[ { "url": "https://docs.airlock.com/iam/latest/index/1579527945304.html", "title": "Oracle as Airlock IAM database", "hits": [ "8.5.", "8.4.", "loginapp" ], "snippets": [ "hema-migration-8_6-8_7.sql Upgrades IAM 8.6 database schema for release IAM 8.7. iam-schema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator admin with password password (works with demo configuration).  Notice Comment out SET sqlblanklines on if you are using an SQL client other than Oracle SQL*Plus.  Notice For performance tuning hints, see: Performance tuning and scaling best practices JDBC connector (JDBC driver) The JDBC connector ( ojdbc*.jar ) can be downloaded from the Oracle website. Ensure", "hema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator admin with password password (works with demo configuration).  Notice Comment out SET sqlblanklines on if you are using an SQL client other than Oracle SQL*Plus.  Notice For performance tuning hints, see: Performance tuning and scaling best practices JDBC connector (JDBC driver) The JDBC connector ( ojdbc*.jar ) can be downloaded from the Oracle website. Ensure you download a version of the JDBC Connector suitable for your Oracle database. Copy t", "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs Oracle DB Oracle as Airlock IAM database This article describes using an Oracle database with the Airlock IAM database schema.  Notice The chosen data layer has to be well managed and monitored. IAM is not responsible for the operation and backup/" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413800.html", "title": "Airlock Device Token Configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Airlock Device Token Configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375362720.html", "title": "User representation: representer configuration in the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "User representation: representer configuration in the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services User representation (representer side) Application porta" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572090.html", "title": "Plugin trees", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Plugin trees Plugin trees The plugin trees on the left show an overview of all configuration items and how they relate to each other. Modules, unconnected plugins, inheritance tree There are three different types of trees that can be selected in the drop" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404668.html", "title": "Managing maintenance messages", "hits": [ "loginapp" ], "snippets": [ "ion Configuration management Authentication Interaction models Authentication methods Remember-Me Step-Up authentication Risk-based authentication Failed logins and temp locking Username transformation Maintenance messages Management Examples in the Loginapp Usage and limitations Locations User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Maintenance messages Manage" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341392321.html", "title": "Hardware token management for Airlock 2FA", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token management HW token management Hardware token management for Airlock 2FA This article shows an example of how to assign and manage Airlock 2FA hardware tokens for a user. Please refer to Token management (Airlock 2FA) for general Airlock 2FA toke" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642782502421.html", "title": "Airlock 2FA - lock user on fraud", "hits": [ "loginapp" ], "snippets": [ "n fraud Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812951.html", "title": "Gateway configuration for user consent", "hits": [ "loginapp" ], "snippets": [ "ser consent IAM configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration Gateway configuration Gateway configuration for user consent Gateway configuration for user consent The user consent application is treated as all other web applications protected by Airlock Gateway and IAM. There are no special" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1627571813233.html", "title": "Self-service flows for account linking configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Account linking persister Authentication flows for account linking Account linking self-service Self-services UI Google a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006479.html", "title": "Kerberos system user", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. AD configuration Kerberos system user Kerberos system user In a Kerberos environment, the client requests a Kerberos service ticket to authenticate against this kerberized service. With Airlock IAM Front-side Kerberos, the Loginapp is th" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1746606295132.html", "title": "DCR - Dynamic Client Registration", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP DCR DCR - Dynamic Client Registration In the OAuth 2.0 framework, the client is the application that requests access to protected resources on " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1644518953228.html", "title": "SAML Single Logout with temporary Gateway role", "hits": [ "loginapp" ], "snippets": [ "ay role Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URLs Authentication contexts SAML Single Logout with temporary Gateway role Load balancing setup Keystore generation Limitations SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-sho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960547.html", "title": "References", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. References References https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/ktpass https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/klist https://learn.microsoft.com/en-us/powershe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668114223.html", "title": "Solution overview", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Solution overview Solution overview Airlock 2FA is based on the Futurae cloud service. This makes the setup especially easy because no 3rd party 2FA solution needs to be installed or integrated. The following diagram shows how the solution works in gen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615339.html", "title": "Protected Flows", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Protected Flows Protected Flows Protected flows provide the functionality to view and change context data and to manage authentication tokens of users. In general, protected flows are all end-user flows accessible after authentication. They require special consideration bec" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710337.html", "title": "Upgrade and manage parallel installations (migration case)", "hits": [ "8.5.", "loginapp" ], "snippets": [ "stalled and managed in parallel on the same machine. This may be useful when upgrading Airlock IAM.  Info The following text is based on parallel installations of Airlock IAM 8.5 and 8.6.  Terminal box # Install version 8.5\n./airlock-iam-installer-8.5.sh\n\n# Create instances \"a\" and \"b\", enable license analytics\nsu - airlock\n\niam init -i \"a\" --analytics LICENSE_DATA\niam systemd -i \"a\"\n# Follow printed instructions to enable the service\n# Note that the systemd service directly references version 8.5. This means that instance \"a\" will continue to use version 8.5 until an explicit upgrade is performed.\ncat /home/airlock/iam/instances/a/airlock-iam-a.service\n\n# Repeat the same steps for instance \"b\"  Notice Starting with IAM 8.5, the IAM lice", "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Upgrade/manage parallel installations Upgrade and manage parallel installations (migration case) This example illustrates how Airlock IAM versions can be installed and managed in parallel on the same machine. This may be useful when upgrading Airlock IAM. Â" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328147367.html", "title": "Complex password reset flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Simple password reset Complex password reset Email link password reset Reset locked users Secret questions Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Addit" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945323.html", "title": "Username and password authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Username and password authentication Username and password authentication can be used as a simple authentication method. It is usually considered a weak authentication scheme because the credentials are static , i.e. they are the same for mul" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1662655602435.html", "title": "Unsupported SAML signature algorithms in IAM 7.6 and later", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML Unsupported SAML signature algorithms in IAM 7.6 and later Unsupported SAML signature algorithms in IAM 7.6 and later This article explains why certain unsafe signature algorithms used for SAML are no more supported in Airlock IAM 7.6 and later and what to do about it. Affect" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945483.html", "title": "Airlock Gateway and IAM configuration for NextGenPSD2", "hits": [ "loginapp" ], "snippets": [ "k API calls User consent step HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration Airlock Gateway and IAM configuration for NextGenPSD2 This document describes how to configure Airlock Gateway and Airlock IAM to use the NextGenPSD2 features. Please refer to NextGenPSD2 interaction models for details about ho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1763057535127.html", "title": "SMTP email service", "hits": [ "loginapp" ], "snippets": [ "service Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Loginapp Configuration SMTP email service SMTP email service IAM sends emails to end-users in several scenarios, including: During authentication, when email OTP is used as a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435031419.html", "title": "Transaction approval with Cronto Push", "hits": [ "loginapp" ], "snippets": [ "to