Geolocation Impossible Journey Action
The Geolocation Impossible Journey Action gives the ability to an admin to configure additional measures when a user attempts to login after making an impossible journey. For example, a user is located in Sweden and uses an authenticator to login. After two hours the same user is trying to login from Singapore. If we assume that a user cannot travel with a speed higher than 250Km/h as a default value, then this journey is impossible to happen within two hours, indicating that this second attempt to login might seem suspicious.
A journey is measured between the coordinates of two authentications, so an authentication whose location cannot be resolved to coordinates reports no impossible journey, and does not replace the recorded location. Use the Allow or Deny Country, Changed Country or New Country action to act on a request whose location is unknown.
Configuration#
The configuration of the Geolocation Impossible Journey action accepts the following parameters:
| Configuration | Mandatory | Description |
|---|---|---|
| bucket | Yes | The bucket to store the location of the user. |
| impossible-journey-action-attribute-name | No | The name of the attribute that will be potentially used from a following action. Default value is requireSecondFactor. |
| impossible-journey-action-attribute-location | No | The location for the above attribute. Default value is subject-attributes. |
| speed-in-kmh-for-impossible-journey-calculations | No | The speed that can dictate if a journey is impossible (km/h). Default is 250 km/h. |
Location precision#
The geolocation database does not report where a requester is. It reports the centre of the smallest area the requester’s IP address can be attributed to, together with how large that area is — a few kilometres for a well-known city network, a whole country for an address it can say little about. Each lookup therefore describes an area, not a point. The action compares the area of the last recorded authentication with the area of the one now taking place, and measures the shortest journey consistent with both: the distance between the two centres, less the reach of each area.
This matters most for addresses that resolve no further than a country, which is typical of VPN exit nodes, mobile carrier NAT and anycast addresses. For these the database reports the centre of that country, a point every address in the country shares, so it states a country and nothing more:
- journeys within one country produce no signal when either address resolves no further than that country, because the user may not have moved at all;
- the allowance made for each of the two addresses is added together, and an address resolving no further than a country is allowed up to 2500 km. Two such addresses therefore produce no signal unless the points reported for them lie more than some 5000 km apart: a journey between continents is still reported, one between neighbouring or moderately distant countries is not;
- an address that resolves to no coordinates, or that states no accuracy for the coordinates it does resolve to, produces no signal at all.
An address that resolves to a city, or to a region within a country, is treated as a real position, and the accuracy the database reports for it is used — widened by a margin for the error the network itself contributes, which is considerable on mobile networks whatever accuracy is claimed.
An address that says less about where the user is than the previous authentication still does — allowing for the travel possible in the time since — does not replace it, and the next authentication is still measured from the previous one.
The practical consequence is that this action reports fewer journeys than the raw distance between two lookups would suggest, and that the ones it does report are those the location data actually supports. Where a stricter signal is wanted, the speed-in-kmh-for-impossible-journey-calculations setting tunes how much travel is considered plausible in the elapsed time. It cannot sharpen the cases above, though: where the two areas overlap there is no distance to explain, and no speed makes such a journey impossible.
Back-channel support#
This action can be used in back-channel authentication.