AdminX Configuration

Journeys let you control which authentication factors are required based on who the user is or which group they belong to. By default, a new journey applies to all users.

---

How to Configure

Adaptive Auth Journeys for Linux PAM are configured in AdminX under Applications > Linux PAM > Adaptive Auth Journeys.

Creating an Authentication Journey

Click Add new adaptive auth journey, give it a name, and set it to enabled or disabled.

Conditions — define who the journey applies to:

Category	Operators
Groups	Is one of / Is not one of / Contains / Does not contain
Username	Is one of / Is not one of / Contains / Does not contain / Starts with / Does not start with / Ends with / Does not end with

Actions — define what happens when conditions are matched:

Action	Behavior
Grant Access	User is granted access without any MFA prompts. Use this only alongside LDAP PAM for service accounts — using it with 1Kosmos PAM alone allows login with just a username, which is a security risk.
Deny Access	Access is denied and the user sees: "Login failed due to max number of authentication attempts."
MFA Required	User must complete one or more of the selected factors before access is granted.

MFA Required supports the following factor options:

• Just Password

• Push Notification

• 1Kosmos App Codes

• Any OTP (mobile TOTP, email OTP, SMS OTP, phone OTP)

• SMS OTP (requires registered mobile number)

• Email OTP (requires registered email)

• Voice OTP (requires registered phone/landline)

• Password + Push Notification

• Password + 1Kosmos App Codes

• Password + Any OTP

• Password + SMS OTP

• Password + Email OTP

• Password + Voice OTP

Click Save to apply the journey.

Deleting an Authentication Journey

In the Adaptive Auth Journeys list, click the delete icon next to the journey you want to remove.