Push Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504097.html", "title": "Transaction Approval Configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945258.html", "title": "Interaction models for authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Interaction models Interaction models for authentication The Airlock Secure Access Hub supports multiple interaction models for authentication . They are ways how the components involved in authentication, i.e. the browser/client, the Airlock Gateway , and Airlock IAM interact. This cha" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1660804712081.html", "title": "Example role removal", "hits": [ "loginapp" ], "snippets": [ "removal Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812969.html", "title": "Plugin features", "hits": [ "loginapp" ], "snippets": [ "n TPP authn. with NextGenPSD2 Plugin features Notification for new TPPs Configuration Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation TPP authn. with NextGenPSD2 Plugin features Plugin features  Notice The certificate referred to as \" client certificate\" in this document is the X.509 certificate involved in the SSL/TLS handshake (“mutual TLS”). In PSD2 it is a QWAC (qu" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1701201731698.html", "title": "Airlock 2FA QR code login - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615688.html", "title": "Example configuration for protected self-service flow", "hits": [ "loginapp" ], "snippets": [ "ce flow Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006399.html", "title": "Native library setup for Cronto and Digipass OTP", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Digipass OTP Native library setup Native library setup for Cronto and Digipass OTP To use OneSpan tokens (Vasco OTP or Vasco Cronto), Airlock IAM requires a native library, called Authentication Suite Server (formerly known as OneSpan Authentication Server Framewo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945446.html", "title": "Set up multiple SAML IDPs with load balancing", "hits": [ "loginapp" ], "snippets": [ "lancing Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URLs Authentication contexts SAML Single Logout with temporary Gateway role Load balancing setup Keystore generation Limitations SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-sho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816691.html", "title": "Integration with container environments (Docker, Kubernetes, Cloud)", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Integration with container environments Integration with container environments (Docker, Kubernetes, Cloud) In container orchestration environments logs are typically routed through each containers standard output (stdout). From there, a docker log driver takes over and" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504899.html", "title": "Login statistics attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins Login statistics attributes Login statistics attributes The next table shows attributes related to login statistics . They are relevant for the LDAP Connector plugin. Attribute name (examples) Usage Type LDAP Connector pl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945406.html", "title": "Flow-based authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1716384337792.html", "title": "PKCE configuration for IAM as OAuth 2.0 OIDC client", "hits": [ "loginapp" ], "snippets": [ " client Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Google as OIDC OP example HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813007.html", "title": "Authorization server access control settings", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 OAuth AS settings with remote consent Access control settings Authorization server access control settings The just OAuth 2.0 Authorization Server (AS) configured in the first step has to be listed in IAM's application settings, so I" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1637831365286.html", "title": "Remember-Me settings and configuration for the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Remember-Me settings and configuration for the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945529.html", "title": "Log message formats", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Log message formats Log message formats Airlock IAM currently supports two types of log message formats considered API. These two types will remain backward compatible across version upgrades of Airlock IAM with the following guarantees: Existing log formats will not be modified. In structur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328146940.html", "title": "Failed factor attempts in public self-services", "hits": [ "loginapp" ], "snippets": [ "ervices Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1786675736186.html", "title": "Use case - Set up a realm administration", "hits": [ "loginapp" ], "snippets": [ "tration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435033143.html", "title": "Authentication REST API", "hits": [ "loginapp" ], "snippets": [ "EST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE AWS KMS Password E2EE Separate User Identification and Password-only Authentication steps Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945336.html", "title": "Cronto authentication (OneSpan)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto authentication (OneSpan) Cronto – sometimes also referred to as Optical challenges using color 2D code, so-called cryptogram (example image below). This cryptogram can be scanned with a dedicated hardware device a smartphone app, which wi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812941.html", "title": "Gateway configuration", "hits": [ "loginapp" ], "snippets": [ "ser consent IAM configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration Gateway configuration Gateway configuration  Notice This section only describes the Airlock Gateway settings that are special for the NextGenPSD2 feature and not Gateway configuration in general. Please refer to: Airlock Gatewa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945332.html", "title": "Supported SMS providers", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods mTAN/SMS Supported SMS providers Supported SMS providers Some features - mainly MTAN authentication - require sending SMS messages via an SMS service. Airlock IAM provides a set of plugins implementing the SMS Gateway interface. This page lists the corresponding p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1781491741326.html", "title": "Configuration of realm-based access control", "hits": [ "loginapp" ], "snippets": [ "control Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413808.html", "title": "Register Device Token", "hits": [ "loginapp" ], "snippets": [ "e Token Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens Usage Configuration Usage of Device Token Initial authentication Device Token registration test Register Device Token Device Token authn. SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668119416.html", "title": "Configuring IAM Tech-Client management", "hits": [ "loginapp" ], "snippets": [ "tion Self-services Target applications OAuth and OIDC SAML API access control Solution overview Tech-Client management API access control configuration Configuring API policy service Configuring IAM Tech-Client management Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control API access control configuration Configuring IAM Tech-Client management Configuring IAM Tech-Client management Prerequisites You need to be logged in to the Airlock IAM Adminapp and be able to access the Config Editor. The IAM bundle API Access Management must be licensed. The datab" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759809553.html", "title": "Event attributes", "hits": [ "loginapp" ], "snippets": [ "tributes Event attribute examples Event subscribers Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Event attributes Event attributes Every event carries a number of attributes that document various aspects of the event. The event attributes are structured in the following categories: Event attributes Description Event object data The core information provided" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1612361354577.html", "title": "FIDO 2nd factor authentication - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication 2nd factor authn. Passwordless authn. Token migration Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me confi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404728.html", "title": "System design", "hits": [ "loginapp" ], "snippets": [ "cation Identity propagation Auditing Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation System design System design The next diagram shows the user representation system design. Virtual hosts (session domains) User representation demands that the representee's login is created in an additional session while the representer's session stays alive. This re" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816687.html", "title": "Reporting with Elasticsearch and Kibana", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Elasticsearch / Kibana reporting Reporting with Elasticsearch and Kibana Integration with Elasticsearch and Kibana (EK) is provided through a set of configuration files and scripts that prepare EK for use with Airlock Suite Reporting. You can find the complete bundle he" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1691686264422.html", "title": "Session tracking modes and configuration", "hits": [ "loginapp" ], "snippets": [ "ader-based session tracking Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Flow auth. API with Gateway sessions Session tracking Session tracking modes and configuration Session tracking for Airlock IAM sessions can be configured in Airlock Gateway via session cookies or header tokens . Cookie-based session tracking is the def" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504089.html", "title": "IAM Command-Line Interface