Specifying authentication levels

About this task

Complete the following steps to specify authentication levels.

Procedure

Edit the [authentication-levels] stanza in the WebSEAL configuration file. For each authentication method to be used for authentication level step-up, add an entry to the stanza.

The supported authentication methods are described in the following table:

Table 1. Authentication methods supported for authentication strength
Authentication Method	Configuration File Entry
None	`level = unauthenticated`
Forms authentication	`level = password`
Certificate authentication	`level = ssl`
External authentication interface	`level = ext-auth-interface`
Lightwight Third-Party Authentication (LTPA)	`level = ltpa`
OpenID Connect (OIDC)**	`level = oidc`
OAuth Authentication**	`level = oauth`
OAuth Introspection**	`level = oauth-introspect`

**Note OpenID Connect Authentication, OAuth Authentication and OAuth Introspection can only be used as authentication level one.

The default entries are:

[authentication-levels]
level = unauthenticated
level = password

The following entry must always be the first in the list: level = unauthenticated. Additional entries can be placed in any order. For example, to enable authentication strength levels for certificate authentication at the highest level, the completed stanza entry is:

[authentication-levels]
level = unauthenticated
level = password
level = ssl

Verify that each authentication method listed in [authentication-levels] is enabled. To determine if an authentication method is enabled, check the appropriate entries in the WebSEAL configuration file. To review the necessary entries and access the authentication configuration instructions, see the following sections:
Note: Basic authentication is enabled by default.