Authentication Modules

identifier

String

YES

The identifier is the unique identifier of each Authentication module.

Identifier is case sensitive and no special characters (except - or _) are allowed.

-

name

String

YES

The Authentication module name.

The name may be different from the identifier. Specifying the name first allows to define automatically the identifier.
Must be at least 4 characters long.

-

description

String

NO

The purpose of the Authentication module.

-

configuration

-

YES

Indicates the type of authentication module.

-

kerberosDomain

String

YES

The name of the Kerberos (Active Directory) domain.

-

keyDistributionCenter

String

YES

The fully qualified domain name (FQDN) of the Kerberos (Active Directory) server.

-

principalName

String

YES

The principal name for Kerberos authentication in the following format : HTTP/<memority_tenant_hostname>@<AD_DOMAIN>

This principal name must match the one used in the keytab file created from the Active Directory server.

-

amcp.authenticationModule.<auth_module_id>.kerberos.keytab

BinarySecret

The Keytab File generated on the Active Directory by using the following command :

ktpass -princ HTTP/<memority_am_hostname>@<AD_DOMAIN_IN_UPPERCASE> -mapuser <service_account>@<AD_DOMAIN_IN_UPPERCASE> -pass <service_account_pwd> -ptype KRB5_NT_PRINCIPAL -crypto AES256-SHA1 -out C:\kerberos\<ad_domain>.keytab

Service account should have been previously created with the following characteristics :

• No specific rights

• Ucheck box “User must change  password at next logon”

• Check box “Kerberos pre-authentication is not needed”

• Check the box “Password never expires”

ldapServers

List<String>

YES

List of LDAP servers that will be used to authenticate users.

Two LDAP servers can be declared to ensure high availability if one LDAP server is down.

-

searchAttributes

List<String>

YES

List of user attributes returned by the LDAP directory and used to search for the user to be authenticated in Memority.

-

baseDn

String

YES

DN from which the user search starts.

-

bindDn

String

YES

DN of an admin user used to authenticate to the LDAP directory.

-

connectionMode

Enum

YES

Type of connection used to connect to the LDAP server.

-

retrievalAttribute

String

YES

Name of the user attribute used to perform the user search in the LDAP directory.

-

searchFilter

String

YES

Search filter used to search the user in the LDAP directory.

-

ldapServer

String

YES

Host or IP address and port of the ldap server in the following format : <host_or_IP_address:port>

IP addresses or hosts must be whitelisted in Memority side. Contact the PS team.

-

searchAttribute

String

YES

User attribute returned by the LDAP directory after performing the user search.

-

mode

Enum

YES

The authentication mode used for this authentication module.

MOBILE : user authenticates with an enrolled mobile

BROWSER_EMBEDDED : user authenticates with an enrolled browser

enablePush

Boolean

NO

If enabled, users can use push authentication sent to his enrolled mobile to authenticate.

Can only be enabled if mode is MOBILE.

true, false

myMFAAccountPolicyId

String

YES

Identifier of the MyMFA policy defining settings and application scope.

See Memority MFA Account Policies.

-

maxRegistrations

Integer

YES

Maximum number of devices a user can enroll.

1

otpLength

Integer

YES

Length of the generated OTP sent to the user (by email or sms).

4

otpLifetime

String

YES

Lifetime of the generated OTP.

1 minute

notificationId

String

YES

Identifier of the notification to be sent to the user (by email or sms).

See Notifications

-

accountMapping

ProviderAttributeMappingType

YES

Mapping between the account of the authenticated user on the provider and the user account in Memority.

-

authorizationEndpoint

String

YES

URL of the authorization endpoint at the OAuth2 Provider.

-

clientId

String

YES

Unique identifier of the OAuth2/OIDC Provider.

-

logoutEndpoint

String

NO

Logout URL of the OAuth2 Provider.

-

oidcIssuer

String

YES

Identifier of the OpenID Provider.

-

oidcProvider

Boolean

NO

Indicate if the Provider is using OAuth2 or OpenID Connect protocol.

true, false

pkceEnabled

Boolean

NO

Indicate if a code challenge and a code verifier must be sent in corresponding requests of Authorization Code grant type.

true, false

scopes

List<String>

NO

List of scopes returned by the OAuth2 Provider.

“openid” scope is automatically added when “OpenID Connect Provider” is enabled.

-

tokenEndpoint

String

YES

URL of the token endpoint at the OAuth2 Provider.

-

userInfoEndpoint

String

YES

URL of the endpoint at the OAuth2 Provider allowing to obtain claims about the authenticated user.

-

federationId

String

YES

The unique technical identifier of the federation used in Memority Service Provider URLs

This identifier should not be provided, it is generated by the system at the creation of the SAML2 Provider configuration.

-

idpEntityId

String

YES

The entity ID of the SAML Identity Provider.

-

idpSigningCertificate

String

YES

The certificate of the SAML Identity Provider used to verify the SAML response signing.

-

idpSsoUrl

String

YES

The sign-on URL of the SAML Identity Provider.

-

mappedAttribute

Enum

YES

Mapping between the account of the authenticated user on the provider and the user account in Memority.

-

nameIDFormat

Enum

YES

The Name Identifier format to use in SAML messages.

UNSPECIFIED, PERSISTENT, TRANSIENT

requestBinding

Enum

YES

The SAML binding Memority will use to communicate with the SAML Identity Provider.

REDIRECT, POST