Customize the Push Solution Behavior

Customize the Key Protection Methods

Keys provisioned on the mobile can be protected by different means. According to the security level required, users might need to enter a password or select a biometric (fingerprint/face) prior to using the keys.

These protection methods will impact how the end user uses mobile keys to:

• Validate a logon request

• Validate an action

• Generate a new Secure Code

To customize the Key Protection Method, go to the Device Type and edit the Container keys protection policy according to the following table.

Configure the Protection Method per Key

1. Log on to the ActivID Management Console as a Configuration Manager.

2. Select the Configuration tab and, under Polices, select Authentication and then Credential Types.

3. Select a push-based credential type (that is, Mobile Action Validation Credential or Mobile Logon Validation Credential).

   

1. In Credential Adapter tab, specify the Key protection policy – that is, one of the policies listed in Protection method.

Configure the Protection Method for All Keys

1. Log on to the ActivID Management Console as a Configuration Manager.

2. Select the Configuration tab and, under Polices, select Authentication and then Device Types.

3. Select the Mobile push based Validation Device type.

4. Select the Device Adapter tab.

   

5. Specify the Container keys protection policy – that is, one of the policies listed in Protection method.

6. Click Save.

Customize the Secure Code Settings

The Secure Code can be configured by editing the Credential Type. For further information, see OTP Key Parameters (Secure Code).

Secure Code Settings for One-Time Password (OTP)

Secure Code Settings for Challenge/Response

Secure Code Settings for Signature

Customize the Application Password Caching Mode

The HID Approve application allows the Service Protection to be kept in cache during the handling of the Push operations.

For the password caching policy parameters, see Key Protection Policy Parameters.

Customize the Maximum Number of Devices Allowed per User

You can restrict the number of devices a user can register (per ActivID AS domain) for the push solution.

This value can be set in the Maximum Number of Devices per user parameter of the Mobile push based Validation device type (DT_TDSV4).

• If you do not define a restriction (that is, keep the default value of -1), the user can register services on an unlimited number of devices with the HID Approve application.

• If you define a restriction, when the user reaches the maximum number of allowed devices and attempts to register a service on a new device, they will see an error message in the registration portal.

Customize the Devices Allowed for Service Registration

The HID Approve application allows defining a set of rules restricting the service registration according to the mobile platform characteristics.

You can exclude platforms from Service registration based on the following:

• Specific OS (Android or iOS)

• Specific OS version or a range of versions (by defining the maximum and minimum values)

• Specific key store mode (software or hardware)

• Specific root state (corresponding to a rooted Android phone or a jailbroken iOS phone)

When a platform is excluded, a warning is displayed during service registration on the user’s device. This warning can be customized on the server-side.

The "rules" are defined using the following JSON payload for the "provisioning" claim:

• "ruleid" – an ID to identify the rule. Several rules can be added in the JSON (for example, one per outcome).

• "phonestates" – a list of mobile platform characteristics containing of one or several of the following:

  • "os" – defines the OS platform (that is, Android or iOS)
  • "osversion" – defines the OS platform
  • "keystore" – defines the key store mode (either sw for software or hw for hardware)
  • "isRooted" – defines the rooted/jailbroken state of the device (either true or false)
  • "maxosversion" – defines the maximum value of the range of OS versions
  • "minosversion" – defines the minimum value of the range of OS versions

• "outcome" – defines the result of the rule:

  • deny - provisioning is denied for the device

• "Message" – a customizable warning message displayed to the user when the rule is applied

For Android devices only, it is also possible to define authentication rules to restrict biometric authenticators. If the rule is not defined, by default, only strong (class 3) biometric authenticators are authorized. The rules are defined using the following JSON payload for the "authentication" claim:

• "ruleid" – an ID to identify the rule

• "bioclass" – an integer value of 2 or 3 corresponding to the minimum authorized biometric class security level

• "outcome" – to define the result of the rule

  • Only allow is currently supported

For example, JSON data with two rules and one authentication rule to allow class 2 biometrics:

"rules": {
	"version": 1,
	"provisioning": [
		{
			"ruleid": 1,
			"phonestates": [
				{
					"os": "Android",
					"osversion": "6",
					"isRooted": "true"
				},
				{
					"os": "Android",
					"keystore": "sw"
				}
			],
			"outcome": "deny",
			"message": "Not allowed to provision for Android version 6 rooted phone or Android device with software key store"
		},
		{
			"ruleid": 2,
			"phonestates": [
				{
					"os": "iOS",
					"maxosversion": "10",
					"minosversion": "9"
				}
			],
			"outcome": "deny",
			"message": "Not allowed to provision for iOS version 9 to 10 "
		}
	],
	"authentication":[
		{
			"ruleid":3,
			"bioclass":2,
			"outcome":"allow"
		}
	]
}

To apply the defined rules:

1. Log on to the ActivID Management Console as a Configuration Manager.

2. Select the Configuration tab and, Under Polices, select Authentication and then Device Types.

3. Select the Mobile push based Validation Device type (DT_TDSV4).

   

4. Paste the JSON content into the Policy Rules field and save your changes.

Alternatively, you can apply the rules by adding your definitions in the policyRule parameter using the Device Type REST API.

Customize the HID Approve Windows Universal App Activation Link (URI)

For the HID Approve Windows Universal App, a URI can be used to automatically start a service registration from a web page. It can be customized as follows:

The URI must respect the following syntax:

hidglobal-approve://activate?name={AppName}&qrcode={ ActivationCode }

Where:

{AppName}

• Is part of a mandatory query

• Is the web application friendly name that will be displayed to the user (maximum of 30 characters, and can contain only letters, numbers, spaces and dashes)

• Format is percent-encoding UTF-8 based

{ ActivationCode }

• Is part of a mandatory query

• Is the activation code that will be used to register a new service for the user (maximum of 1000 characters)

• Format is base64 encoding

Customize Multiple Device Types

Multiple device types can be configured on ActivID AS to allow different branding or policy settings on a single Security Domain.

You can customize Device Types to meet your requirements, taking into consideration that:

• Each device type can use a specific Customization file (allowing a different look and feel within the same domain).
• When several device types co-exist in a domain, the registration portals must reflect the possible choices to allow registering services for one or the other.

Customize the HID Approve Activation Mode

HID Approve can be activated using one or both of the following modes that determine the available methods:

• In online mode:
  • HID Approve and ActivID AS communicate to register the service during the activation process
  • Both push-based authentication and OTP authentication are supported
  • Available methods:
    • Scan QR code
    • Enter Invite code
    • Click Activation URL (only for HID Approve for Windows 10)
• In offline mode (for example, if the device does not have an adequate internet connection):
  • HID Approve and ActivID AS do not communicate during the activation process
  • Only OTP authentication is supported
  • Users can only rename or delete a service
  • Available methods:
    • Scan QR code
    • Enter Key Secret
    • Click Activation URL (only for HID Approve for Windows 10)

By default, ActivID AS is configured for online activation only. To enable offline activation (per domain and per administration group), configure the Token Activation Settings.

You can also disable online activation for all domains by editing the ActivID Self-Service Portal settings.

See also:

Customize the HID Approve Application

Register a Device for Validation with Push

Key Protection Configuration Best Practices