Acceptto Authentication
Secure your workforce identity with Acceptto end-to-end risk-based multiFactor authentication.
Start by visiting the Acceptto documentation.
Support is enabled by including the following module in the overlay:
1
2
3
4
5
<dependency>
<groupId>org.apereo.cas</groupId>
<artifactId>cas-server-support-acceptto-mfa</artifactId>
<version>${cas.version}</version>
</dependency>
1
implementation "org.apereo.cas:cas-server-support-acceptto-mfa:${project.'cas.version'}"
1
2
3
4
5
6
7
8
9
dependencyManagement {
imports {
mavenBom "org.apereo.cas:cas-server-support-bom:${project.'cas.version'}"
}
}
dependencies {
implementation "org.apereo.cas:cas-server-support-acceptto-mfa"
}
The integration adds support for both multifactor authentication and QR passwordless authentication.
Integration with DBFP
The integration is able to handle the integration with DBFP and will set a cookie
named jwt
that is passed to the Acceptto API. This parameter contains a value that the server uses
to assess the risk of authentication request including browser fingerprint, IP address of user and
GPS location of the user’s browser. The server compares this data with the
history of user behavior data to detect anomalies.
Configuration
The following settings and properties are available from the CAS configuration catalog:
cas.authn.mfa.acceptto.bypass.groovy.location=
The location of the resource. Resources can be URLS, or files found either on the classpath or outside somewhere in the file system. In the event the configured resource is a Groovy script, specially if the script set to reload on changes, you may need to adjust the total number ofinotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf : fs.inotify.max_user_instances = 256 . You can check the current value via cat /proc/sys/fs/inotify/max_user_instances .
|
cas.authn.mfa.acceptto.bypass.rest.url=
The endpoint URL to contact and retrieve attributes. |
cas.authn.mfa.acceptto.registration-api-public-key.location=
The location of the resource. Resources can be URLS, or files found either on the classpath or outside somewhere in the file system. In the event the configured resource is a Groovy script, specially if the script set to reload on changes, you may need to adjust the total number ofinotify instances. On Linux, you may need to add the following line to /etc/sysctl.conf : fs.inotify.max_user_instances = 256 . You can check the current value via cat /proc/sys/fs/inotify/max_user_instances .
|
cas.authn.mfa.acceptto.api-url=https://mfa.acceptto.com/api/v9/
Base URL for API calls to authenticate, fetch channels or verify responses. |
cas.authn.mfa.acceptto.application-id=
Identifier of the application. When an organization creates an application in eGuardian dashboard this id gets generated. |
cas.authn.mfa.acceptto.authn-selection-url=https://mfa.acceptto.com/mfa/index
URL of the Acceptto instance for authn discovery. This page allows the user to choose their second-factor authentication method. Based on the policies defined by relying party user has the option of using Push Notification, Text Message, Voice Call, TOTP for replying to the authentication request. As soon as users select Accept or Decline with the push, or verifies with a one-time passcode, they will get redirected back to callback url that was passed by the relying party. |
cas.authn.mfa.acceptto.email-attribute=mail
The user attribute that collects the user's email address which the relying party wants to authenticate. |
cas.authn.mfa.acceptto.organization-id=
Organization identifier. |
cas.authn.mfa.acceptto.organization-secret=
Organization secret. |
cas.authn.mfa.acceptto.registration-api-url=https://mfa.acceptto.com/api/integration/v1/mfa/authenticate
URL to the enrollment/registration API. |
cas.authn.mfa.acceptto.secret=
Secret of the application. When an organization creates an application in eGuardian dashboard this secret gets generated. |