CLI", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation IAM Command-Line Interface CLI IAM Command-Line Interface CLI The iam CLI is a command-line tool providing commands used to manage Airlock IAM instances and the IAM configuration. Run iam -h / iam --help to get general usage and help information. Run iam -h / iam -" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945490.html", "title": "HTTP request signature verification for NextGenPSD2", "hits": [ "loginapp" ], "snippets": [ "res Configuration Signature scope Other config properties TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation HTTP signature verification HTTP request signature verification for NextGenPSD2 This document describes how to use the plugin “HTTP Signature Verification Credential Extractor” (within the Loginapp's one-shot feature HTTP request authent" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615503.html", "title": "Failed login counters and account lockout configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929284434.html", "title": "Risk-based authentication in the Loginapp REST API/UI", "hits": [ "loginapp" ], "snippets": [ "Risk-based authentication in the Loginapp REST API/UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO aut" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812975.html", "title": "Scaling example", "hits": [ "loginapp" ], "snippets": [ "Configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures Scaling example STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Performance measures Scaling example Scaling example The following expected performance is based on measurements with the described hardware and configuration: Assumed hardware/OS for IAM CPU: 2x 8 Cores/16 Threads at 2.1 GHz RAM: 32 GB Disk:" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945530.html", "title": "Monitoring, health checks, and metrics", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics Monitoring, health checks, and metrics Airlock IAM supports standard tools and interfaces for monitoring. Currently, this comprises: System-level monitoring with systemd to start IAM and systemctl to check the process status. Liveness and readiness probes o" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435030324.html", "title": "Airlock 2FA configuration hints", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Configuration overview Configuration hints Airlock 2FA configuration hints This article provides background information and tips for Airlock 2FA configuration. Connection to Futurae cloud (Futurae server) Airlock 2FA is based on Futurae's authenticatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1658474115522.html", "title": "Password end-to-end encryption configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Password end-to-end encryption configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1765856940109.html", "title": "Lua and operating system dependencies", "hits": [ "loginapp" ], "snippets": [ "gs and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Lua and operating system dependencies Scriptable Step plugin Scriptable Validator plugin Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Scriptable plugins Lua and operating system dependencies Lua and operating system dependencies Lua and operating systems and CPU architectures When writing Lua scripts, external libraries are often required to provide additional functionality. Only a small number of Lua lib" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416191.html", "title": "SAML web browser SSO with HTTP artifact binding", "hits": [ "loginapp" ], "snippets": [ "uth and OIDC SAML Terms and definitions SSO with POST binding SSO with HTTP artifact binding SAML Single Logout (SLO) HTTP Proxy for artifact binding Asynchronous public key renewal Troubleshooting SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML SSO with HTTP artifact binding SAML web browser SSO with HTTP artifact binding With Artifact binding, only an Artifact issued by Airlock IAM (IDP) is transmitted through the client's web browser to the SP. The SAML Assertion itself is retrieved by the SP through a web service call directly to Ai" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945365.html", "title": "Basic access control concepts", "hits": [ "loginapp" ], "snippets": [ "M as PDP Airlock Gateway as Policy Enforcement Point Sources of roles Author. of internal services Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Access control (end-users) Basic access control concepts Basic access control concepts This tutorial introduces the Airlock IAM and Airlock Gateway access control concepts for web applications. It should answer the following questions: What user may access what application? Why may" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759834005.html", "title": "Protected self-services for end-users", "hits": [ "loginapp" ], "snippets": [ "ation management Authentication Self-services Public self-services Protected self-services Application portal User profile self-services User lockout self-service Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Protected self-services Protected self-services for end-users This article provides conceptual information about protected (require authentication and access right) self-services for end-users. Protected self-services in other chapters Some protected self-services are described in chapte" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945494.html", "title": "STET PSD2 with Airlock components", "hits": [ "loginapp" ], "snippets": [ "r config properties TPP authn. with OAuth 2 and STET Plugin features Configuration Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 STET PSD2 with Airlock components  Info This document describes how to use Airlock Gateway and IAM to protect a bank's PSD2 APIs using the STET framework. Scope of the feature The feature stores information about technical clients in the IAM database. LDAP d" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435050445.html", "title": "The Airlock 2FA app", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Solution overview Airlock 2FA app The Airlock 2FA app The Airlock 2FA app is an integral part of the Airlock 2FA solution and available for iOS and Android in the corresponding app stores. App features The table below gives an overview of features avai" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415606.html", "title": "General information on secret questions", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions General information General information on secret questions The following table summarizes other conceptual information: Topic Description Activate Secret Questions The secret questions" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1715877709935.html", "title": "PAR - Pushed Authorization Request on the AS/OP", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP PAR PAR - Pushed Authorization Request on the AS/OP Pushed Authorization Request is a standard in OAuth 2.0 and specified in RFC 9126 - OAuth 2" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1644518852689.html", "title": "Adding SAML SPs to the IDP configuration for the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Adding SAML SPs to the IDP configuration for the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URL" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1739013283163.html", "title": "Configuration CLIs", "hits": [ "8.4.", "loginapp" ], "snippets": [ "pulates the file iam-config.yaml within the specified instance. a single file : the command then manipulates the file given as an argument or writes a new file. Config CLI command overview The following table summarizes the config commands as of IAM 8.4. Use the -h option with each command for further usage information. Command Description iam config validate This CLI command checks whether the configuration in a configuration file or snippet is valid and can be activated. It performs the same validation as the Config Editor. When validating snippets, unconnected plugins are also included in the check. The CLI command allows you to specify a custom code directory to include custom code plugins in the validation process. Usage examples: Vali", "odifications Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config automation CLIs Configuration CLIs Airlock IAM provides a number of command-line tools (CLIs) for configuration management. They expose crucial configuration management functions to the command line and can be used, for example, in configuration automation pipelines or " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813005.html", "title": "General AS setup for STET", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 OAuth AS settings with remote consent Setup for STET General AS setup for STET To set up an Authorization Server suitable for STET PSD2, do the following: In the Loginapp configuration go to the OAuth 2.0/OIDC Authorization Servers " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1755485395195.html", "title": "Proof of transaction approval", "hits": [ "loginapp" ], "snippets": [ "pproval Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Customizing text elements Cronto message custom formatting Proof of transaction approval IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Transaction Approval Configuration Proof of transaction approval Proof of transaction approval Airlock IAM's Transaction Approval module lets a delegating system, such as an e-banking" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813011.html", "title": "Client Credentials grant setup", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 OAuth AS settings with remote consent Client Credentials grant setup Client Credentials grant setup To configure the Client Credentials grant to be used with PSD2, proceed as follows: Go to: Loginapp >> OAuth 2.0/OIDC Authorization S" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1646935202009.html", "title": "Using custom plugins", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Using custom plugins Using custom plugins This article explains how to use and configure custom plugins in an Airlock IAM installation.  