Restricting Access Based on Geolocation

1Kosmos lets organizations manage access using a user's geographic location, helping protect applications from malicious actors while ensuring access is granted only to legitimate users.

---

Overview

Community administrators can set a maximum distance from a user's trusted location within which login is allowed. If a user tries to log in from outside this distance, access is denied. For example, if the user's mobile location is within 100 meters of their trusted location, access is granted; otherwise it is blocked. This is set up using the rule engine, which lets you create location-based rules from data on the user's mobile device.

This feature applies only when users authenticate to their applications through QR code or push notifications.

Setting up geolocation-based restriction

Complete these prerequisites before configuring the Geo rule:

• Ensure the end user has enabled location on their mobile device.
• The user's trusted location must be stored in an AD attribute.
• Map that AD attribute to the 1Kosmos attribute trustedLocation.

Note: The expected format of the trusted location data is:

[
  {
    "lat": 40.7129,
    "lon": -74.007
  },
  {
    "lat": 39.7514,
    "lon": -105.0211
  }
]

If the AD attribute does not carry the trusted location detail in the required format, a transformation script can be added at the broker level to convert the data. Reach out to your 1Kosmos customer representative for assistance.

Configuring geolocation rules

1. Log in to your tenant as a community administrator.
2. Navigate to Authentication > Adaptive Authentication.
3. In the Add new adaptive auth journey drop-down, click Add new geo based restriction.
4. On the Geolocation Based Restriction page, configure the rule that determines whether access is granted:

   Field	Description
   Journey Name	Specify a journey name for the rule.
   Enabled	Move the slider on or off to enable or disable the rule.
   Conditions
   Mobile location and Allowed location is not within range of <x> meters	Specify the maximum allowed distance between the user's mobile location and their allowed location. If the distance exceeds this range, access is denied.
   + Add another	Add a new row to specify a condition such as User(s), Groups, and so on.

5. Click Save.

If a user tries to access a protected application from outside the allowed distance from their trusted location(s), they receive an access-denied message.

The following table shows the scenarios in which the E_ACCESS_DENIED event is triggered when the user's mobile and browser locations differ by more than 100 meters, resulting in access denial:

Scenario	Reason	UI message	Note
The user's mobile and browser locations differ by more than <X> meters	User is not within <X>m of the allowed location	Title: "Your access has been denied." Description: "Sorry, you are not allowed to access this page. Please contact your administrator."
The user has not enabled geolocation services in the mobile app	Mobile geolocation is not enabled	Title: "Mobile Location Required." Description: "Please enable location permissions for the BlockID app on your mobile device and try again. How to do?"	Clicking How to do displays the navigation path to enable location permissions on the user's device (Android or iOS).
The user has not enabled geolocation services in the browser	Browser geolocation is not enabled	Title: "Browser's Location Required." Description: "Please enable your browser's location permissions and try again."

Event logs

The following events are triggered:

• E_LOGIN_SUCCEEDED
• E_ACCESS_DENIED

Both events capture the mobile location and the user's trusted location as part of the factSubmitted attribute.

• Mobile location refers to the latitude and longitude of the device used for authentication.
• User trusted location refers to the location configured for the user in AD.