# Policies

#### **Password policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FaNsS15yMAB9O5w4ZcTPN%2F17.png?alt=media&#x26;token=17aee451-ce8e-4980-a9a3-131a76aa6372" alt=""><figcaption></figcaption></figure>

Within the Password Policy section, various policies for password setup can be defined.

For example, requirements such as including one uppercase letter, one numeric character, or setting limits on password length and many others can all be configured from this tab.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FFs527QuxvZxE2VwTVufO%2F18.png?alt=media&#x26;token=9e8042dc-d65a-452c-8c8e-1f1d484559fb" alt=""><figcaption></figcaption></figure>

You can incorporate the desired settings by selecting the appropriate option from the dropdown menu according to your needs.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FKY2wIORBnAHDSXTvhr8V%2F19.png?alt=media&#x26;token=6fe45206-a2df-4e4f-a013-fc7adf5009e3" alt=""><figcaption></figcaption></figure>

The selection that you made from the dropdown menu will be automatically reflected here.

You can set the threshold value for the Policy Type that you selected.

For example - If Uppercase Characters was chosen from the dropdown, it will appear under the Policy Type section as shown below&#x20;

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FFwqyJNCkI44LG5cSXIbW%2F20.png?alt=media&#x26;token=c7dd191d-1d4c-4271-b0eb-5bfb6edee201" alt=""><figcaption></figcaption></figure>

The threshold value can then be configured accordingly.

In the example shown above, a value of 1 indicates that a password must contain at least 1 uppercase character to be considered valid.

#### **Save**

After making the necessary adjustments, click Save to apply the changes.

#### **Reload**

If you wish to discard the changes made, click on Reload to revert to the previous settings.

### **OTP Policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FycyGDPWgM6L1zQmZ3064%2F21.png?alt=media&#x26;token=1cac9fb7-e5ee-49a8-acd8-ae150e29307c" alt=""><figcaption></figcaption></figure>

In the OTP Policy section, you can configure various settings related to OTP (One-Time Password).

#### **OTP Type**

In this setting, you can choose the OTP Type—either [Time Based OTP](../../../key-terminologies#time-based-otp) or [Counter Based OTP](../../../key-terminologies#counter-based-otp)—by selecting your preferred option.

#### **OTP Hash Algorithm**

This pertains to the Hashing Algorithm type utilized for generating the OTP.&#x20;

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FO4BIGPqODnsPDmkoOsaw%2F22.png?alt=media&#x26;token=48fc2a7e-62f1-4e9e-b723-83034c936c83" alt=""><figcaption></figcaption></figure>

You can select your preferred option from the dropdown menu.

#### **Number of Digits**

You can change this setting by selecting a different option.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FFqS3XfkiR9dmksxgqvZ0%2F23.png?alt=media&#x26;token=fa6d7eff-79c7-4aeb-af1a-fd20f49b9093" alt=""><figcaption></figcaption></figure>

You can choose between 6 or 8 digits for the OTP length.

#### **Look Around Window**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FJBfYANc3fgZoiVmrS7XG%2F24.png?alt=media&#x26;token=245e7cb0-5955-440e-baef-8b4327aefa1c" alt=""><figcaption></figcaption></figure>

This setting refers to the intervals the server attempts to match the hash. It's a feature in ZTrust that addresses situations where the OTP generator or authenticator server's clock becomes out of sync.

It has a default value of 1 and can be modified as required.

#### **OTP Token Period**

The default value is 30 seconds, but it can be adjusted as required.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FOBsd7xm5rUgQxCOr1F6x%2F25.png?alt=media&#x26;token=4f617d54-c28a-4e69-9fff-dbe91d4515e4" alt=""><figcaption></figcaption></figure>

This represents the duration (in seconds) for which the OTP remains valid.

#### **Supported Applications**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FodvZeOhae6tvVmMjReos%2F26.png?alt=media&#x26;token=d3406ff1-7824-46a6-850a-893429af6f5a" alt=""><figcaption></figcaption></figure>

It lists the applications that have been verified to be compatible with the current OTP policy.

#### **Reusable token**

This toggle button can be turned ON or OFF according to your needs.&#x20;

When enabled, the same OTP code can be reused after successful authentication.&#x20;

If disabled, the user cannot log in again using the same OTP code after successful authentication.

