Configure Adaptive Authentication

This page covers how to set up Adaptive Authentication in the Admin Portal by creating journeys with conditions and decision actions.

---

For an overview of what Adaptive Authentication is and what you can do with it, see Adaptive Authentication.

Prerequisites

Before setting up Adaptive Authentication, ensure the following prerequisites are met:

• Active Directory (AD) and Go Broker configuration — integrate Active Directory with 1Kosmos for user authentication and access control. Ensure at least one Go Broker is available per Active Directory to facilitate seamless communication and authentication between 1Kosmos and Active Directory.
• 1Kosmos attributes & AD attribute mapping — ensure that 1Kosmos attributes include the groups attribute, and map the memberof directory attribute to the groups 1Kosmos attribute for group-based authentication.
• Enable Adaptive Authentication module — toggle on the Adaptive Authentication journey in AdminX.

Step 1: Navigate to Adaptive Authentication

1. Log in to AdminX.
2. Go to Authentication > Adaptive Authentication > Adaptive Authentication Journey.

Step 2: Create a new journey

1. On the Adaptive Authentication Journeys list page, click Add new adaptive auth journey.
2. Provide a descriptive name for the journey.
3. Enable or disable the journey as needed.

Step 3: Define conditions

Adaptive Authentication Journeys allow administrators to build authentication paths for users based on various conditions. Define a condition from the following options:

Condition	Operator	Description
Application	is one of	Select the appropriate applications for which this journey must be applied.
Groups	is one of	Specify the AD groups to which this journey has to be applied.
Groups	is not one of	Specify the AD groups to which this journey must not be applied.
IP Address	is in the range of	Specify the range of IP address to which this journey has to be applied. Format: 10.0.64.0-10.0.64.57.
IP Address	is outside the range of	Specify the range of IP address to which this journey must not be applied. Format: 10.0.64.0-10.0.64.57.
Username	is one of	Specify the list of users for whom this journey is applicable.
Username	is not one of	Specify the list of users for whom this journey is not applicable.
Domain	is one of	Specify the domain to which this journey has to be applied.
Domain	is not one of	Specify the domain to which this journey does not apply.
Machine Name	is one of	Specify the machine name to which this journey has to be applied.
Machine Name	is not one of	Specify the machine name to which this journey must not be applied.
Machine & User	is one of	Specify both the machine and the username to whom this journey has to be made applicable.
Machine ID	is one of	Specify the machine ID to which this journey has to be applied.
Machine ID	is not one of	Specify the machine ID to which this journey must not be applied.

Note: The Machine ID refers to the serial number shown on the Orion screen upon installation.

Step 4: Set decision actions

Define the outcome for each condition:

Authentication method	Description
Grant Access	Grants access when the user specifies the application for which the access is required.
Deny Access	Denies access when the user matches against a journey.
Just Password	Requires the user to provide only a password to log in.
Push Notification	Approves sign-ins via push notification sent to the 1Kosmos App.
QR Code	Scans the QR code using the 1Kosmos App.
FIDO	Allows the use of Windows Hello, Mac TouchID, or your security key to login.
1Kosmos app Codes	Requires entering the 6-digit code generated by the 1Kosmos app.
Hardware Token OTP	Provides username and requires entering a 6-digit code generated from a hardware token.
Password & any OTP	Requires providing a password and using passcodes generated through any channel.
Password & Web OTP	Requires providing a password and using passcodes generated through Email, SMS, Voice, 1Kosmos App, generated through APIs, and hardware tokens.
Password & SMS OTP	Requires providing a password and entering a code delivered to the registered phone number via text.
Password & Email OTP	Requires providing a password and entering a code delivered to the registered email address.
Password & Voice OTP	Requires providing a password and entering a code delivered to the registered phone number via voice call.
Password & Profile OTP	Requires the user to provide their password and enter the passcode from their profile.
Password & Push Notification	Requires providing the password and approving sign-ins via push notification sent to the 1Kosmos App.
Password & FIDO	Enter the password and then use your enrolled FIDO devices such as Windows Hello, Mac TouchID, or your security key, to login.
Password & 1Kosmos App Codes	Requires providing the password and entering the 6-digit code generated by the 1Kosmos app.
Password & Passcodes from Orion Agent	Requires providing the password and then enter the OTP generated by the Orion agent.
Password & Hardware OTP Codes	Allows users to enter the password and then the code generated from the hardware token.
Kerberos	Allows users to log in using an active Kerberos token.
Kerberos + Push	Requires users to authenticate with the Kerberos token first, followed by push authentication.
Kerberos + Any OTP	Lets users authenticate with the Kerberos token first, then complete the process using an OTP generated by 1Kosmos applications.

Previously, when an administrator created an adaptive authentication journey with the options "Password + MFA" and "Other MFA" such as "Password + OTP" and "FIDO", the authentication method generated two separate sets of rules for each option. As a result, users encountered two options in the first step ("FIDO" and "Password") and, after entering their password, two options again in the second step ("FIDO" and "OTP").

In the current implementation, the algorithm for creating rules has been enhanced so the rule engine now displays only the appropriate authentication methods. In the latest behavior, the user is shown two options in the first step (FIDO and Password); after entering their password, they are presented with only the OTP options, not the FIDO option.

Step 5: Adaptive authentication journey evaluation

1. If a user matches multiple journeys, all matching methods are presented.
2. If a deny-access decision is included in a matching journey, access is automatically denied.
3. All authentication policies are executed without a priority order.
4. If a user doesn't match any journey, the default authentication journey is initiated.

Step 6: Save and apply

Save the journey to apply the configuration.

Note:

• Ensure that the adaptive authentication journey is correctly configured to improve security and efficiently manage user access to resources.
• Regularly monitor the performance of your configured journeys and make necessary adjustments to optimize the authentication process.