Authenticator Filters¶

Authenticator Filters are used to restrict the authenticators available for a client.

They can be configured to be used on Service Providers or on OAuth Client Configuration.

The base path for all authenticator-filters is the following:

/profiles/profile/settings/authentication-service/authenticator-filters/authenticator-filter

All authenticator-filters have a common base, but different types provide further settings.

The basic parameters for all authenticator-filters are as follows (see the configuration reference for the complete definition):

Parameter name	Mandatory	Description
`id`	Yes	The unique identifier of the authenticator-filter
`filter-type`	Yes	The type of the authenticator-filter. Values can be `user-agent`, `cidr` or `script-filter`.

The following sections explain how you can configure each type of authenticator-filter.

User-Agent Authenticator Filter¶

The User-Agent Authenticator Filter can be used to filter authenticators based on the Request User-Agent header.

Note

The filter-type for User-Agent authenticator filters is user-agent.

The following parameters can be configured (see the configuration reference for the complete definition):

Parameter name	Mandatory	Description
`user-agent-regex`	Yes	Regular expression to match against a Request’s User-Agent
`exclusions`	Yes	Container of authenticators to exclude
`exclusions/authenticator`	1 or more	Reference to an existing authenticator (by ID)

Example configuration:

<authenticator-filter>
    <id>curl-no-html</id>
    <user-agent xmlns="https://curity.se/ns/conf/authenticator-filters/user-agent">
        <user-agent-regex>.*curl.*</user-agent-regex>
        <exclusions>
            <authenticator>htmlSql</authenticator>
            <authenticator>htmlScimMock</authenticator>
            <authenticator>htmlLdap</authenticator>
            <authenticator>htmlFormJson</authenticator>
        </exclusions>
    </user-agent>
</authenticator-filter>

CIDR Authenticator Filter¶

Note

CIDR (Classless Inter-Domain Routing) is defined in the REF-1519 specification

The CIDR authenticator-filter allows authenticators to be restricted based on the origin of the Request.

IPV4 and IPv6 CIDRs are supported.

Caution

Only quad-dotted decimal notation is supported for IPv4 (eg. 10.77.12.11), and the standard 8-group hexadecimal notation for IPv6 addresses (may be abbreviated, eg. 0A:0B:1F:2A:82:1:55:6666, 1::FFFF:ABCD) .

Valid CIDRs include 10.77.12.11/18 and 0A:0B:1F:2A:82:1:55:6666/2, for example.

Note

The filter-type for CIDR authenticator filters is cidr.

The following parameters can be configured (see the configuration reference for the complete definition):

Parameter name	Mandatory	Description
`filter-cidr`	Yes	CIDR describing the origins to which this filter applies
`exclusions`	Yes	Container of authenticators to exclude
`exclusions/authenticator`	1 or more	Reference to an existing authenticator (by ID)

Example configuration:

<authenticator-filter>
    <id>ip-address-authenticator-filter</id>
    <cidr xmlns="https://curity.se/ns/conf/authenticator-filters/cidr">
        <filter-cidr>192.168.10.0/24</filter-cidr>
        <exclusions>
            <authenticator>htmlSql</authenticator>
            <authenticator>ping1</authenticator>
        </exclusions>
    </cidr>
</authenticator-filter>

Script Authenticator Filter¶

The Script authenticator-filter can be configured to use existing filter-procedures to perform filtering.

Important

The filter-procedure must be of type authenticator for it to be acceptable by a script-authenticator-filter.

Note

The filter-type for Script authenticator filters is script-filter.

The following parameters can be configured (see the configuration reference for the complete definition):

Parameter name	Mandatory	Description
`authenticator-filter-procedure`	Yes	Reference to an existing filter-procedure

Example configuration:

<authenticator-filters>
    <authenticator-filter>
        <id>check-header-authenticator-filter</id>
        <script-filter xmlns="https://curity.se/ns/conf/authenticator-filters/script">
            <authenticator-filter-procedure>check-header-authenticator-filter</authenticator-filter-procedure>
        </script-filter>
    </authenticator-filter>
</authenticator-filters>

Geolocation Authenticator Filter¶

The Geolocation Authenticator Filter can be configured to allow or deny specific countries to use a list of authenticators.

The filter can be configured using a list of countries in the form ISO-3166 code and which authenticators to exclude from being available for usage. For instance, for a user to be able to use an htmlSql authenticator when the request originates from Sweden, then the filter-countries parameter should be SE, as the ISO-3166 code, the apply-filter-when-match parameter should be set to true and the authenticator list should include the id htmlSql for this specific authenticator.

Parameter name	Mandatory	Description
`filter-countries`	Yes	The list of countries in form of ISO-3166 code that are allowed or denied to use the authenticators.
`apply-filter-when-match`	Yes	True to exclude an authenticator for a matching country, false otherwise.
`exclusions`	Yes	Container of authenticators to exclude.
`exclusions/authenticator`	1 or more	Reference to an existing authenticator (by ID).

Example configuration:

<authenticator-filters>
    <authenticator-filter>
        <id>geolocation-filter</id>
        <geo-country xmlns="https://curity.se/ns/conf/authenticator-filters/geo-country">
            <filter-countries>IT</filter-countries>
            <filter-countries>SE</filter-countries>
            <apply-filter-when-match>true</apply-filter-when-match>
            <exclusions>
                <authenticator>htmlSql</authenticator>
            </exclusions>
        </geo-country>
    </authenticator-filter>
</authenticator-filters>