ILP journey covering the following flow:
-
If authentication succeeds and motion and context scores are good, the user is asked for one authentication factor.
-
If authentication succeeds but motion or context scores are poor, the user is asked for an additional authentication factor.
Creating your own conditions:
In journies, the commands can be created based on any field from the session. Based on these fields, any decision can be taken. Here is an example of a condition for allowing login only in business hours.
###is_working_hour
loginDate := input.session.requestTime
# Must match time between 08:00 and 17:59 - this is UTC time. It needs to be customized the regex part, to take into consideration the UTC time.
regex.match("^[0-9]{4}-[0-9]{2}-[0-9]{2}T(0[8-9]|1[0-7]):[0-5][0-9]", loginDate)
# Must be a weekday (Mon–Fri)
weekday := time.weekday(time.parse_rfc3339_ns(loginDate))
weekday != "Sunday"
weekday != "Saturday"
If you want to have different journeys, based on location, you can use a selector, like this one.
Later, for a journey, you can have different challanges, based on Groups.
-
it is important to define the group in veridium Websecadmin → groups.
Another complex conditions are has_logged_in_today and pin_authenticated_recently. These to conditions are taking into conderation also previous authentications. To enable 10 previous and Pin counter, modify this in websecadmin → config.json
"orchestrator": {
"sessionFinishedReadLimit": 10,
"useCounters": false
},
After chaning this value, ver_tomcat should be restarted.
Here is an example for has_logged_in_today → for cp and for web.
# change this value to reflect the how often should the user be authenticated; 480 means 8 hours.
authentication_timespan_minutes = 480
count(input.finishedSessions) > 0
completed_sessions = [ s | s := input.finishedSessions[_] ; s.status == "COMPLETED" ]
cp_sessions = [ s | s := completed_sessions[_] ; input.session.exploiterDeviceContext.userAgentName == "VeridiumCP" ; input.session.exploiterDeviceId == s.exploiterDeviceId]
web_session = [ s | s := completed_sessions[_] ; input.session.exploiterDeviceContext.userAgentTrustId != null ; input.session.exploiterDeviceContext.userAgentTrustId == s.agentTrustId ]
#web_session = [ ]
same_exploiter_completed_sessions = array.concat(cp_sessions, web_session)
# same day check
sessionDate := substring(input.session.requestTime, 0, 10)
same_day_sessions = [
s |
s := same_exploiter_completed_sessions[_]
substring(s.completeTime, 0, 10) == sessionDate
]
count(same_day_sessions) > 0
count(same_exploiter_completed_sessions) > 0
completeTimes = [ mapped |
original := same_exploiter_completed_sessions[_]
mapped := time.parse_rfc3339_ns(original["completeTime"])/ 1000000
]
most_recent = max(completeTimes)
(most_recent + authentication_timespan_minutes * 60 * 1000) > time.now_ns() / 1000000