Policies
Last updated
Last updated
Within the Password Policy section, various policies for password setup can be defined.
For example, requirements such as including one uppercase letter, one numeric character, or setting limits on password length and many others can all be configured from this tab.
You can incorporate the desired settings by selecting the appropriate option from the dropdown menu according to your needs.
The selection that you made from the dropdown menu will be automatically reflected here.
You can set the threshold value for the Policy Type that you selected.
For example - If Uppercase Characters was chosen from the dropdown, it will appear under the Policy Type section as shown below
The threshold value can then be configured accordingly.
In the example shown above, a value of 1 indicates that a password must contain at least 1 uppercase character to be considered valid.
After making the necessary adjustments, click Save to apply the changes.
If you wish to discard the changes made, click on Reload to revert to the previous settings.
In the OTP Policy section, you can configure various settings related to OTP (One-Time Password).
In this setting, you can choose the OTP Type—either Time Based OTP or Counter Based OTP—by selecting your preferred option.
This pertains to the Hashing Algorithm type utilized for generating the OTP.
You can select your preferred option from the dropdown menu.
You can change this setting by selecting a different option.
You can choose between 6 or 8 digits for the OTP length.
This setting refers to the intervals the server attempts to match the hash. It's a feature in ZTrust that addresses situations where the OTP generator or authenticator server's clock becomes out of sync.
It has a default value of 1 and can be modified as required.
The default value is 30 seconds, but it can be adjusted as required.
This represents the duration (in seconds) for which the OTP remains valid.
It lists the applications that have been verified to be compatible with the current OTP policy.
This toggle button can be turned ON or OFF according to your needs.
When enabled, the same OTP code can be reused after successful authentication.
If disabled, the user cannot log in again using the same OTP code after successful authentication.
In the WebAuthn Policy section, you can configure the policies for WebAuthn authentication.
These settings are utilized by the WebAuthn Register required action and the WebAuthn Authenticator authenticator.
This setup is commonly employed for implementing WebAuthn in two-factor authentication scenarios.
It refers to the Human-readable server name for a WebAuthn Relying Party.
This is a mandatory field and required for registering the WebAuthn authenticator.
The default setting is Keycloak.
This algorithm tells the WebAuthn authenticator which signature algorithm has to be used for Public Key Credential.
ZTrust relies on Public Key Credentials for signing and verifying Authentication Assertions.
You can choose the desired option from the dropdown menu.
If no specific algorithms are specified, the default ES256 algorithm is used.
It is an optional configuration item while applying to the registration of WebAuthn authenticators.
It refers to the ID of a WebAuthn Relying Party, which defines the scope of Public Key Credentials.
It should correspond to the effective domain of the origin.
This is an optional configuration that is applied during the registration of WebAuthn Authenticators.
This setting specifies the preference for generating an attestation statement to the authenticator.
You can choose the desired option from the dropdown menu.
It is an optional configuration field while applying to the registration of the WebAuthn authenticator.
This indicates an acceptable attachment pattern to the authenticator.
You can select your preference between platform or cross-platform patterns from the dropdown menu.
It is an optional configuration item while applying to the registration of WebAuthn Authenticator.
It instructs an authenticator whether to create a public key credential as a resident key or not.
It is an optional configuration item while applying to the registration of WebAuthn Authenticator.
This setting communicates the authenticator to confirm the verification of a user.
It's an optional configuration applied during the registration and authentication processes of a WebAuthn authenticator.
You can select your preferred option from the available choices in the dropdown menu.
If left unselected, it defaults to the behavior same as having preferred option.
This value determines the timeout duration for registering a WebAuthn authenticator and authenticating the user with it.
If set to 0, the timeout option is not adapted, and it relies on the implementation behavior of the WebAuthn authenticator.
This is a toggle button, When activated (toggled ON), ZTrust prevents the re-registration of an already registered WebAuthn authenticator.
If deactivated (toggled OFF), an already registered WebAuthn authenticator can be registered again.
It mentions the white list of AAGUIDs (Authenticator Attestation Global Unique Identifier) of which an authenticator can be registered.
This indicates the whitelist of AAGUIDs that a WebAuthn authenticator needs to register against.
You can include any AAGUID by selecting the '+ Add AAGUID' option. To remove any existing AAGUID, simply click on the '-' symbol.
