It is possible to configure IBM Security Access Manager (ISAM) including its Advanced Access Control (AAC) module to support step-up authentication using One Time Passwords (OTPs) sent by SMS to a mobile phone (cell phone) using an SMS gateway. Here is an outline guide to the process for setting this up.
- Load the AAC activation key into the ISAM appliance where the AAC module is run. (Manage System Settings > Updates and Licensing: Licensing and Activation.)
- By default, the ISAM Advanced Access Control runtime listens only on the local loopback interface of the appliance (127.0.0.1). In order to be able to access the ISAM AAC runtime from the Reverse Proxy appliance it is therefore necessary to configure the AAC to listen on the specified interface. (Secure Access Control > Global Settings: Runtime Parameters.)
- Set the password for the EAS user. (Secure Access Control > Global Settings: User Registry.)
- Run the ISAM Auto-configuration Tool.
- Set up a certificate store for communication with SMS gateway. (Manage System Settings > Secure Settings: SSL Certificates.)
- Configure SMS gateway characteristics: on the AAC appliance LMI, go to Secure Access Control > Policy: Authentication. Click Mechanisms. The list of authentication mechanisms will be displayed. Click SMS One-time Password. Click the edit icon: the Modify Authentication Mechanism dialogue box will be displayed. Click Properties: the Modify Authentication Mechanism properties will be displayed. Set the properties correctly for the SMS gateway being used.
- Ensure that the the name of the attribute in the user’s credential which contains the user’s mobile number is ‘mobileNumber’.
- Create an access control policy which will be used to trigger step-up authentication using SMS OTP. (Secure Access Control > Policy: Access Control.)
- Attach access control policy to protected resource. (Secure Access Control > Policy: Access Control)
Vaughan
Nice Article,
I am working on a requirement which requires external users to go through username/passwd as first factor and email OTP as Second factor.
one way to identify external users is their LDAP group membership and their LDAP suffix GUID.
how can I use ISAM 9.0.03 AAC to configure this 2FA?