Taiala Fa'atinoga
Fai lau MFA e fetuutuunai i faʻataʻitaʻiga o gaioiga
Talaaga
Adaptive multi-factor authentication (MFA) e faʻaitiitia ai feteʻenaʻiga mo tagata faʻaoga tatau e ala i le suʻesuʻeina o tulaga lamatia o fefaʻatauaiga i masini aʻoaʻoga (ML) algorithms, ina ia vave ona siaki tagata faʻaoga i latou masani i luga o lau tulaga.
Ae, e manaʻomia le taimi e fausia ai se afi faʻalavelave mai le maoaʻe, ma o le mauaina o le saʻo a le MFA e mafai ona faia le eseesega i le va o le fausiaina o le faʻatuatuaina o tagata faatau, ma le faʻaaogaina e le tagata faʻaaogaina lau faʻavae ona e tele naua laasaga e saini ai.
Mo le malosi Adaptive MFA, Okta CIC o loʻo maua le sikoa faʻamaonia ML i fafo-o-le-pusa e fetaui ma ou manaʻoga o suʻesuʻega faʻalavelave, ina ia faʻaleleia atili le UX ma le saogalemu mo tagata faʻaoga uma e manaʻo e maua lau faʻavae.
E mafai ona e fa'aogaina lenei fa'atusatusaga o le ML ma Actions, ma fai sau lava polokalame Adaptive MFA e fo'ia ai ma'i tauaso e ono misia e le MFA, e pei o le:
- E fa'afefea ona e fa'atumauina sauniga a tagata fa'atulafonoina e aunoa ma le fa'alavelave ae poloka le felauaiga e le mana'omia?
- O le ā le taimi e talafeagai ai ona faailoa atu se vala lona lua po o le tolu?
- O le a le mea e manatu fa'avae mo le tausia o lau fa'avae saogalemu i le MFA?
I lenei pou o le a matou faʻamatalaina pe faʻafefea ona faʻaogaina Actions, ma o a Actions templates o loʻo avanoa mai le pusa ina ia mafai ai ona faʻaogaina le eleele pe a oʻo mai i le MFA faʻatinoga sili ona lelei.
I le avea ai o se vaega o la matou fa'ava'a fa'alautele, o Gaioiga o se toso-ma-pa'u pro-code/no-code logic e mafai ona e fa'avasegaina mo au lava talosaga ma tu'ufa'atasiga e amata ile Identity.
O gaioiga e mafai ai ona e faʻaopoopo le code i mea taua i le paipa faʻamaonia ma naʻo le javascript - ma le 2M + npm modules i lou tuʻuina atu.
O fa'ata'ita'iga a Actions e a'oa'oina ai oe i le fa'aogaina o le malosi o Actions, ma alu vave atu i maketi nai lo le tauvaga, fa'atalanoaina mataupu fa'aoga masani e taua mo fa'alapotopotoga i aso nei.
Fa'ata'ita'iga #1
Manaomia le lesitalaina o le MFA
O le lesitalaina o se avanoa tulaga ese e tuʻuina atu ai i tagata faʻaoga se filifiliga pe a oʻo mai i le faʻamaonia.
Fa'avae i luga ole mana'oga fa'amaoni a le tagata fa'aoga, e te fa'aitiitia fete'ena'iga mo i latou, ma fa'ae'e i luga ole va'a ma lou tulaga saogalemu.
Tatou amata i le Manaomia le lesitalaina o le MFA Fa'ata'ita'iga fa'atino.
Fa'asaga i Gaioiga > Faletusi > Fau mai le Fa'ata'ita'iga.
O le tino lenei o le mamanu:
exports.onExecutePostLogin = async (mea na tupu, api) => {
afai (!event.user.multifactor?.umi) {
api.multifactor.enable('so'o', { allowRememberBrowser: sese });
}
};
O le a le mea moni o loʻo tupu iinei: Afai e le'o iai ni fa'ailoga MFA, fa'ataga lou tagata fa'aoga e lesitala i so'o se mea e te avanoa.
O se faʻataʻitaʻiga ua naʻo le amataga - Seʻi o tatou tilotilo i le mea na tupu ma api mea:
O le mea e tutupu e tele fa'asologa eseese, lea e aofia ai fa'amatalaga e uiga i le tagata fa'aoga, e mafai ona e fa'aogaina e fa'avasega au mana'oga MFA; i le tulaga lea, o lo'o matou palotaina le fa'asologa o avanoa MFA, event.user.multifactor?.length , ma afai e leai se (!) na lesitala, fa'aauau le lesitala.
