In-Flight Enrollment for EAM (Behavior Auth + PIN)

Enable frontline workers to enroll Behavior Auth (typing pattern) and set a PIN in-flight during EAM login - passwordless second-factor authentication with no personal device required.

---

Frontline workers who are pre-authenticated by an external identity provider (for example, Entra ID) and redirected to 1Kosmos for a second factor can now enroll Behavior Auth (typing pattern) and set a PIN during login—no personal device required. Previously, a pre-authenticated user who had no enrolled second factor was denied access with no way forward. Now the user enrolls on the spot, that enrollment satisfies the authentication requirement, and the user is redirected back to the application without a separate login step.

This is aimed at frontline-worker environments where users are not allowed to carry personal devices to their workstations, so phone-dependent factors (OTP, Push, QR) are not practical.

Prerequisites

• Behavior Auth for web apps is enabled at the community level.
• An EAM OIDC application is configured for the community.
• Community Administrator access to the AdminX console.

Configure the Authentication Method

The authentication method lets the EAM OIDC application both verify enrolled users and enroll unenrolled users in-flight.

1. In AdminX, open the EAM OIDC application.
2. Open its Adaptive Auth Journey configuration.
3. Under Authentication Method, select OIDC ID Token & Behavior Auth.
4. Save the configuration.

The OIDC ID Token & Behavior Auth option only appears when Behavior Auth for web apps is enabled for the community. All existing EAM authentication methods (OTP, Push, QR Code, FIDO) remain available and unchanged.

Enrollment Flow

When a pre-authenticated user reaches the second factor without the required factors, they enroll in-flight via Setup MFA → Setup Behavior Auth. The steps adapt to what the user already has:

No factors enrolled (neither Behavior Auth nor PIN):

1. User enrolls their typing pattern - they are shown a phrase and must type it exactly.
2. User sets a PIN.
3. Access is granted and the user is redirected back to the application.

Behavior Auth enrolled, PIN not set:

1. Typing-pattern enrollment is skipped.
2. User sets a PIN.
3. Access is granted.

PIN set, Behavior Auth not enrolled:

1. User enrolls their typing pattern.
2. PIN setup is skipped.
3. Access is granted.

Enrollment counts as authentication, so the user is not asked to authenticate again after enrolling.

Authentication Flow

Once enrolled, a returning user is pre-authenticated by the external identity provider and redirected to 1Kosmos for the second factor. The user verifies their typing pattern and enters their PIN, and is redirected back to the application.

Notes and limitations

• In-flight enrollment happens only in the EAM pre-authenticated context. It is not available in non-EAM flows.
• This capability currently supports enrollment of Behavior Auth and PIN only.
• Existing EAM authentication methods (OTP, Push, QR Code, FIDO) continue to work as before.