Authentication Selectors and Their Routing Logic

Selector	Purpose	Routing logic	Typical use case
ILP_Selector	Starts authentication through ILP_journey	Always routes to `ILP_journey`	Use when login must go through the ILP flow
NoPhone_Selector	Starts authentication through No_Phone_Journey	Always routes to `No_Phone_Journey`	Users without phone-based authenticators
Delegated_Authentication	Chooses delegated authentication for shared accounts	`is_shared_account` → `Delegate_Authentication`; otherwise → `journey_default`	Shared/delegated account access
Specific_Groups_Selector	Routes selected groups to stronger authentication	`is_in_specific_groups` → `Two_factor_auth`; otherwise → `journey_default`	Group-based MFA enforcement
CBA_Selector	Enables certificate-based authentication entry options	Always routes to `journey_default`; engagement supports certificate	Certificate-based authentication scenarios
selector_default	Default selector	Always routes to `journey_default`	Baseline/default authentication
Windows_Login	Credential Provider selector based on group assignment	`is_in_specific_groups` → `CP_2factor_with_LDAP`; otherwise → `journey_default`	Windows logon requiring LDAP + second factor for selected groups

Journey	Purpose	Flow	Typical use case
journey_default	Default single-challenge journey where the user chooses from available authenticators	`Start → Challenge → Authenticated / Failed`	Standard login flow
ILP_journey	Authentication with ILP / UBA validation, followed by PIN step-up if risk fails	`Start → ILP_challenge → Authenticated` or `Second_challenge → Authenticated / Failed`	Risk-based login with fallback step-up
No_Phone_Journey	Authenticate users without relying on phone-based methods	`Start → no_phone_challenge → Authenticated / Failed`	Users without mobile app or phone access
Two_factor_auth	Two-step authentication journey	`Start → first_factor → second_step → Authenticated / Failed`	Enforce two independent factors
Delegate_Authentication	Delegated/shared-account authentication workflow	`Start → SharedAccounts → DelegateAuth → Authenticated / Failed`	Shared account or delegated approval scenarios
CP_2factor_with_LDAP	Credential Provider two-factor flow with LDAP password as second factor	`Start → First_factor → second_factor → Authenticated / Failed`	Windows login requiring Veridium factor plus LDAP password

Journey	Challenge nodes	Commands used
journey_default	`Challenge`	`cmd_fido_browser`, `cmd_lost_mode_browser`, `cmd_totp_browser`, `cmd_pin_mobile`, `cmd_vface_browser`, `cmd_vface_mobile`, `cmd_native_biometrics_mobile`, `cmd_push_with_userpresence_code`, `cmd_otp`, `cmd_4f_mobile`
ILP_journey	`ILP_challenge`, `Second_challenge`	`cmd_uba_context`, `cmd_uba_motion`, `cmd_push_with_userpresence_code`, `cmd_native_biometrics_mobile`, `cmd_fido_browser`, `cmd_lost_mode_browser`, `cmd_totp_browser`, `cmd_vface_browser`, then `cmd_pin_browser` if ILP/UBA fails
No_Phone_Journey	`no_phone_challenge`	`cmd_vface_browser`, `cmd_pin_browser`, `cmd_sms_browser`, `cmd_fido_browser`
Two_factor_auth	`first_factor`, `second_step`	First: `cmd_push_with_userpresence_code`, `cmd_native_biometrics_mobile`, `cmd_vface_mobile`, `cmd_4f_mobile`; second: `cmd_vface_browser`, `cmd_fido_browser`, `cmd_pin_browser`, `cmd_totp_browser`
Delegate_Authentication	`SharedAccounts`, `DelegateAuth`	First: `cmd_delegate_authentication`, `cmd_QR`, `cmd_native_biometrics_mobile`, `cmd_pin_mobile`; second: `cmd_push_with_userpresence_code`, `cmd_native_biometrics_mobile`, `cmd_pin_mobile`, `cmd_vface_mobile`, `cmd_4f_mobile`
CP_2factor_with_LDAP	`First_factor`, `second_factor`	First: `cmd_push_with_userpresence_code`, `cmd_native_biometrics_mobile`, `cmd_pin_mobile`, `cmd_totp_desktop`, `cmd_totp_browser`, `cmd_vface_browser`, `cmd_fido_browser`; second: `cmd_LDAP_password_desktop`

Selectors