### **Webauthn Policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fl2R83buWiuWoC41E2k4l%2F27.png?alt=media&#x26;token=fddebe5c-d4ae-4dd9-9994-40cd121b89b2" alt=""><figcaption></figcaption></figure>

In the WebAuthn Policy section, you can configure the policies for WebAuthn authentication.&#x20;

These settings are utilized by the WebAuthn Register required action and the WebAuthn Authenticator authenticator.&#x20;

This setup is commonly employed for implementing WebAuthn in two-factor authentication scenarios.

#### **Relying Party Entity Name**

It refers to the Human-readable server name for a WebAuthn Relying Party.

This is a mandatory field and required for registering the WebAuthn authenticator.

The default setting is Keycloak.

#### **Signature Algorithms**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FbOaGrhsI8qCwrJTFnGk5%2F28.png?alt=media&#x26;token=833b7169-2087-44b8-9539-7e40371a3fdc" alt=""><figcaption></figcaption></figure>

This algorithm tells the WebAuthn authenticator which signature algorithm has to be used for Public Key Credential.

ZTrust relies on Public Key Credentials for signing and verifying Authentication Assertions.

You can choose the desired option from the dropdown menu.

If no specific algorithms are specified, the default ES256 algorithm is used.

It is an optional configuration item while applying to the registration of WebAuthn authenticators.

#### **Relying Party ID**

It refers to the ID of a WebAuthn Relying Party, which defines the scope of Public Key Credentials.&#x20;

It should correspond to the effective domain of the origin.&#x20;

This is an optional configuration that is applied during the registration of WebAuthn Authenticators.

#### **Attestation Conveyance Preference**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FonIJNnobuB0TU0vN2Pxe%2F29.png?alt=media&#x26;token=abba6fe2-e1be-4051-97d3-9d7c6d0bc2b3" alt=""><figcaption></figcaption></figure>

This setting specifies the preference for generating an attestation statement to the authenticator.

You can choose the desired option from the dropdown menu.

It is an optional configuration field while applying to the registration of the WebAuthn authenticator.

#### **Authenticator Attachment**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FiHi9GQFPV2DkfWaXxgAF%2F30.png?alt=media&#x26;token=fcab3af0-b9d1-4696-a337-3a5e8a9e0914" alt=""><figcaption></figcaption></figure>

This indicates an acceptable attachment pattern to the authenticator.

You can select your preference between platform or cross-platform patterns from the dropdown menu.

It is an optional configuration item while applying to the registration of WebAuthn Authenticator.

#### **Require discoverable credential**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FQRpQzGojjYXojRmtz8Kp%2F31.png?alt=media&#x26;token=7cf326db-8dd7-468e-be87-96abb8092ac4" alt=""><figcaption></figcaption></figure>

It instructs an authenticator whether to create a public key credential as a resident key or not.

It is an optional configuration item while applying to the registration of WebAuthn Authenticator.

#### **User Verification Requirement**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F3bu9PZw0raQRGOxEQGCV%2F32.png?alt=media&#x26;token=bffc4e0e-5866-46b0-ae3c-a67bcfcceb75" alt=""><figcaption></figcaption></figure>

This setting communicates the authenticator to confirm the verification of a user.&#x20;

It's an optional configuration applied during the registration and authentication processes of a WebAuthn authenticator.&#x20;

You can select your preferred option from the available choices in the dropdown menu.

If left unselected, it defaults to the behavior same as having preferred option.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Frlx2MQAg27JRjZxT2h5t%2F33.png?alt=media&#x26;token=7e088f17-d68b-46a0-8f91-ed03bfbccd09" alt=""><figcaption></figcaption></figure>

#### **Timeout**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FKth4ZhTcrcKlrW0qsB94%2F34.png?alt=media&#x26;token=48752962-7b85-4b54-924e-58b150a9d3d1" alt=""><figcaption></figcaption></figure>

This value determines the timeout duration for registering a WebAuthn authenticator and authenticating the user with it.&#x20;

If set to 0, the timeout option is not adapted, and it relies on the implementation behavior of the WebAuthn authenticator.

#### **Avoid Same Authenticator Registration**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FkOscH27UGY0AagzCEzaE%2F35.png?alt=media&#x26;token=2096fc96-02d8-4e3c-b96e-34ee58ad4354" alt=""><figcaption></figcaption></figure>

This is a toggle button, When activated (toggled ON), ZTrust prevents the re-registration of an already registered WebAuthn authenticator.&#x20;

If deactivated (toggled OFF), an already registered WebAuthn authenticator can be registered again.

#### **Acceptable AAGUIDs**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FCKVPg05F00sRf8kgedAV%2F36.png?alt=media&#x26;token=198122de-db7a-4934-ae17-9625e5f0bce3" alt=""><figcaption></figcaption></figure>

It mentions the white list of AAGUIDs (Authenticator Attestation Global Unique Identifier) of which an authenticator can be registered.

