Chapter 3. Configuring authentication in the Ansible Automation Platform

Procedure

1. From the navigation panel, select Access Management Authentication Methods.

2. Click Create authentication.

   The Create Authentication wizard is displayed, where you can follow the prompts to configure your preferred authentication method.

3. Select the authenticator type from the Authentication type list. See Configuring an authentication type for the complete list of authentication plugins available.
4. Click Next to Configure authentication details.

Procedure

1. Enter a unique Name for the authenticator. The name is required, must be unique across all authenticators, and must not be longer than 512 characters. This becomes the unique identifier generated for the authenticator.

   Note

   Changing the name does not update the unique identifier of the authenticator. For example, if you create an authenticator with the name “My Authenticator” and later change it to “My LDAP Authenticator” you will not be able to create another authenticator with the name “My Authenticator” because the unique identifier is still in use.

2. Use the Additional Authenticator Fields to send arbitrary data back to the libraries behind the authenticators. This is an advanced feature and any values provided in this field are not validated.

   Note

   Values defined in this field override the dedicated fields provided in the UI. For example, if you enter a URL in a dedicated field on this page and then add a URL entry into the Additional Authentication Fields, the URL defined in Additional Authentication Fields overrides the definition in the dedicated field.

3. Enable or disable Enabled to specify if the authenticator should be enabled or disabled. If enabled, users are able to login from the authenticator. If disabled, users will not be allowed to login from the authenticator.

4. Enable or disable Create Object to specify whether the authenticator should create teams and organizations in the system when a user logs in.

   Enabled

   Teams and organizations defined in the authenticator maps are created and the users added to them.

   Disabled

   Organizations and teams defined in the authenticator maps will not be created automatically in the system. However, if they already exist (i.e. created by a superuser), users who trigger the maps are granted access to them.

5. Enable or disable Remove Users. If enabled, any access previously granted to a user is removed when they authenticate from this source. If disabled, permissions are only added or removed from the user based on the results of this authenticator’s authenticator mappings.

   For example, assume a user has been granted the is_superuser permission in the system. And that user will log into an authenticator whose maps will not formulate an opinion as to whether or not the user should be a superuser. If Remove Users is enabled, the is_superuser permission will be removed from the user, the authenticator maps will not have an opinion as to whether it should be there or not so, after login the user will not have the is_superuser permission.

   If Remove Users is disabled, the is_superuser permission will not be removed from the user. The authenticator maps will not have an opinion as to whether it should be there or not so after login the user will have the is_superuser permission.

6. Click Next to Define authentication mapping rules and triggers.

Procedure

1. Click Add authentication mapping to see the list of available map types and select the map type you want to create. See Authenticator map types for detailed descriptions of the different map types. Choices include:

   • Allow
   • Organization
   • Team
   • Role
   • Is Superuser
2. Enter a unique rule Name to identify the rule.

3. Select a Trigger from the list. See Authenticator map triggers for more details. Choices include:

   • Always
   • Never
   • Group
   • Attribute
4. Repeat steps 1-3 to add additional triggers to the authenticator.

5. Click Next to optionally Adjust the Mapping order.

   Note

   The mapping order setting is only available if there is more than one authenticator map defined.

Procedure

1. Adjust the mapping order by dragging and dropping the mappings up or down in the list using the draggable icon.

   Note

   The mapping precedence is determined by the order in which the mappings are listed.

2. After your authenticator maps are in the correct order, click Next to Review the authentication settings.

Procedure

1. Review and verify the authentication settings.

2. Click Finish to create the authenticator.

   A notification is displayed if there are any issues with the authenticator or the map. If you encounter issues, click Back or select a wizard section from the wizard menu to go back and add missing data or correct inaccurate data.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select Local from the Authentication type list and click Next.
4. Enter a Name for this Local configuration. The configuration name is required, must be unique across all authenticators, and must not be longer than 512 characters.

5. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

6. To automatically create organizations, users, and teams upon successful login, select Create objects.
7. To enable this authentication method upon creation, select Enabled.
8. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
9. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select LDAP from the Authentication type list and click Next.
4. Enter a Name for this LDAP configuration. The configuration name is required, must be unique across all authenticators, and must not be longer than 512 characters.
5. In the LDAP Server URI field, enter or modify the list of LDAP servers to which you want to connect. This field supports multiple addresses.

6. In the LDAP Bind DN text field, enter the Distinguished Name (DN) to specify the user that the Ansible Automation Platform uses to connect to the LDAP server. For example:

   CN=josie,CN=users,DC=website,DC=com

7. In the LDAP Bind Password text field, enter the password to use for the binding user.

8. Select a group type from the LDAP Group Type list.

   Note

   The LDAP group types that are supported by the Ansible Automation Platform use the underlying django-auth-ldap library.

9. To use LDAP User DN Template as an alternative to user search, enter the name of the template. This approach is more efficient for user lookups than searching if it is usable in your organizational environment. If this setting has a value it will be used instead of the LDAP User Search setting.
10. LDAP Start TLS is disabled by default. To enable TLS when the LDAP connection is not using SSL, set the switch to On.

11. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI.

12. Enter any LDAP Connection Options to set for the LDAP connection.

13. In the LDAP Group Type Parameters field, enter the parameters required for the LDAP Group Type you previously selected to identify LDAP groups and the members that belong to those groups.

    To determine the parameters that a specific LDAP Group Type requires, refer to the django_auth_ldap documentation on the classes init parameters.

14. In the LDAP Group Search field, specify which groups should be searched and how to search them.
15. In the LDAP User Attribute Map field, enter user attributes to map LDAP fields to your Ansible Automation Platform users for example, email or first_name.
16. In the LDAP User Search field, enter where to search for users during authentication.
17. To automatically create organizations, users, and teams upon successful login, select Create objects.
18. To enable this authentication method upon creation, select Enabled.
19. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
20. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select SAML from the Authentication type list and click Next.
4. Enter a Name for this SAML configuration.
5. Enter the application-defined unique identifier used as the audience of the SAML service provider configuration in the SAML Service Provider Entity ID field. This is usually the URL for the service.
6. Include the certificate content in the SAML Service Provider Public Certificate field.
7. Include the private key content in the SAML Service Provider Private Key.
8. Enter the URL to redirect the user to for login initiation in the IdP Login URL field.
9. Enter the public cert used for secrets coming from the IdP in the IdP Public Cert field.
10. Enter the entity ID returned in the assertion in the Entity ID. .Enter user details in the Groups, User Email, Username, User Last Name, User First Name and User Permanent ID fields.
11. The SAML Assertion Consumer Service (ACS) URL field registers the service as a service provider (SP) with each identity provider (IdP) you have configured.

12. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI.

13. In the SAML Service Provider Organization Info field, provide the URL, display name, and the name of your app.

    {
      "en-US": {
        "url": "http://www.example.com",
        "displayname": "Example",
        "name": "example"
      }
    }

14. In the SAML Service Provider Technical Contact field, provide the name and email address of the technical contact for your service provider.

    {
    "givenName": "Some User",
    "emailAddress": "suser@example.com"
    }

15. In the SAML Service Provider Support Contact field, provide the name and email address of the support contact for your service provider.

    {
    "givenName": "Some User",
    "emailAddress": "suser@example.com"
    }

16. Optional: Provide extra configuration data in the SAML Service Provider extra configuration data field. This field is the equivalent to the SOCIAL_AUTH_SAML_SP_EXTRA in the API. For more information, see OneLogin’s SAML Python Toolkit to learn about the valid service provider extra (SP_EXTRA) parameters.

17. Optional: Provide security settings in the SAML Security Config field. This field is the equivalent to the SOCIAL_AUTH_SAML_SECURITY_CONFIG field in the API.