Manatunatu e mana'omia pe fa'amaoti ni 'au'aunaga eseese e ala i le mea API — mea taua e aofia ai: duo, google-authenticator, leoleo .
api.multifactor.enable(provider, options)
O filifiliga e pei ole allowRememberBrowser e fuafua pe tatau ona manatua le su'esu'ega, ina ia mafai e tagata fa'aoga ona fa'amisi MFA mulimuli ane. O le boolean lea e filifili ai, ma o le faaletonu e sese. E te mafaia suia lenei filifiliga e ala i le pulega API.
E ala i le faʻapipiʻiina, ona tosoina lea ma tuʻu i lalo lau gaioiga fou i totonu o le tafega (Gaoioiga > Fa'asolo > Ulufale) ma le filifilia Talosaga, ua mana'omia nei e au tagata fa'aoga e lesitala i le MFA:
Toe fai le la'asaga i luga i so'o se taimi e te mana'o e fa'aopoopo se Gaioiga i se fa'aoso i le paipa fa'amaonia.
Fa'afeiloa'i ma lau MFA
Fa'asaga i Saogalemu > Fa'amaoni Fa'ato'aga, ma filifili mea e te mana'o e avanoa mo au tagata fa'au'uga.
Tusi i lalo i Filifiliga Faaopoopo, ma sui le filifiliga i Fa'apitoa MFA Factors e fa'aaoga ai Gaioiga. Ole mea lea e fa'atagaina ai oe e fa'aopoopo sau lava fa'atatauga Fa'atino ma la matou atamai Adaptive MFA ML i fafo atu o le pusa.
O nisi nei o fa'amatalaga autu e mafaufau i ai e uiga i fefa'ataua'iga a le tagata fa'aoga pe a fa'ailoga e fetaui ma au tusi ta'aloga saogalemu:
- O a tulaga ou te mana'omia e la'u tagata fa'aoga e toe fa'amaonia ai?
- E fa'afefea ona taua a latou fa'amatalaga o sauniga pe a o'o mai i le fa'atinoina o se fefa'ataua'iga?
- O a fa'atapula'a faiga fa'avae fa'atasi e fa'aliliuina i faiga fa'atatau o talosaga?
Faatasi ai ma nei iloiloga i le mafaufau, seʻi o tatou savali i lea laasaga ma lea laʻasaga, pe faʻapefea ona faʻatinoina faʻataʻitaʻiga Adaptive MFA with Actions.
Fa'ata'ita'iga #2
Fa'aoso le MFA pe a ausia tulaga
O lenei fa'ata'ita'iga e fa'aogaina ai la matou Adaptive MFA fa'ailoga mata'utia/fa'atuatuaina - fa'atatau i su'esu'ega fa'aletonu, e mafai ona e taofia ai tagata fai mea leaga, ae fa'apea fo'i ona fausia se feso'ota'iga saogalemu ma au tagata fa'atau e tautua ai i latou lava ma se mea e tupu pe a maua ni amioga fou pe fa'aletonu.
I totonu o lenei fa'ata'ita'iga, newDevice o le tu'utu'uga su'esu'e lea mo fa'atonuga fa'aopoopo a le MFA; o lo'o ia te oe mea nei mea faitino su'esu'e tulaga lamatia avanoa e palota ai se sikoa mautinoa:
- Meafaigaluega Fou
- Le Mafai le Malaga
- Le faatuatuainaIP
- Numera telefoni
E mafai fo'i ona e tu'ufa'atasia su'esu'ega e fai ai se fa'ai'uga le taunuuga o le Gaioiga; mo example, afai e le mafai ona tupu malaga, e mafai poloka atoa le fefa'atauaiga a le tagata fa'aoga.
exports.onExecutePostLogin = async (mea na tupu, api) => {
// Filifili po o fea togi mautinoa e tatau ona faʻaosoina MFA, mo nisi mea
fa'amatalaga fa'asino i
// https://auth0.com/docs/secure/multi-factor-authentication/adaptivemfa/
customize-adaptive-mfa#confidence-scores
const promptConfidences = ['maualalo', 'medium'];
// Esoample tulaga: vave MFA e faʻavae i luga o le NewDevice
// tulaga faʻalagolago, o le a faʻamalosia mo le MFA pe a faʻaoga se tagata faʻaoga
in
// mai se masini e le iloa.
Const mautinoa =
mea e tutupu.fa'amaoni?.riskAssessment?.su'esu'ega?.Mava'a Fou
?.talitonuga;
const e tatauPromptMfa =
mautinoa && promptConfidences.includes(fa'atuatuaina);
// E naʻo le talafeagai le faʻamalosi mo le MFA pe a maua e le tagata faʻaoga
tasi
// enrolled MFA factor.