This indicates the whitelist of AAGUIDs that a WebAuthn authenticator needs to register against.

You can include any AAGUID by selecting the '+ Add AAGUID' option. To remove any existing AAGUID, simply click on the '-' symbol.

#### **Extra Origins**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FwyeGdzyqnDyVfk9Yb3Fe%2F37.png?alt=media&#x26;token=6f83cede-625f-44cf-8914-ba3b03e6b6e5" alt=""><figcaption></figcaption></figure>

This specifies the list of extra origins for non-web applications.&#x20;

You can add a new origin by entering the necessary details and clicking on + Add Origin.

To remove an existing origin, click on the '-' symbol.

#### **Save**

After making the necessary adjustments, click Save to apply the changes.

#### **Reload**

If you wish to discard the changes made, click on Reload to revert to the previous settings.

### **Webauthn Passwordless Policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FTH20M2PoWk84MYgIA9mB%2F38.png?alt=media&#x26;token=b2e15fe3-425f-4b5b-a8d6-d8ac9b36413e" alt=""><figcaption></figcaption></figure>

Under the WebAuthn Passwordless Policy, you can establish guidelines for Passwordless WebAuthn Authentication.

These policies are applied to both the WebAuthn Register Passwordless required action and the WebAuthn Passwordless Authenticator.&#x20;

This setup is commonly utilized when WebAuthn serves as the initial authentication factor. If both the WebAuthn Policy and WebAuthn Passwordless Policy are configured within the same realm, it enables the use of WebAuthn for both first-factor and second-factor authentication within that realm.

#### **Relying Party Entity Name**

It refers to the Human-readable server name for a WebAuthn Relying Party.

This is a mandatory field and required for registering the WebAuthn authenticator.

The default setting is Keycloak.

#### **Signature Algorithms**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FIN2PxV9c4Lc5B9hmIlig%2F39.png?alt=media&#x26;token=d04f80fd-2e19-4294-80f9-1be052a7afe1" alt=""><figcaption></figcaption></figure>

This algorithm tells the WebAuthn authenticator which signature algorithm has to be used for Public Key Credential.

ZTrust relies on Public Key Credentials for signing and verifying Authentication Assertions.

You can choose the desired option from the dropdown menu.

If no specific algorithms are specified, the default ES256 algorithm is used.

It is an optional configuration item while applying to the registration of WebAuthn authenticators.

#### **Relying Party ID**

It refers to the ID of a WebAuthn Relying Party, which defines the scope of Public Key Credentials.&#x20;

It should correspond to the effective domain of the origin.&#x20;

This is an optional configuration that is applied during the registration of WebAuthn Authenticators.

#### **Attestation Conveyance Preference**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FWUe9xZLdIZFopmRixVnr%2F40.png?alt=media&#x26;token=a2a7ffcf-37a9-4a75-a49d-0ab05c62bded" alt=""><figcaption></figcaption></figure>

This setting specifies the preference for generating an attestation statement to the authenticator.

You can choose the desired option from the dropdown menu.

It is an optional configuration field while applying to the registration of the WebAuthn authenticator.

#### **Authenticator Attachment**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FZ7yjAdIcE4x8Wn6Ee5Pt%2F41.png?alt=media&#x26;token=32d60c2b-7e95-4838-8fb8-20400910f06e" alt=""><figcaption></figcaption></figure>

This indicates an acceptable attachment pattern to the authenticator.

You can select your preference between platform or cross-platform patterns from the dropdown menu.

It is an optional configuration item while applying to the registration of WebAuthn Authenticator.

#### **Require discoverable credential**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FTaIhqpJks8wEEvHrrjBV%2F42.png?alt=media&#x26;token=98d60bdc-6b95-44d3-ab1e-599385713d0d" alt=""><figcaption></figcaption></figure>

It instructs an authenticator whether to create a public key credential as a resident key or not.

It is an optional configuration item while applying to the registration of WebAuthn Authenticator.

#### **User Verification Requirement**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FdpVr4VhL4xh1CIpLtMON%2F43.png?alt=media&#x26;token=6b058724-8b12-4a94-8e35-686e0bd69d41" alt=""><figcaption></figcaption></figure>

This setting communicates the authenticator to confirm the verification of a user.&#x20;

It's an optional configuration applied during the registration and authentication processes of a WebAuthn authenticator.&#x20;

You can select your preferred option from the available choices in the dropdown menu.

