Importing a bundled authentication policy

Edit online

You can import an authentication policy bundle into Verify Identity Access. The bundle can include the policy definition, optional infomap-mechanism definitions, and any required mapping rules or template files.

About this task

A complete authentication policy is made up of several different components:

  1. The authentication policy definition. This definition includes a list of steps, decisions, and branches along with any required configuration for each.
  2. The authentication mechanisms.
  3. Optional mapping rules.
  4. Optional template files.

An authentication policy bundle is a compressed file that contains all the required components alongside a yaml file that describes the authentication policy.

The bundle file must be a compressed file that contains:

  • policy.yaml A policy file that describes the authentication policy and any required infomap mechanisms, mapping rules and template files.
  • mapping_rules An optional directory that includes all the mapping rules that are listed in the policy.yaml file.
  • template_files An optional directory that includes the template files that are listed in the policy.yaml file.

The policy.yaml file must adhere to the schema file found at: https://github.com/IBM-Security/verify-access-aac-authentication-policies/blob/master/policy.yaml.schema.

Existing authentication policy bundles and examples can be found at: https://github.com/IBM-Security/verify-access-aac-authentication-policies.

The following import wizard performs these actions:

  1. Upload the compressed file to Verify Identity Access and validate the policy.yaml file.
  2. Populate wizard pages based on the content of the policy.yaml file.
  3. Allow user-defined substitutions for any macro values in the mapping rules and template files that were defined in the policy.yaml file.
  4. Create the included template files in Verify Identity Access.
  5. Create the included mapping rules in Verify Identity Access.
  6. Create the defined infomap authentication mechanisms in Verify Identity Access.
  7. Create the defined authentication policy in Verify Identity Access.
  8. Show the summary of the operations that were performed and their JSON payloads.

Procedure

  1. Log in to the local management interface.
  2. Click AAC.
  3. Under Policy, click Authentication.
  4. In the dropdown menu item, select Import.
  5. A dialog opens with a single tab that allows the authentication policy compressed file to be selected. Click Browse to locate and select the compressed file to be imported.
  6. Click Next. This action performs an upload of the compressed file to Verify Identity Access where the contents are validated. Any problems display an error message. Upon successful validation, the wizard dialog is updated to show the details of the authentication policy that is going to be created.
  7. Read through the General Information page to see a description of the authentication policy. At this stage, make sure that any prerequisite tasks that are listed were performed. Also take note of any post configuration tasks that need to be run upon successful completion.
  8. Click Next.
  9. The Authentication Policy page is shown. The page shows the name, description, identifier, and enabled settings along with a flowchart of the authentication policy that is going to be created. If a matching existing authentication policy exists, a warning is shown along with a checkbox that can be selected to overwrite the existing policy. In this situation, the wizard cannot continue unless the overwrite checkbox is selected. All the fields except the Description field are read only. The description is pre-populated with the bundle data from the policy yaml file. If a different description is required, update it in the field.
  10. Click Next.
  11. If any infomap authentication mechanisms are listed in the policy.yaml file, a page is shown in the wizard for each mechanism. Each page shows the name, description, identifier, mapping rule, and template file that are defined for the specific mechanism. If a matching authentication mechanism exists, a warning is shown along with a checkbox that can be selected to overwrite the existing mechanism. In this situation, the wizard cannot continue unless the overwrite checkbox is selected. All the fields are read only.
  12. Click Next on each authentication mechanism page.
  13. If any mapping rules are listed in the policy.yaml file, a page is shown in the wizard for each mapping rule. Each page shows the name and category of the mapping rules along with a list of macros that can be updated for the specific mapping rule. If a matching mapping rule exists, a warning is shown along with a checkbox that can be selected to overwrite the existing mapping. In this situation, the wizard cannot continue unless the overwrite checkbox is selected. All the fields are read only.

    The macros table shows a list of any macros that can be set for the mapping rule. The initial value for each macro in the list is either the default value from the policy.yaml file or the actual macro name if no default value is set. The wizard does not enforce the update of this value. If the value is not changed, the resulting mapping rule contains the value that is shown on the page. If the value is set as an empty string, the macro is removed from the mapping rule.

    1. To modify a macro value, select the macro in the list and click Edit.
    2. Update the value and click OK.
  14. Click Next for each mapping rule page.
  15. If any template files are listed in the policy.yaml file, a page is shown in the wizard for each template file. Each page shows the name and location of the template files along with a list of macros that can be updated for the specific template file. If a matching template file exists, a warning is shown along with a checkbox that can be selected to overwrite the existing template file. In this situation, the wizard cannot continue unless the overwrite checkbox is selected. All the fields are read only.

    The macros table shows a list of any macros that can be set for the template file. The initial value for each macro in the list is either the default value from the policy.yaml file or the actual macro name if no default value is set. The wizard does not enforce the update of this value. If the value is not changed, the resulting template file contains the value that is shown on the page. If the value is set as an empty string, the macro is removed from the template file.

    1. To modify a macro value, select the macro in the list and click Edit.
    2. Update the value and click OK.
  16. The Summary page is shown. The page lists all the configuration steps that are performed. Review the operations to verify that no problems exist and click OK. The wizard performs each of the listed configuration steps in order.
  17. On completion of the configuration steps a new Summary page is shown. This screen lists the configuration steps and the result of the operation.
  18. Click Next to see the JSON Payloads page. The page shows the details of the configuration operations that were performed. For each operation, the HTTP action and the JSON payload can be viewed or copied. Use the Copy All button to copy the HTTP actions and JSON payloads for all the operations to the clipboard.
  19. Click Close to finish the wizard operation.

What to do next

When you configure the mechanism, a message indicates that changes are not deployed. Deploy changes when you are finished. For more information, see Deploying pending changes.
Note: During the operation of the wizard and after the authentication mechanisms are created, an automatic deployment of any changes up to that point is performed. This deployment includes any nondeployed changes that were performed before the running of this wizard. This deployment step is required to make the mechanisms available during the authentication policy creation.