Configure Adapters

An adapter provides notifications of defined audit and process events.

Create an Adapter

1. Log on to the ActivID Management Console as an ActivID Administrator.
2. Select the Configuration tab and, under Environment, select Adapters.



All existing adapters are listed in a paged table. The total number of adapters is given in the lower left corner.

Each row corresponds to an adapter. It provides the following information in the different columns:

• Name – the name of the adapter.
• Type – supported values are Process and Audit. A type is a group of categories.
• Category – the category of the adapter depends on the type, and determines the list of parameters to configure.
• Description – a user-friendly description of the adapter.
3. Click Add.



4. Enter the main information for the adapter:
   • Name – mandatory and should be unique for ease of administration.
   • Description – a user-friendly description of the adapter (optional).
5. Select the Adapter Type:
   • Process – to send notifications of operational events (such as user validations).
   • Audit – to send notifications of audit events (such as device registrations).
Note: If the Adapter Category list is empty, then Adapter Type option is not available.
6. Select the Adapter Category to define of the adapter.

   The available categories depend on the selected Adapter Type.

   Adapter Type	Categories
   Process	CIBA HTTP callback process adapter JWT Session Process Adapter Mobile Action or Logon validation Notification adapter OpenID client (organization) configuration
   Audit	Device registration feedback Adapter

7. Define the Parameters for the adapter.

Note: The available parameters depend on the selected Adapter Category. The list can also be empty.

Device registration feedback Adapter

This adapter defines the audit event generated at final step of device registration.

Note: This is only available for the Audit adapter type.

Setting	Description
Event id of audit events which trigger feedback	ID of the event that triggers the device registration feedback By default, this is updateDeviceIssuanceRequest
Specific parameter name of audit event of given event id	The parameter of the audit event that triggers the device registration feedback By default, this is STP
Value of specified parameter which triggers feedback	The value of the parameter of the audit event that triggers the device registration feedback By default, this is setDeviceStatus
JMS Topic name to post the notification	The identifier of the JMS topic name used for your application By default, this is ActivIDAuthPortal

CIBA HTTP callback process Adapter

This adapter is triggered when operation is approved or denied on a mobile device in a push-based authentication deployment.

This adapter retrieves the CIBA callback URL from the attribute (ATR_CIBACB) of the direct user that initiated the operation (usually, spl-api).

It then forwards the result of the approval and the callback URL to the CIBA delivery adapter.

For further information, see Enable Validation Feedback using CIBA Notifications.

Setting	Description
Authentication policies codes that will trigger a notification	List of the authentication polices (separated by the | character but no spaces) that will trigger notifications for push-based operations By default, this is AT_TDS|AT_PASA
Attribute code for push-based authentication CIBA callback URL	Attribute of the direct user that initiated the operation (usually, spl-api) By default, this is ATR_CIBACB

JWT Session Process Adapter

This adapter is used to configure security domain federation.

Setting	Description
Code of the User group to use to authorize the user Required	Code of the User Group defined for the administrator external users
Code of the authentication policy to use to authorize the user Required	Code of the Authentication Policy defined for the administrator external users
Certificate to validate the JSON Web Token (PEM without CRLF characters)	Contents of the IDP signing certificate (without the CRLF characters)
JSON Web Token issuer Required	The issuer value based on the IDP_HOSTNAME and IDP_HTTPS_PORT properties from <ACTIVID_HOME>/ActivID_AS/applications/resources/common/activid.properties file in the format: https://<IDP public FQN>:<IDP public port (if not SSL standard port)>/idp/<Issuer domain>/authn/token

Mobile Action or Logon validation feedback Adapter

This adapter is used to send feedback using JMS (Java Message Service) notifications in a push-based authentication deployment.

For further information, see Enable Validation Feedback using JMS Notifications.

Setting	Description
Authentication policies codes that will trigger a notification	List of the authentication polices (separated by the | character but no spaces) that will trigger notifications for push-based operations By default, this is AT_TDS|AT_PASA
Message timeout (in milliseconds) Required	Number of seconds for which the message is valid By default, this is - 3600000

OpenID client (organization) configuration

This adapter is also used to configure OpenID clients (such as registration. requests and security domain federation).

For further information, see Deploying the ActivID Push-Based Validation Solution and Getting Started with the ActivID AS OpenID API.