const canPromptMfa =
event.user.multifactor && event.user.multifactor.length > 0;
afai (shouldPromptMfa && canPromptMfa) {
api.multifactor.enable('so'o', { allowRememberBrowser: moni });
}
};
Fa'ata'ita'iga #3
Fa'aoso le MFA pe'ā sau le IP ole talosaga mai fafo o se vaega IP fa'apitoa
O lenei fa'ata'ita'iga e fa'atapula'aina le avanoa i se talosaga tu'uina atu e fa'apea, se feso'ota'iga tu'ufa'atasi, ma fa'aoga le faletusi ipaddr.js e fa'avasega ai IP, ma, i lenei tulaga, fa'aosoina se fa'asalalauga fa'alaua'itele e ala ile Guardian:
exports.onExecutePostLogin = async (mea na tupu, api) => {
const ipaddr = mana'omia('ipaddr.js');
// maua le CIDR faatuatuaina ma mautinoa e aoga
const corp_network = event.secrets.TRUSTED_CIDR;
afai (!corp_network) {
toe fo'i api.access.deny('Fa'atonu le sa'o');
}
// vase le talosaga IP mai ma faʻamautinoa e aoga
tu'u current_ip;
taumafai {
current_ip = ipaddr.parse(event.request.ip);
} pu'e (sese) {
toe faafoi api.access.deny('Talosaga le aoga');
}
// vase le CIDR ma faʻamautinoa le aoga
tu'u cidr;
taumafai {
cidr = ipaddr.parseCIDR(corp_network);
} pu'e (sese) {
toe fo'i api.access.deny('Fa'atonu le sa'o');
}
// fa'amalosia le MFA leoleo pe a le o iai le IP ile vaega fa'atuatuaina
afai (!current_ip.match(cidr)) {
api.multifactor.enable('leoleo', { allowRememberBrowser: sese });
}
};
Fa'ata'ita'iga #4
Manaomia le MFA tasi ile vasega
O lenei mamanu e fai se mea e ese teisi mai isi.
Nai lo le taofia o tagata faʻaoga, o lenei faʻatulagaga e fesoasoani ia te oe e ausia fa'amaoni le leoa, lea e lagolagoina ai se tagata fa'aoga e alu i le latou sauniga mai la latou su'esu'ega masani e tu'ia ai eleele e aunoa ma le fa'amalosia mo le MFA.
exports.onExecutePostLogin = async (mea na tupu, api) => {
// pe afai o le faʻasologa o metotia faʻamaonia e aoga ma o loʻo i ai se
metotia ua faaigoaina 'mfa', mfa ua uma ona faia i lenei vasega
afai (
!event.authentication ||
!Array.isArray(event.authentication.methods) ||
!event.authentication.methods.find((metotia) => method.name === 'mfa')
) {
api.multifactor.enable('so'o');
}
};
Aotelega
O a matou fa'ata'ita'iga na aofia ai le fa'amalosia o le MFA i le resitalaina, i fafo atu o se feso'ota'iga tu'ufa'atasi, i vasega ta'itasi, ma le amataga o le fa'atinoina o le MFA.
O nei faʻataʻitaʻiga uma e faʻamalosia pe faʻafefea ona faʻaogaina a matou Universal Login i tulaga faʻamaonia eseese, o lona uiga e mafai ona e tuʻuina le UX ia i matou.
Fa'atasi ai ma Actions, e mafai ona e fa'atupuina atoa le fa'agasologa o le puipuiga e fa'afetaui i tulaga fa'aoga saogalemu a lau fa'alapotopotoga, ma fa'ate'aina fo'i fe'ese'esea'iga mo tagata fa'aoga tatau e maualuga i le fua fa'atatau.
E uiga ia Okta
Okta o le Kamupani Fa'asinomaga a le Lalolagi. I le avea ai ma paaga taʻutaʻua Tutoʻatasi, matou te faʻasaʻoloto tagata uma e faʻaoga saogalemu soʻo se tekinolosi - i soʻo se mea, i luga o soʻo se masini poʻo se app. O fa'ailoga sili ona fa'atuatuaina o lo'o fa'atuatuaina Okta ina ia mafai ai ona fa'amautu le avanoa, fa'amaoni, ma le masini. Faatasi ai ma le fetuutuunai ma le le faaituau i le totonugalemu o la tatou Okta Workforce Identity and Customer Identity Clouds, e mafai e taitai pisinisi ma tagata atiae ona taulai atu i mea fou ma faatelevave suiga numera, faafetai i fofo masani ma sili atu i le 7,000 faʻapipiʻi muamua. O lo'o matou fausia se lalolagi e iai le Fa'asinomaga mo oe. A'oa'o atili ile okta.com.
Auth0 ose fa'avae tekonolosi a Okta ma lana fa'ailoga oloa - Okta Customer Identity Cloud. E mafai e tagata atiaʻe ona aʻoaʻo atili ma fai se teugatupe e leai se totogi i Auth0.com.
Pepa / Punaoa
 |
okta Adaptive Multi Factor Authentication App [pdf] Taiala mo Tagata Fa'aoga Adaptive Multi Factor Authentication, Adaptive Multi Factor Authentication App, App |
