatchValue

(string) The value to match based on the values based on the values of MatchType and MatchKey.

Examples:

Action

(selection) If a match is found, the ”Action” column determines what the policy engine should do with the list of chains already matched as part of the current run. The following options are available:

ChainID

Optional . If this rule matches, this field determines which chain is allowed.

The value of this column is an authentication chain_ ID; it is not a GUID of an individual authentication chain module.

Built-in chains such as the password or security questions authentication must be prefixed accordingly since this is how the authentication selector plugin expects them to be listed in its output; for example, $INTERNAL_password.pss, $INTERNAL_response.pss. Other custom authentication chains must be listed by their ID; for example, SUCCESS, SMSPIN, FIRST_LOGIN.

It is important to note here that any authentication chain added to this field must first be made available to the calling chain via Manage the system > Policies > Authentication chains otherwise the plugin run will fail.

The Chain_ID field can be empty, thus allowing a rule to ’throw away’ any existing chains collected in the current run up until then, if the authentication logic requires it.

ErrorMsg

The custom error message to use if authentication fails to find any valid chains.

ComponentOwnerFQN

(string, not modifiable): The component that registered the rule. For manually created rules, this is blank.

Rule 1

Allows users to skip authentication when instance is accessed from localhost

Rule 2

Allows users to skip authentication when instance is accessed from localhost

Rule 3

Provides a ’forgot my password’ authchain