AAC IBM Verify Gateway

The wizard includes a summary tab that details all the configuration steps that will be performed, in order, once the Save button is clicked. The wizard deploys pending changes multiple times throughout the process.

After all the configurations steps have been performed, a summary is again presented. New tabs are available in the wizard that provide example JSON configuration for the Verify Gateway module, and each of the API request URLs and payloads are detailed.

Custom Policies

Authentication policies will be created, depending on the selected second factor methods. Most of the policy parameters are configured to be mapped from request parameters, and the second factor policies will be disabled so that they can only be exercised by using the AuthSvcClient. See Execute authentication service policies in an Info Map.

Verify Gateway Entry Policy

The main policy entry point for the integration. This InfoMap policy will map between URLs passed in via the HTTP Transformation Rules, and the second factor policies.

Verify Gateway TOTP Policy

A simple TOTP policy with default configuration. Created if TOTP is selected as a second factor method.

Verify Gateway MAC OTP Policy

A MAC OTP policy with deliveryType, emailAddress, and mobileNumber sourced from request parameters. Created if Email OTP or SMS OTP is selected as second factor methods.

Verify Gateway MMFA Initiate Policy

Verify Gateway MMFA Fingerprint Policy

Verify Gateway MMFA User Presence Policy

Up to 3 MMFA policies are created depending on the selected second factor methods, and selected MMFA methods in the wizard. The MMFA Initiate policy is configured to source pushMessage, contextMessage, and policyURI from request parameters. The Fingerprint and User Presence policies created are simple MMFA response policies.

Mechanisms

While some policy configuration is sourced from request parameters, most configuration is instead stored at the mechanism level. As such, multiple mechanisms are either modified or created.

Verify Gateway Entry Mechanism

The Verify Gateway Entry mechanism is an InfoMap mechanism configured with the VerifyGatewayEntry mapping rule, and is used by the Verify Gateway Entry Policy.

Email One-time Password mechanism

If Email OTP is selected as a second factor method, the Email One-time Password mechanism will be configured with the following information, gathered from the configuration wizard:

• SMTP hostname
• SMTP port
• BA username
• BA password
• Sender Email
• SSL enabled

SMS One-time Password mechanism

If SMS OTP is selected as a second factor method, the SMS One-time Password mechanism will be configured with the following information, gathered from the configuration wizard:

• Connection URL
• BA username
• BA password
• Client Auth Key
• HTTPS Truststore

Verify Gateway SCIM Mechanism

The SCIM Endpoint Configuration mechanism will be configured with a new Web Service Server Connection, Verify Gateway SCIM Connection. The server connection is configured with the information gathered from the LDAP tab of the wizard. The server connection and mechanism will only be created if MMFA has been chosen as a second factor method.

SCIM Configuration

A Verify Identity Access Runtime server connection will be created (Verify Gateway Runtime Connection), and SCIM will be configured to use that connection.

The SCIM Configuration suffixes, User DN Attribute, and User ID Attribute will be configured with the values from the MMFA tab.

The User Profile Attribute Mappings will be updated to map the userName attribute to the uid LDAP attribute, which matches the required mappings for users created by using pdadmin. See Common attribute mappings.

VerifyGatewayEntry mapping rule and template pages

The VerifyGatewayEntry mapping rule and template pages (authsvc/authenticator/verify_gateway) will exist by default.

They will also be available via the File Downloads section of the configuration UI. The contents of the VerifyGatewayEntry mapping rule may change after running the wizard, as the beginning of the mapping rule contains configuration such as enabled second factor methods, trusted OAuth Client, and the point of contact URL.

OAuth Definition and Client

The wizard will create a new OAuth Definition and Client for use by the Verify Gateway Module, named Verify Gateway Definition and Verify Gateway Client respectively. The definition only enables the client credentials grant type.

MMFA Configuration

The wizard will check for well-known MMFA configuration as detailed in the MMFA Cookbook and create the configuration items if they are missing.

This includes adding the Authenticator OAuth Definition and the Authenticator Client OAuth Client. The MMFA Configuration endpoints can be viewed or modified by navigating to AAC > MMFA Configuration > General.