    // Indicates whether the <samlp:AuthnRequest> messages sent by this SP // will be signed. [Metadata of the SP will offer this info]
    "authnRequestsSigned": false,
    
    // Indicates a requirement for the <samlp:Response>, <samlp:LogoutRequest> // and <samlp:LogoutResponse> elements received by this SP to be signed.
    "wantMessagesSigned": false,
    
    // Indicates a requirement for the <saml:Assertion> elements received by // this SP to be signed. [Metadata of the SP will offer this info]
    "wantAssertionsSigned": false,

    For more information and additional options, see OneLogin’s SAML Python Toolkit.

18. Optional: In the SAML IDP to extra_data attribute mapping field, enter values to map IDP attributes to extra_data attributes. For more information, see advanced SAML settings.
19. To automatically create organizations, users, and teams upon successful login, select Create objects.
20. To enable this authentication method upon creation, select Enabled.
21. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
22. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select TACACS+ from the Authentication type list and click Next.
4. Enter a Name for this TACACS+ configuration.

5. Enter the following information:

   • Hostname of TACACS+ Server: Provide the hostname or IP address of the TACACS+ server with which to authenticate. If you leave this field blank, TACACS+ authentication is disabled.
   • TACACS+ Authentication Protocol: The protocol used by the TACACS+ client. The options are ascii or pap.
   • Shared secret for authenticating to TACACS+ server: The secret key for TACACS+ authentication server.
6. The TACACS+ client address sending enabled is disabled by default. To enable client address sending, select the checkbox.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

8. To automatically create organizations, users, and teams upon successful login, select Create objects.
9. To enable this authentication method upon creation, select Enabled.

10. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.

    Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select Azuread from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. Click Edit, copy and paste Microsoft’s Application (Client) ID to the OIDC Key field.

   Following instructions for registering your application with the Microsoft identity platform, supply the key (shown at one time only) to the client for authentication.

6. Copy and paste the secret key created for your Microsoft Azure AD application to the OIDC Secret field.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

8. To automatically create organizations, users, and teams upon successful login, select Create objects.
9. To enable this authentication method upon creation, select Enabled.

10. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.

    Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select Google OAuth from the Authentication type list and click Next.
4. Enter a Name for this authentication setting.

5. The Google OAuth2 Key and Google OAuth2 Secret fields are pre-populated.

   If not, use the credentials Google supplied during the web application setup process. Save these settings for use in the following steps.

6. Copy and paste Google’s Client ID into the Google OAuth2 Key field.
7. Copy and paste Google’s Client secret into the Google OAuth2 Secret field.

8. Optional: Enter information for the following fields using the tooltips provided for instructions and required format:

   • Access Token URL
   • Access Token Method
   • Authorization URL
   • Revoke Token Method
   • Revoke Token URL
   • OIDC JWT Algorithm(s)
   • OIDC JWT

9. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

10. To automatically create organizations, users, and teams upon successful login, select Create objects.
11. To enable this authentication method upon creation, select Enabled.

12. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.

    Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select Generic OIDC from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. Enter the following information:

   • OIDC Provider URL: The URL for your OIDC provider.
   • OIDC Key: The client ID from your third-party IdP.
   • OIDC Secret: The client secret from your IdP.
6. Optional: Select the HTTP method to be used when requesting an access token from the Access Token Method list. The default method is POST.

7. Optionally enter information for the following fields using the tooltips provided for instructions and required format:

   • Access Token Method - The default method is POST.
   • Access Token URL
   • Access Token Method
   • Authorization URL
   • ID Key
   • ID Token Issuer
   • JWKS URI
   • OIDC Public Key
   • Revoke Token Method - The default method is GET.
   • Revoke Token URL
   • Response Type
   • Token Endpoint Auth Method
   • Userinfo URL
   • Username Key
8. Use the Verify OIDC Provider Certificate to enable or disable the OIDC provider SSL certificate verification.
9. Use the Redirect State to enable or disable the state parameter in the redirect URI. It is recommended that this is enabled to prevent Cross Site Request Forgery (CSRF) attacks.

10. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI.

11. To automatically create organizations, users, and teams upon successful login, select Create objects.
12. To enable this authentication method upon creation, select Enabled.
13. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
14. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select Keycloak from the Authentication type list and click Next.
4. Enter a Name for this keycloak configuration. The configuration name is required, must be unique across all authenticators, and must not be longer than 512 characters.
5. Enter the location where the user’s token can be retrieved in the Keycloak Access Token URL field.
6. Optional: Enter the redirect location the user is taken to during the login flow in the Keycloak Provider URL field.
7. Enter the Client ID from your Keycloak installation in the Keycloak OIDC Key field.
8. Enter the RS256 public key provided by your Keycloak realm in the Keycloak Public Key field.
9. Enter the OIDC secret (Client Secret) from your Keycloak installation in the Keycloak OIDC Secret field.

10. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

    Note

    Values defined in this field override the dedicated fields provided in the UI.

11. To automatically create organizations, users, and teams upon successful login, select Create objects.
12. To enable this authentication method upon creation, select Enabled.
13. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
14. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select GitHub from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.

6. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

7. To automatically create organizations, users, and teams upon successful login, select Create objects.
8. To enable this authentication method upon creation, select Enabled.
9. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
10. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select GitHub organization from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. Enter the name of your GitHub organization, as used in your organization’s URL, for example, https://github.com/<yourorg>/ in the GitHub OAuth Organization Name field.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

8. Enter the authorization scope for users in the GitHub OAuth2 Scope field. The default is read:org.
9. To automatically create organizations, users, and teams upon successful login, select Create objects.
10. To enable this authentication method upon creation, select Enabled.
11. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
12. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select GitHub team from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. Copy and paste GitHub’s team ID in the GitHub OAuth2 Team ID field.
7. Enter the authorization scope for users in the GitHub OAuth2 Scope field. The default is read:org.

8. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

9. To automatically create organizations, users, and teams upon successful login, select Create objects.
10. To enable this authentication method upon creation, select Enabled.
11. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
12. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select GitHub enterprise from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. In the Base URL field, enter the hostname of the GitHub Enterprise instance, for example, https://github.example.com.
7. In the Github OAuth2 Enterprise API URL field, enter the API URL of the GitHub Enterprise instance, for example, https://github.example.com/api/v3.

8. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

9. To automatically create organizations, users, and teams upon successful login, select Create objects.
10. To enable this authentication method upon creation, select Enabled.
11. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
12. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select GitHub enterprise organization from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. In the Base URL field, enter the hostname of the GitHub Enterprise instance, for example, https://github.example.com.
7. In the Github OAuth2 Enterprise API URL field, enter the API URL of the GitHub Enterprise instance, for example, https://github.example.com/api/v3.
8. Enter the name of your GitHub Enterprise organization, as used in your organization’s URL, for example, https://github.com/<yourorg>/ in the GitHub OAuth2 Enterprise Org Name field.

9. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

10. To automatically create organizations, users, and teams upon successful login, select Create objects.
11. To enable this authentication method upon creation, select Enabled.
12. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
13. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select GitHub enterprise team from the Authentication type list and click Next.
4. Enter a Name for this authentication configuration.

5. When the application is registered, GitHub displays the Client ID and Client Secret:

   1. Copy and paste the GitHub Client ID into the GitHub OAuth2 Key field.
   2. Copy and paste the GitHub Client Secret into the GitHub OAuth2 Secret field.
6. In the Base URL field, enter the hostname of the GitHub Enterprise instance, for example, https://github.orgexample.com.
7. In the Github OAuth2 Enterprise API URL field, enter the API URL of the GitHub Enterprise instance, for example, https://github.example.com/api/v3.
8. Enter the OAuth2 key (Client ID) from your GitHub developer application in the GitHub OAuth2 team ID field.

9. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

10. To automatically create organizations, users, and teams upon successful login, select Create objects.
11. To enable this authentication method upon creation, select Enabled.
12. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
13. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. Click Create authentication.
3. Select Radius from the Authentication type list and click Next.
4. Click Create authentication.
5. Enter the host or IP of the RADIUS server in the RADIUS Server field. If you leave this field blank, RADIUS authentication is disabled.
6. Enter the Shared secret for authenticating to RADIUS server.

7. Optional: Enter any Additional Authenticator Fields that this authenticator can take. These fields are not validated and are passed directly back to the authenticator.

   Note

   Values defined in this field override the dedicated fields provided in the UI.

8. To automatically create organizations, users, and teams upon successful login, select Create objects.
9. To enable this authentication method upon creation, select Enabled.
10. To remove a user for any groups they were previously added to when they authenticate from this source, select Remove users.
11. Click Next.

Procedure

1. After configuring the authentication details for your authentication method, select Allow from the Add authentication mapping list.
2. Enter a unique rule Name to identify the rule.
3. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
4. Select Revoke to deny user access to the system when none of the trigger conditions are matched.
5. Click Next.

Procedure

1. After configuring the authentication details for your authentication type, select Organization from the Add authentication mapping list.
2. Enter a unique rule Name to identify the rule.
3. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
4. Select Revoke to deny user access to the system when none of the trigger conditions are matched.
5. Select the Organization to which matching users are added or blocked.
6. Select a Role to be applied or removed for matching users (for example, Organization Admin or Organization Member).
7. Click Next.

Procedure

1. After configuring the authentication details for your authentication type, select Team from the Add authentication mapping list.
2. Enter a unique rule Name to identify the rule.
3. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
4. Select Revoke to deny user access to the system when none of the trigger conditions are matched.
5. Select the Team and Organization to which matching users are added or blocked.
6. Select a Role to be applied or removed for matching users (for example, Team Admin or Team Member).
7. Click Next.

Procedure

1. After configuring the authentication details for your authentication type, select Team from the Add authentication mapping list.
2. Enter a unique rule Name to identify the rule.
3. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
4. Select Revoke to remove the role for the user when none of the trigger conditions are matched.
5. Select a Role to be applied or removed for matching users.
6. Click Next.

Procedure

1. After configuring the authentication details for your authentication type, select Team from the Add authentication mapping list.
2. Enter a unique rule Name to identify the rule.
3. Select a Trigger from the list. See Authenticator map triggers for more information about map triggers.
4. Select Revoke to remove the superuser role from the user when none of the trigger conditions are matched.
5. Click Next.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.

   The Authentication Methods page is displayed.

2. Click Create authentication and follow the steps for creating an authentication method in Configuring an authentication type. Otherwise, proceed to step 3.
3. From the menu bar, you can sort the list of authentication methods by using the arrows in the menu bar for Order, Name and Authentication type.
4. Click the toggles to Enable or Disable authenticators.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. In the search bar, enter an appropriate keyword for the authentication method you want to search for and click the arrow icon.
3. If you don’t find what you’re looking for, you can narrow your search. From the filter list, select Name or Authentication type depending on the search term you want to use.
4. Scroll through the list of search results and select the authenticator you want to review.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.

2. In the list view, select the authenticator name displayed in the Name column.

   The authenticator Details page is displayed.

3. From the Details page, you can review the configuration settings applied to the authenticator.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.

2. In the list view, you can either:

   1. Select the Edit icon next to authenticator you want to modify, or
   2. Select the authenticator name displayed in the Name column and click Edit authenticator from the Details page.
3. Modify the authentication details or mapping configurations as required.
4. Click Save.

Procedure

1. From the navigation panel, select Access Management Authentication Methods.
2. In the list view, select the checkbox next to the authenticator you want to delete.

3. Select Delete authentication from the ⋮ list.

   Note

   You can delete multiple authenticators by selecting the checkbox next to each authenticator you want to remove, and clicking Delete selected authentication from the ⋮ list on the menu bar.