If left unselected, it defaults to the behavior same as having preferred option.

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FlqaZyXQa097kklJzmT67%2F44.png?alt=media&#x26;token=a922be50-6638-4581-b63f-811fb269cc35" alt=""><figcaption></figcaption></figure>

#### **Timeout**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FyucIpEefucN5HEdxi8O7%2F45.png?alt=media&#x26;token=00a6cfbb-dc8e-4e06-9eea-3da8163a6969" alt=""><figcaption></figcaption></figure>

This value determines the timeout duration for registering a WebAuthn authenticator and authenticating the user with it.&#x20;

If set to 0, the timeout option is not adapted, and it relies on the implementation behavior of the WebAuthn authenticator.

#### **Avoid Same Authenticator Registration**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F6K0w4UWqBSg61OAiCThW%2F46.png?alt=media&#x26;token=880ba0af-f4ed-45bd-b3d2-66b7754a6f87" alt=""><figcaption></figcaption></figure>

This is a toggle button, When activated (toggled ON), ZTrust prevents the re-registration of an already registered WebAuthn authenticator.&#x20;

If deactivated (toggled OFF), an already registered WebAuthn authenticator can be registered again.

#### **Acceptable AAGUIDs**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2F69Kg28NBF1EtyGuoXo80%2F47.png?alt=media&#x26;token=593da6f0-210b-4b36-aeca-3fabc664c55d" alt=""><figcaption></figcaption></figure>

It mentions the white list of AAGUIDs (Authenticator Attestation Global Unique Identifier) of which an authenticator can be registered.

This indicates the whitelist of AAGUIDs that a WebAuthn authenticator needs to register against.

You can include any AAGUID by selecting the '+ Add AAGUID' option. To remove any existing AAGUID, simply click on the '-' symbol.

#### **Extra Origins**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2Fm9wCa2GHTZuvQFwwPcv9%2F48.png?alt=media&#x26;token=e3f1be1a-a512-4af9-9e5d-858ada6300e9" alt=""><figcaption></figcaption></figure>

This specifies the list of extra origins for non-web applications.&#x20;

You can add a new origin by entering the necessary details and clicking on + Add Origin.

To remove an existing origin, click on the '-' symbol.

#### **Save**

After making the necessary adjustments, click Save to apply the changes.

#### **Reload**

If you wish to discard the changes made, click on Reload to revert to the previous settings.

### **CIBA Policy**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FsOAFlnEVdnSNpIIJvAIA%2F49.png?alt=media&#x26;token=7cb93de1-19f2-418f-9d46-f33b4801470b" alt=""><figcaption></figcaption></figure>

In the context of CIBA Policy, an admin can set up operations related to Client Initiated Backchannel Authentication (CIBA) for a specific realm.

#### **Backchannel Token Delivery Mode**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FY5zxNqW7v1VteYG4qtQH%2F50.png?alt=media&#x26;token=5a779178-41a9-4231-9fcd-efc95becfcca" alt=""><figcaption></figcaption></figure>

This setting is mandatory and determines how the Consumption Device (CD) receives the authentication result and associated tokens.&#x20;

Two modes are available - Poll and Ping, with the default value set to Poll.

#### **Expires In**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FB4EUV0emBIio6iKonQoO%2F51.png?alt=media&#x26;token=41c194f4-8526-4a7f-92ce-a561f3ecbc08" alt=""><figcaption></figcaption></figure>

This setting mentions the expiration time of the auth\_req\_id in seconds, starting from when the authentication request was received.&#x20;

The default setting is 120 seconds, but you can adjust this duration based on your needs.

#### **Interval**

<figure><img src="https://1778922777-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3EUK5AUZv0UVaI5S0CTM%2Fuploads%2FlPLvRFhODfMd84S9cYaq%2F52.png?alt=media&#x26;token=cf09e6dc-b564-4c21-a74b-deb0aa62efbc" alt=""><figcaption></figcaption></figure>

This setting specifies the time duration in seconds that the Consumption Device (CD) needs to wait for between polling requests to the token endpoint.&#x20;

It's an optional configuration, with a default setting of 5 seconds.&#x20;

You have the flexibility to adjust this duration according to your needs.

#### **Authentication Requested User Hint**

It's a mandatory field, which refers to the way of identifying the end-user for whom the identification is being requested.&#x20;

The default option is login\_hint, and currently, ZTrust only supports this method.

#### **Save**

After making the necessary adjustments, click Save to apply the changes.

#### **Reload**

If you wish to discard the changes made, click on Reload to revert to the previous settings.

\