Info This article is not about writing custom plugins. Further information can be found in the IAM Custom Development Guide. You can request" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1773337476887.html", "title": "Reliable event delivery", "hits": [ "loginapp" ], "snippets": [ "tributes Event attribute examples Event subscribers Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Reliable event delivery Reliable event delivery Multiple IAM plugins produce events that can be consumed, for example by event subscribers to notify recipients about actions such as password changes or locked user accounts. By default, events are not persisted. " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416183.html", "title": "Request flow", "hits": [ "loginapp" ], "snippets": [ " Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Request flow Configuration Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs OAuth 2 for native apps Request flow Request flow PKCE (“Pixy”, RFC7636)  Notice In this use case, the OAuth 2 client is “public” (it is the mobile app). In this case, for security reasons, always use PKCE (“Pixy”) in this use-case. See sec" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1600698367533.html", "title": "General information about Airlock IAM flows", "hits": [ "loginapp" ], "snippets": [ "REST request / response Session tracking REST API Next Step Codes Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) General information General information about Airlock IAM flows Flow design and flow visualization Flows are designed (or defined) in the configuration using the Config Editor. In addition to selecting steps and putting them in a particular order, additional flow concepts l" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1674151135521.html", "title": "Adminapp log viewer", "hits": [ "loginapp" ], "snippets": [ " viewer Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1675772874965.html", "title": "User trail logging", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation User trail logging User trail logging Airlock IAM provides IAM -instance independent logging of user activities to a database. With the standard configuration, user trails are shown in the Adminapp UI under: Users >> tab Activities All activities on a user account are shown in a list. For ex" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945355.html", "title": "HTTP Basic Auth access", "hits": [ "loginapp" ], "snippets": [ " access Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Loginapp Configuration HTTP Basic Auth access HTTP Basic Auth access Protected resources may be accessed by sending an HTTP Basic Auth header if desired. Airlock IAM does not" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960634.html", "title": "Example – User self-registration flow", "hits": [ "loginapp" ], "snippets": [ "on flow Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in after self-registration Stealth mode for self-registration Self-registration example CAPTCHAs Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp U" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495492.html", "title": "Logging parameters", "hits": [ "loginapp" ], "snippets": [ "urce configuration Logging configuration Logging parameters Log4j 2 configuration files Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Logging configuration Logging parameters Logging parameters The preferred way of changing logging settings is changing application parameters by editing the properties file instances//instance.properties or using the corresponding environment variables. To get a l" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945499.html", "title": "TPP Authentication using client certificates and OAuth 2.0 for STET", "hits": [ "loginapp" ], "snippets": [ "nature verification TPP authn. with OAuth 2 and STET Plugin features Configuration Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 TPP authn. with OAuth 2 and STET TPP Authentication using client certificates and OAuth 2.0 for STET This document describes how to use the plugin STET PSD2 Authenticator (within the Loginapp's one-shot feature HTTP request authentication (One-Shot flow) ) i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710339.html", "title": "Alternative installation arrangements", "hits": [ "8.4.", "loginapp" ], "snippets": [ "t. Example:  Terminal box ./airlock-iam-installer-8.3.sh -u airlock_a\n./airlock-iam-installer-8.3.sh -u airlock_b\n# Running \"su - airlock_a\" or \"su - airlock_b\" will both result in a shell with \"iam\" pointing to version 8.3\n\n./airlock-iam-installer-8.4.sh -u airlock_a\n# Running \"su - airlock_a\" will result in a shell with \"iam\" pointing to version 8.4 # Running \"su - airlock_b\" will result in a shell with \"iam\" pointing to version 8.4", "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Other installation arrangements Alternative installation arrangements The same user “airlock” can be used for parallel installation on a single machine. However, similar results can be achieved using different methods.  Risk Having separate users and/o" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572482.html", "title": "Authentication and authorization flows", "hits": [ "loginapp" ], "snippets": [ "n flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Voluntary password change authentication flow Additional Cronto device activation MS-OFBA configuration User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content secur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416041.html", "title": "The mTAN message provider", "hits": [ "loginapp" ], "snippets": [ "rovider Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1691686285251.html", "title": "SSI configuration hints", "hits": [ "loginapp" ], "snippets": [ "ssages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) SSI configuration hints Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Self-sovereign identities (SSI) SSI configuration hints SSI configuration hints  Risk Self-Sovereign Identities is an incubating feature . It has been implemented to support the technical standards as they have been released in Switzerland and the EU at the time of publication of the s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421887061.html", "title": "Token Exchange Use Case example", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945324.html", "title": "Token authentication via RADIUS", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Token auth via RADIUS Token authentication via RADIUS Many 3rd party token servers (e.g. OTP token servers) can be connected to Airlock IAM over the RADIUS protocol. Usually, token checks over RADIUS are used to perform the 2nd authentication step after username/p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1706097845405.html", "title": "Metrics (Prometheus, OpenMetrics)", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics Metrics Metrics (Prometheus, OpenMetrics) Airlock IAM provides a metrics endpoint that can be used for monitoring and other operational tasks. This article outlines the available metrics and how to enable and configure the metrics endpoint. Available metric" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731173.html", "title": "SSO tickets in the OAuth/OIDC context", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP SSO tickets SSO tickets in the OAuth/OIDC context This section describes SSO tickets and what they can be used for in the OAuth context. It pro" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945255.html", "title": "IAM modules and databases/directories", "hits": [ "loginapp" ], "snippets": [ "ectories Overview of interfaces Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses About Modules and DBs / directories IAM modules and databases/directories This content gives an overview of Airlock IAM  modules and the way they are typically used. Overview The following picture shows the main modules of an IAM instance.  Info Multiple instances can be created. Each instance runs " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496024.html", "title": "Comparison of configuration context and IAM instances", "hits": [ "loginapp" ], "snippets": [ "commended use cases Non-recommended use cases Config contexts vs. IAM instances External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Best practices Config contexts vs. IAM instances Comparison of configuration context and IAM instances The decision to use either configuration contexts or IAM instances is mainly driven by customer requirements and complexity considerations. The followi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415590.html", "title": "Password reset example: Using secret questions", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions Example screen flow Password reset example: Using secret questions Start self-service on the login page: Enter username: Ask the user to answer secret questions: Choose a new password: " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1706097836697.html", "title": "Adminapp UI configuration and access options", "hits": [ "loginapp" ], "snippets": [ "options Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495498.html", "title": "Logging to stdout only", "hits": [ "loginapp" ], "snippets": [ " Operation Initial configuration Configuration files Instances directory Config Editor quickstart guide Gateway - Microgateway configuration User data source configuration Logging configuration Logging parameters Log4j 2 configuration files Changing Loginapp log level Logging to stdout only Sending logs to syslog Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Logging configuration Log4j 2 configuration files Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812937.html", "title": "Remote consent protocol", "hits": [ "loginapp" ], "snippets": [ "uth 2.0 scopes Claims OAuth consent Local consent Consent management Remote consent apps Remote consent protocol ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP OAuth consent Remote consent apps Remote consent protocol Remote consent protocol The Remote Consent Protocol  is embedded in the OAuth 2.0 " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1706097844885.html", "title": "Non-interactive OIDC authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615489.html", "title": "User transformation configuration hints", "hits": [ "loginapp" ], "snippets": [ "ion hints Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Username transformation User transformation configuration hints User transformation configuration hints There are many processes in Airlock IAM (e.g. a login process) starting with a username. To maximize flexibility, username transformation can be configured separately in different pla" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1694711190919.html", "title": "Initialize follow-up authentication flow after self-service", "hits": [ "loginapp" ], "snippets": [ "service Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504901.html", "title": "Authentication method related attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins Authn. method related attributes Authentication method related attributes The next table shows attributes related to authentication methods . They are relevant for the LDAP Connector plugin. Attribute name (examples) Usag" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945329.html", "title": "Authentication methods in IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Authentication methods in IAM Airlock IAM supports many authentication methods that may be combined into authentication flows . Note that Airlock IAM also provides authentication method-related user self-services - such as token migration and token self-management" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1627907720735.html", "title": "Selection and parametrization of hash functions", "hits": [ "loginapp" ], "snippets": [ "nctions Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best practices Hash functions Selection and parametrization of hash functions Affects product Airlock IAM Configur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572476.html", "title": "Loginapp UI configuration", "hits": [ "loginapp" ], "snippets": [ "Loginapp UI configuration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Vo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142493.html", "title": "Response mocking configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation menu configuration Page settings configuration Additional and custom attributes Response mocking configuration Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945284.html", "title": "OpenAPI specification and validation", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway configuration OpenAPI specification and validation OpenAPI specification and validation This article provides the OpenAPI Specifications (OAS) in JSON format for the REST APIs of the IAM modules Loginapp , Adminapp and Transaction Appr" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142466.html", "title": "Design Kit configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation menu configuration Page settings configuration Additional and custom attributes Response mocking configuration Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496034.html", "title": "Configuration and usage", "hits": [ "loginapp" ], "snippets": [ "contexts Planning configuration contexts Configuration and usage Best practices External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Configuration and usage Configuration and usage Introduction to configuring and using configuration contexts  Info In the following, the example screenshots and texts are based on the following simple example: All clients (browsers) with the client IP i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572104.html", "title": "Sensitive configuration values (config secrets)", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Sensitive config values Sensitive configuration values (config secrets) Sensitive configuration values, such as passwords, shared secrets, and alike can be stored in three different ways: Secure External Storage: stored in an external protected key store" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929144216.html", "title": "Password management in the IAM Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1659970267910.html", "title": "Digipass OTP device activation (protected self-service)", "hits": [ "loginapp" ], "snippets": [ "ervice) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1768508196286.html", "title": "Scriptable Validator plugin", "hits": [ "loginapp" ], "snippets": [ "gs and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Lua and operating system dependencies Scriptable Step plugin Scriptable Validator plugin Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Scriptable plugins Scriptable Validator plugin Scriptable Validator plugin The Scriptable Validator plugin is used to validate user data during the user self-registration flow. It enables more complex validation logic than the default built-in validators (for example, strin" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1771040946215.html", "title": "Web content accessibility (WCAG)", "hits": [ "loginapp" ], "snippets": [ " (WCAG) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Content security policy WCAG Configurable accessibility features One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Loginapp Configuration Loginapp UI WCAG Web " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1786675736114.html", "title": "Bootstrapping a configuration in Realms mode", "hits": [ "loginapp" ], "snippets": [ "ms mode Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613465992416.html", "title": "OpenID Connect Session Management 1.0", "hits": [ "loginapp" ], "snippets": [ "ent 1.0 Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435028711.html", "title": "Usage - protected self-service flows REST API", "hits": [ "loginapp" ], "snippets": [ "EST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1629119809157.html", "title": "Public self-service flows REST APIs", "hits": [ "loginapp" ], "snippets": [ "ST APIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Simple password reset Complex password reset Email link password reset Reset locked users Secret questions Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Addit" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960543.html", "title": "Sessionless authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. Sessionless authentication Sessionless authentication Some web clients are not cookie-aware and do not send the session cookie back to Airlock Gateway . This could result in too many sessions on Airlock Gateway or the authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1674151134998.html", "title": "Airlock 2FA / Futurae FAQ", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA FAQ Airlock 2FA / Futurae FAQ End-user verification This section provides an overview of the end-user verification setting in Futurae. It answers the question of where and how this setting affects everything. The setting can be configured in the Futura" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710333.html", "title": "Upgrade Airlock IAM", "hits": [ "release notes", "loginapp" ], "snippets": [ "ntainer Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Upgrade Airlock IAM  Notice When upgrading carefully read the release notes of the corresponding release (or releases if skipping one or more versions). Especially note the section actions required when upgrading . The simplest upgrade path consists of the following steps: Install new version of Airlock IAM using the installer Perform an upgrade of the instance configuration ( iam upgrade command) Perform necessary manual upgrade steps Create new systemd service and replace previous systemd services ( iam systemd command) If Design Kit customizations are u", "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Upgrade Airlock IAM  Notice When upgrading carefully read the release notes of the corresponding release (or releases if skipping one or more versions). Especially note the section actions required when upgrading . The simplest upgrade path consists of the" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816713.html", "title": "Reporting log attribute: action_group and action", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Log message formats Structured log format Reporting attributes action_group / action Reporting log attribute: action_group and action action_group Description action authn Reports the results of authentication actions, independent of the authentication factors used during the authentication " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945331.html", "title": "mTAN/SMS authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods mTAN/SMS mTAN/SMS authentication In mTAN authentication, a one-time password (OTP, also referred to as token code ) is sent to the user's mobile phone as an SMS message. The code is then entered into an input field by the user. Authentication with mTAN can be used" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613069310345.html", "title": "FIDO token migration - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication 2nd factor authn. Passwordless authn. Token migration Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me confi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759946573.html", "title": "Technical client interceptors (custom plugin)", "hits": [ "loginapp" ], "snippets": [ "APIs Identity propagation Terms and conditions PSD2 support PSD2 implementation NextGenPSD2 implementation STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support Tech client interceptors Technical client interceptors (custom plugin) Technical clients  are REST API clients stored in the IAM database. There are several ways how technical clients are added, modified, and deleted. Examples: On-the-fly registration during PSD2 bank" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006407.html", "title": "Digipass OTP tokens in Tokens management menu (Adminapp)", "hits": [ "loginapp" ], "snippets": [ "minapp) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Digipass OTP in Users menu Digipass OTP in Tokens menu Digipass admin use-cases Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notif" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416237.html", "title": "Mismatch in CoT list definition", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML CoT list mismatch Mismatch in CoT list definition Exception (on IdP)  Example IDPSSOFederate: IDPSSOFederate.doSSOFederate: Issuer in Request is not valid.