This specifies the list of extra origins for non-web applications.
You can add a new origin by entering the necessary details and clicking on + Add Origin.
To remove an existing origin, click on the '-' symbol.
After making the necessary adjustments, click Save to apply the changes.
If you wish to discard the changes made, click on Reload to revert to the previous settings.
Under the WebAuthn Passwordless Policy, you can establish guidelines for Passwordless WebAuthn Authentication.
These policies are applied to both the WebAuthn Register Passwordless required action and the WebAuthn Passwordless Authenticator.
This setup is commonly utilized when WebAuthn serves as the initial authentication factor. If both the WebAuthn Policy and WebAuthn Passwordless Policy are configured within the same realm, it enables the use of WebAuthn for both first-factor and second-factor authentication within that realm.
It refers to the Human-readable server name for a WebAuthn Relying Party.
This is a mandatory field and required for registering the WebAuthn authenticator.
The default setting is Keycloak.
This algorithm tells the WebAuthn authenticator which signature algorithm has to be used for Public Key Credential.
ZTrust relies on Public Key Credentials for signing and verifying Authentication Assertions.
You can choose the desired option from the dropdown menu.
If no specific algorithms are specified, the default ES256 algorithm is used.
It is an optional configuration item while applying to the registration of WebAuthn authenticators.
It refers to the ID of a WebAuthn Relying Party, which defines the scope of Public Key Credentials.
It should correspond to the effective domain of the origin.
This is an optional configuration that is applied during the registration of WebAuthn Authenticators.
This setting specifies the preference for generating an attestation statement to the authenticator.
You can choose the desired option from the dropdown menu.
It is an optional configuration field while applying to the registration of the WebAuthn authenticator.
This indicates an acceptable attachment pattern to the authenticator.
You can select your preference between platform or cross-platform patterns from the dropdown menu.
It is an optional configuration item while applying to the registration of WebAuthn Authenticator.
It instructs an authenticator whether to create a public key credential as a resident key or not.
It is an optional configuration item while applying to the registration of WebAuthn Authenticator.
This setting communicates the authenticator to confirm the verification of a user.
It's an optional configuration applied during the registration and authentication processes of a WebAuthn authenticator.
You can select your preferred option from the available choices in the dropdown menu.
If left unselected, it defaults to the behavior same as having preferred option.
This value determines the timeout duration for registering a WebAuthn authenticator and authenticating the user with it.
If set to 0, the timeout option is not adapted, and it relies on the implementation behavior of the WebAuthn authenticator.
This is a toggle button, When activated (toggled ON), ZTrust prevents the re-registration of an already registered WebAuthn authenticator.
If deactivated (toggled OFF), an already registered WebAuthn authenticator can be registered again.
It mentions the white list of AAGUIDs (Authenticator Attestation Global Unique Identifier) of which an authenticator can be registered.
This indicates the whitelist of AAGUIDs that a WebAuthn authenticator needs to register against.
You can include any AAGUID by selecting the '+ Add AAGUID' option. To remove any existing AAGUID, simply click on the '-' symbol.
This specifies the list of extra origins for non-web applications.
You can add a new origin by entering the necessary details and clicking on + Add Origin.
To remove an existing origin, click on the '-' symbol.
After making the necessary adjustments, click Save to apply the changes.
If you wish to discard the changes made, click on Reload to revert to the previous settings.
In the context of CIBA Policy, an admin can set up operations related to Client Initiated Backchannel Authentication (CIBA) for a specific realm.
This setting is mandatory and determines how the Consumption Device (CD) receives the authentication result and associated tokens.
Two modes are available - Poll and Ping, with the default value set to Poll.
This setting mentions the expiration time of the auth_req_id in seconds, starting from when the authentication request was received.
The default setting is 120 seconds, but you can adjust this duration based on your needs.
This setting specifies the time duration in seconds that the Consumption Device (CD) needs to wait for between polling requests to the token endpoint.
It's an optional configuration, with a default setting of 5 seconds.
You have the flexibility to adjust this duration according to your needs.
It's a mandatory field, which refers to the way of identifying the end-user for whom the identification is being requested.
The default option is login_hint, and currently, ZTrust only supports this method.
After making the necessary adjustments, click Save to apply the changes.
If you wish to discard the changes made, click on Reload to revert to the previous settings.