Setting	Description
Code of the Channel through which the client authenticates Required	Code of the Channel used by your application By default, this is CH_DIRECT
Code of the password-based authentication policy to use to authenticate the client	Code of the password Authentication Policy for end users according to the User Group configuration used by your application By default, this is AT_SYSLOG
Code of the PKI-based authentication policy to use to authenticate the client	Code of the PKI Authentication Policy for end users according to the User Group configuration used by your application By default, this is AT_SYSPKI
Code of the channel through which an end user of the client authenticates	Code of the Channel for end users according to the User Group configuration used by your application By default, this is CH_IIS
Type of the session transfer code	Identifier of the session transfer policy used to transfer user sessions between operators By default, this is NUM001 (10-minute expiry period, 8 digits in length).
Valid redirect URIs for the client Required	List (comma delimited) of URIs allowed for the client
Code of the default authentication policy for the end user	Code of the password Authentication Policy for end users according to the User Group configuration used by your application By default, this is AT_EMPPWD
Client scopes	The consent scope in JSON format If the field is empty, the OpenID standard scope will be applied
Prompt to end user for consent signature	If the user should be prompted for their consent By default, this is true
Client's signing certificate	The client’s signature certificate used to verify a signed request object
Client's encryption certificate	The client’s encryption certificate used to encrypt the ID Token in the token endpoint response or the UserInfo response. If empty, the response is not encrypted
userinfo encrypted response algorithm	The algorithm to encrypt the UserInfo response. The recommended algorithm is RSA-OAEP-256 If this field is empty, the response is not encrypted
Id token encrypted response algorithm	The algorithm to encrypt id_token in the token endpoint response. The recommended algorithm is RSA-OAEP-256 If this field is empty, id_token is not encrypted
Access Token Permitted audiences	The valid audiences for domain federation (using a regular expression based on the syntax format described in https://docs.oracle.com/javase/8/docs/api/java/util/regex/Pattern.html) If left empty, the audience is validated against the list of local domains (defined in the SECURITY_DOMAINS property in <ACTIVID_HOME>/ActivID_AS/applications/resources/common/activid.properties) or the client id (as the value of "aud" in a non-JWT response)
End user public roles filter	Filters the roles (using a regular expression) that will be sent to the federated Managed Domains as part of the JWT access token. For example, enter SIS_.* to publish roles such as SIS_USERADM and SIS_DEVADM By default, this is .*
End user Federation Id attribute type	The attribute type created previously to publish dedicated identities per Oauth2 client application If this field is left empty, federation will not be enabled for the Oauth2 client application
Token EndPoint Authentication Method	The required OpenID client authentication method: For public clients, enter none For confidential clients, the supported authentication methods are client_secret_basic, client_secret_post, private_key_jwt and client_secret_pki
Refresh Token validity (in seconds)	The lifetime of a refresh token in seconds If it is not configured (left empty), the default value (of the Session transfer Type) is used By default, this is 3600 seconds
Use legacy plain format in CIBA callback messages	Defines if the ID Token will be signed (or signed/encrypted) in the CIBA response Possible values: true (default) - the ID Token will NOT be signed (or signed/encrypted) in the CIBA response and will use the plain format false - the ID Token will be signed (or signed/encrypted) in the CIBA response and will use the updated format that complies with the CIBA specifications To keep the previous behavior, set the parameter to true Optionally, you can also configure the OpenID client for ID Token encryption using the following parameters: Client's encryption certificate ID Token encrypted response algorithm See also Configure Feedback for External Applications.

8. Click the Channels tab to bind the adapter to the required channel(s):



1. Select the adapter position:
   • Pre-authentication
   • Post-authentication
Note: An adapter can only be activated at a unique position in the authentication flow. That is, a given adapter cannot be applied pre-authentication for a channel and post-authentication for another channel.
2. Drag and drop or use the arrows to move the required channels to the Activate on channel list.
Note: If you change the position of the adapter later, then all the bindings are updated.

9. Click Save to apply the adapter configuration.

Edit an Adapter

1. Log on to the ActivID Management Console as an ActivID Administrator.
2. Select the Configuration tab and, under Environment, select Adapters.

3. Click the Name of the adapter that you want to edit.



4. Edit the settings as required.

All the fields are accessible and all settings can be modified except the:

• Adapter Type
• Adapter Category

If you want to cancel the operation, click Back to List.

5. Click Save to apply your changes.

Copy an Adapter

1. Log on to the ActivID Management Console as an ActivID Administrator.
2. Select the Configuration tab and, under Environment, select Adapters.

3. Select the check box(es) of the adapter(s) that you want to copy and click Copy.



The new adapters are added to the list, prefixed with Copy of.

Note: The channel binding is NOT copied. You must edit the new adapters to configure the binding.
4. Edit the settings as required.

All the fields are accessible and all settings can be modified except the:

• Adapter Type
• Adapter Category

If you want to cancel the operation, click Back to List.

5. Click Save to apply your changes.

Delete an Adapter

1. Log on to the ActivID Management Console as an ActivID Administrator.
2. Select the Configuration tab and, under Environment, select Adapters.

3. Select the check box(es) of the adapter(s) that you want to delete and click Delete.



4. When prompted, click Yes.