\nCircleOfTrustManager: [COT] CONFIG_ERROR_RETREIVE_COT: {Circle of Trust name is invalid : /,iamcot,fedletsp,/}\nCircleOf" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1739013283099.html", "title": "Using YAML", "hits": [ "loginapp" ], "snippets": [ "odifications Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config automation Using YAML Using YAML Using YAML to configure Airlock IAM The Airlock IAM configuration can be represented in a YAML format. Even if most of the configuration is expected to be designed using the Config Editor, the YAML configuration is important for configur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1741268945173.html", "title": "Custom attributes configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes Custom attributes configuration JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Ap" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1593183841264.html", "title": "REST interaction model", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Interaction models REST (interaction model) REST interaction model The REST interaction model is based on Loginapp REST API and suitable REST clients such as mobile applications. This interaction model requires that the REST client knows how to react to responses of the REST API.  Noti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435025512.html", "title": "Passcode authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors Passcode authentication Passcode authentication This article explains on a conceptual level how Airlock 2FA passcode authentication works. It also provides some detailed information on correct use and configuration. Goal Understa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233447178.html", "title": "Configure health checks for Airlock IAM", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway configuration Health checks for Airlock IAM Configure health checks for Airlock IAM Airlock Gateway can be configured to check the health status of IAM instances (using the /health/ready endpoint) to prevent requests from the Gateway t" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1706097846498.html", "title": "Airlock 2FA usernameless QR code login - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849712554.html", "title": "Airlock 2FA One-Touch login - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328143659.html", "title": "Simple password reset flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Simple password reset Complex password reset Email link password reset Reset locked users Secret questions Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Addit" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668118933.html", "title": "Profile management", "hits": [ "loginapp" ], "snippets": [ "ement Authentication Self-services Target applications OAuth and OIDC SAML API access control Solution overview Tech-Client management Profile management Plan management API key management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Tech-Client management Profile management Profile management The Tech-Client profile section is used to display and manage the following Tech-Client attributes: ID The Tech-Client ID uniquely identifies the Tech-Client . It is generated by Airlock IAM when creating the Tech-Client a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572547.html", "title": "Airlock 2FA Settings plugin – global shared Airlock 2FA configuration", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Configuration overview Airlock 2FA Settings Airlock 2FA Settings plugin – global shared Airlock 2FA configuration This article describes how to configure the Airlock 2FA Settings plugin. This plugin configures the central aspects of Airlock 2FA acros" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1773337498754.html", "title": "IAM 8.7 - Release notes", "hits": [ "release notes", "loginapp" ], "snippets": [ "IAM 8.7 - Release notes Toggle navigation About Release and support Release notes Changelog Required upgrade actions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and tex", "ctions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release and support Release notes IAM 8.7 - Release notes This chapter highlights the key new features of Airlock IAM 8.7, the latest long-term support (LTS) release of IAM. The following chapters list all changes in this release , describe the required actions when upgrading from IAM 8.6 to 8.7 , and" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945496.html", "title": "Gateway configuration for STET PSD2", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Gateway configuration for STET PSD2 Gateway configuration for STET PSD2 This document describes how to configure Airlock Gateway to use the STET PSD2 features. Related documents: STET interaction models for details about how the Airlock Suite is involved in s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759947195.html", "title": "Health checks with liveness and readiness probes", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics LR(S) probes Health checks with liveness and readiness probes To monitor the health of the modules deployed in Airlock IAM instances, health check endpoints for liveness and readiness are available. The current health check implementation uses MicroProfile " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404988.html", "title": "Segregation of duties", "hits": [ "loginapp" ], "snippets": [ " duties Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Segregation of duties Segregation of users Privilege escalation p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945537.html", "title": "User representation", "hits": [ "loginapp" ], "snippets": [ "cation Identity propagation Auditing Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation User representation User Representation  allows a logged-in user to represent another user. The term to represent means that a logged-in user can gain access to another user's application as his/her representative. The representee does not have to be logged in expli" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945375.html", "title": "User lockout self-service", "hits": [ "loginapp" ], "snippets": [ "ation management Authentication Self-services Public self-services Protected self-services Application portal User profile self-services User lockout self-service Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Protected self-services User lockout self-service User lockout self-service The lockout self-service allows authenticated users to lock their user accounts. This could be for security reasons, e.g. if a user thinks that his password has been stolen or the account has been compromised. Th" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615418.html", "title": "Failed factor attempts", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Failed factor attempts Failed factor attempts Counting failed attempts on authentication factors and locking user accounts based on such counters is crucial for overall account security. The flow infrastructure counts failed attempts individually for every authentication fa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142526.html", "title": "UI customizations with JavaScript", "hits": [ "loginapp" ], "snippets": [ "aScript Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing the language switcher JS customization of additional attributes Customiz" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945264.html", "title": "Installation on a Linux host system", "hits": [ "loginapp" ], "snippets": [ " Manual installation Getting started IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Installation on Linux Installation on a Linux host system The installer works with all Linux operating systems supported by Airlock IAM . Note that the Airlock IAM installer is a self-contained application (SCA) and doesn't require additional software installation on a Linux h" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813009.html", "title": "Authorization Code Grant and remote consent setup", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 OAuth AS settings with remote consent Consent setup in Authz Code Grant Authorization Code Grant and remote consent setup To configure the Authorization Code Grant for STET, go to the authorization server settings in Loginapp >> OAut" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1644518868129.html", "title": "Using the Loginapp UI with SAML", "hits": [ "loginapp" ], "snippets": [ "Using the Loginapp UI with SAML Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Cust" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849715923.html", "title": "Airlock 2FA mobile-only (single device) authentication - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1773337454308.html", "title": "Modifications in Snippets", "hits": [ "release notes", "loginapp" ], "snippets": [ " simple changes, such as property name changes or type name changes, are automatically migrated, more complex changes may require manual adaptations to the modifications. Starting with IAM 8.5, changes to the YAML config schema are documented in the release notes. We aim to keep changes that may make manual changes necessary to a minimum. Further information and links Configuration snippets YAML format specification", "odifications Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config automation Modifications Modifications in Snippets In addition to plugins, a snippet can define a list of modifications . The list of modifications can be understood as a recipe describing how the snippet should be applied to the base configuration. Modifications are in" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415729.html", "title": "Flow selection and conditions", "hits": [ "loginapp" ], "snippets": [ "M concept) General information Step properties Flow tags and flags Selection and conditions HTTP Request Header Value Provider Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Selection and conditions Flow selection and conditions With flow selection one of several sub-flows is selected based on conditions and/or the end-users choice. In other words, it allows creating branches . The following flow diagram shows an example of an authentication fl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1694711191138.html", "title": "HTTP Request Header Value Provider", "hits": [ "loginapp" ], "snippets": [ "M concept) General information Step properties Flow tags and flags Selection and conditions HTTP Request Header Value Provider Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Selection and conditions HTTP Request Header Value Provider HTTP Request Header Value Provider The HTTP Request Header Value Provider plugin extracts a value from the header of the current request. Based on client-provided information, the injected value can be used in a se" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443458.html", "title": "Step 2 – Save current configuration", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 2 – Save current configuration Step 2 – Save current configuration Before changing the configuration, it is advisable to save the current configuration with a useful comment as a backup so that it can be easily found and restored when requi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1786675737005.html", "title": "FIDO in native mobile apps", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in native mobile apps FIDO in native mobile apps Airlock IAM supports FIDO/passkey authentication from native Android and iOS apps. This article explains how to configure this. In FIDO, a website's origin , for example https://login.example.co" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1726159375719.html", "title": "Configuring the cooldown period", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Cooldown period Configuring the cooldown period Configuring the cooldown period This article explains how to configure the cooldown period. You need to configure the following elements: The cooldown period itself. If a cooldown period is configured, al" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815333.html", "title": "Parameter replacement", "hits": [ "loginapp" ], "snippets": [ "acement Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Security best practices Third-party licenses Customizing UIs and texts MSWord report templates Parameter replacement Parameter replacement Simple variables contained in the paramet" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1739013283152.html", "title": "Configuration snippets", "hits": [ "loginapp" ], "snippets": [ "odifications Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config automation Snippets Configuration snippets A configuration snippet is a modular IAM configuration unit representing a part of a larger configuration. Snippets enable automated composition of IAM configurations by dividing them into manageable units. This article describ" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813023.html", "title": "Plugin features", "hits": [ "loginapp" ], "snippets": [ "nature verification TPP authn. with OAuth 2 and STET Plugin features Configuration Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 TPP authn. with OAuth 2 and STET Plugin features Plugin features  Notice The certificate referred to as \" client certificate\" in this document is the X.509 certificate involved in the SSL/TLS handshake (“mutual TLS”). In PSD2 it is a QWAC (qualified webs" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1720717686883.html", "title": "OAuth 2.0/OIDC client authentication", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP Client authentication OAuth 2.0/OIDC client authentication Private Key JWT is an optional client authentication method of the OIDC specificatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142513.html", "title": "IAM HTML body attributes", "hits": [ "loginapp" ], "snippets": [ "ributes Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance IAM HTML body attributes Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Customizing example (cancel button) Customization with tenant ID Customization with Resource Sets Design Kit upgrade procedure Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812939.html", "title": "Remote consent configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421888967.html", "title": "PostgreSQL as Airlock IAM database", "hits": [ "8.5.", "8.4.", "loginapp" ], "snippets": [ "hema-migration-8_6-8_7.sql Upgrades IAM 8.6 database schema for release IAM 8.7. iam-schema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator “admin” with password “password” (works with demo configuration).  Notice For performance tuning hints, see: Performance tuning and scaling best practices JDBC connector (JDBC driver) The JDBC connector postgresql-*.jar can be downloaded from the PostgreSQL driver downloads website. Make sure to download a version of the JDBC Connector suitable for your ", "hema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator “admin” with password “password” (works with demo configuration).  Notice For performance tuning hints, see: Performance tuning and scaling best practices JDBC connector (JDBC driver) The JDBC connector postgresql-*.jar can be downloaded from the PostgreSQL driver downloads website. Make sure to download a version of the JDBC Connector suitable for your PostgreSQL database. Copy the driver (JAR file) to the libs folder of the common instan", "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs PostgreSQL PostgreSQL as Airlock IAM database This page describes how to use a PostgreSQL database with the Airlock IAM database schema. In order to use Airlock IAM with this database, a JDBC connector/driver library is required.  Notice The chosen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416231.html", "title": "Host flag not set or using withouth FQDN", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML Host flag without FQDN Host flag not set or using withouth FQDN Exception:  Example 2015-06-18 17:26:12,105 DEBUG [TRC - DEFAULT - SID: 260162194708150277 - RID: 105101999724952484] | 001 FedLib: SAMLServiceManager: SAMLServiceManager: No POST to targets found 2015-06-18 17:" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849687760.html", "title": "Airlock 2FA authentication in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Airlock 2FA authentication in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch l" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1706097844822.html", "title": "Customization with Resource Sets", "hits": [ "loginapp" ], "snippets": [ "ce Sets Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Customizing example (cancel button) Customization with tenant ID Customization with Resource Sets Design Kit upgrade procedure Content security policy WCAG" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960529.html", "title": "Requirements", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. Requirements Requirements This document is based on the following versions and requirements. Older versions may also work but may lack some features or require a slightly different configuration. Component Requirement Comments Airlock Ga" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572139.html", "title": "Protected self-service REST APIs", "hits": [ "loginapp" ], "snippets": [ "ST APIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443454.html", "title": "Step 8 – Restore previous configuration", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 8 – Restore previous configuration Step 8 – Restore previous configuration Following best practice, we saved the initial configuration before activating our new custom configuration in the Config Editor. To restore this saved configuration:" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945253.html", "title": "Airlock IAM", "hits": [ "release notes", "loginapp" ], "snippets": [ " Airlock IAM, including its installation, operation and configuration. It contains numerous use cases with step-by-step instructions, diagrams illustrating flows and concepts, and graphical representations of REST API sequences. It also contains IAM release notes and support information. Target audience : System administrators, Airlock IAM configurators as well as support staff. Found errors? Please report errors found in this documentation by mail to documentation-feedback@airlock.com . When reporting errors, let us know: The full title of the referred document. What kind of problem or error you found. If possible, send us a copy or a screenshot of the affected document page. Thank you very much for your support! Your feedback is highly ap", "ectories Overview of interfaces Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses About Airlock IAM Airlock Identity and Access Management (IAM) provides authentication and identity management for web applications and services. It ensures secure, efficient access to digital resources while maintaining a smooth user experience. Airlock IAM supports multiple authentication methods , " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1721740988232.html", "title": "Example 2 - User-based IP restrictions", "hits": [ "loginapp" ], "snippets": [ "ow error handling Protected Flows Scriptable plugins Lua and operating system dependencies Scriptable Step plugin Scriptable Step - Lua scripts Scriptable Step example 1 Scriptable Step example 2 Scriptable Step example 3 Scriptable Validator plugin Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Scriptable plugins Scriptable Step plugin Scriptable Step example 2 Example 2 - User-based IP restrictions The goal of this example is to enforce user-based IP restrictions using a Scriptable Step . The solution has the following properties: The allowed IP address is stored" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1773337498565.html", "title": "IAM 8.7 - Deprecation announcement", "hits": [ "release notes", "8.5.", "loginapp" ], "snippets": [ "IAM 8.7 - Deprecation announcement Toggle navigation About Release and support Release notes Changelog Required upgrade actions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release an", "are no longer supported. Use the new URL paths: …/auth-admin/ui/app/secure/users …/auth-admin/ui/app/secure/users/jdoe 9.0 7.5 XML config format (AI-20620) The YAML config format (introduced in 8.4) is the default for new instances starting with 8.5. Support for the XML config format will be removed. The CLI to migrate from XML to YAML will also be removed. Use the last version still supporting XML config files to migrate to YAML. 9.0 8.5 MSOFBA Support (AI-20999) Support for MSOFBA (Microsoft Office form-based authentication) will be removed. 9.0 8.5 Legacy SMS Gateway Plugins (AI-21931, AI-21930, AI-21892) The following legacy SMS gateway plugins will be removed. Use an up-to-date SMS gateway plugin instead. Many gateways can be conne", "ctions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release and support Deprecation announcement IAM 8.7 - Deprecation announcement Deprecation announcement for future releases The following features have been deprecated in IAM 8.7 or earlier releases. They are planned to be removed in future releases and are still available in Airlock IAM 8.7. REST En" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813021.html", "title": "Other config properties", "hits": [ "loginapp" ], "snippets": [ "iguration Signature scope Other config properties TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 HTTP request signature verification Configuration Other config properties Other config properties Property Value Description HTTP Signature Certificate Loader HTTP Signature X.509 Certificate URL Loader Reads certificate used for signature verification from t" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945308.html", "title": "H2 as Airlock IAM database", "hits": [ "8.5.", "8.4.", "loginapp" ], "snippets": [ "hema-migration-8_6-8_7.sql Upgrades IAM 8.6 database schema for release IAM 8.7. iam-schema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator “admin” with password “password” (works with demo configuration).  Notice For performance tuning hints, see: Performance tuning and scaling best practices Database schema version The database schema includes a table named schema_metadata , which stores the schema version. Additional information may be added to this table in future releases. The schema ver", "hema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator “admin” with password “password” (works with demo configuration).  Notice For performance tuning hints, see: Performance tuning and scaling best practices Database schema version The database schema includes a table named schema_metadata , which stores the schema version. Additional information may be added to this table in future releases. The schema version information serves two purposes: Schema upgrade scripts can be made more robust by", "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs H2 H2 as Airlock IAM database This page describes how to use an H2 database with the Airlock IAM database schema. For more information on H2, refer to http://www.h2database.com .  Notice The chosen data layer has to be well managed and monitored." ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759806768.html", "title": "Target applications and services", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Target applications and services This chapter provides conceptual information about how to secure target applications and services. It explains the following aspects: How to make sure only authenticated users can access protected applications. How to define the authentication level" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416043.html", "title": "The Cronto Message Provider", "hits": [ "loginapp" ], "snippets": [ "rovider Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375362472.html", "title": "User representation: representer configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "User representation: representer configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-ser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1738063556858.html", "title": "Config automation", "hits": [ "release notes", "8.4.", "loginapp" ], "snippets": [ " Breaking changes to the configuration format and structure between minor releases are minimized (but not eliminated). Change documentation Any necessary modifications to the configuration when upgrading to an IAM minor version are documented in the release notes. Validation CLI tool  IAM provides a CLI tool to validate configurations before deployment, reducing the risk of runtime errors. The guarantees apply to the config format (YAML), plugin type names, property names, and property values.  Functional limitation Limitations: The above-mentioned commitments apply only to the YAML config format, not to the XML config format. Manual changes to code that manipulates the configuration may be required when upgrading to a minor release (e.g.", "omation is implemented using the following IAM features: Using YAML Configuration CLIs Configuration snippets Related video The following video provides in-depth explanations about the configuration automation features as introduced with Airlock IAM 8.4. New features, such as short plugin type names and modifications , are not yet covered in the video. -", "odifications Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config automation Config automation Configuration automation enables organizations to programmatically manage and deploy software configurations in a reliable and repeatable way. It helps manage complex deployments, allowing administrators to treat configuration as code and le" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233444259.html", "title": "General logging and recovery information", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs H2 Advanced configuration Logging and recovery General logging and recovery information The changes to the main data area itself are usually not written immediately, but later on to optimize disk access. If there is a power failure, the main data ar" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1768508196284.html", "title": "Scriptable Step plugin", "hits": [ "loginapp" ], "snippets": [ "ow error handling Protected Flows Scriptable plugins Lua and operating system dependencies Scriptable Step plugin Scriptable Step - Lua scripts Scriptable Step example 1 Scriptable Step example 2 Scriptable Step example 3 Scriptable Validator plugin Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Scriptable plugins Scriptable Step plugin Scriptable Step plugin Customers of Airlock IAM may face unique requirements that are difficult to address with a standardized product. The Scriptable Step plugin allows these customers to quickly and conveniently implement solution" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945296.html", "title": "Configuration activation timeout", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Configuration activation timeout Configuration activation timeout When a new configuration is activated in the Config Editor, the new configuration is written and then the Config Editor waits for feedback from the affected modules (e.g. the Loginapp, Adm" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404986.html", "title": "Role-based access control in the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Segregation of duties Segregation of users Privilege escalation p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233444263.html", "title": "Verification of import", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs H2 Advanced configuration Verification of import Verification of import If the creation of the new DB was successful (no errors during import) logon the recovered database using the H2 web console: Verification of the imported data should be checked" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006477.html", "title": "Ensure that encryption type AES 256 is allowed for Kerberos", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. AD configuration Enable AES 256 for Kerberos Ensure that encryption type AES 256 is allowed for Kerberos Go to Administrative Tools and open Group Policy Management . Edit the Default Domain Policy of the relevant domain. Navigate to Com" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945269.html", "title": "Getting started after installation", "hits": [ "loginapp" ], "snippets": [ " Manual installation Getting started IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Installation on Linux Getting started Getting started after installation  Info This page describes the next steps after a successful installation of Airlock IAM Starting and stopping IAM instances Please refer to Starting and stopping IAM for details about starting and stopp" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416163.html", "title": "Using the flow authentication API with Airlock Gateway sessions", "hits": [ "loginapp" ], "snippets": [ "ader-based session tracking Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Flow auth. API with Gateway sessions Using the flow authentication API with Airlock Gateway sessions This article describes a generic API request flow where a client's mobile application gets authenticated access to an application backend secured by Air" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341395669.html", "title": "MS-OFBA Configuration in Airlock Gateway and Airlock IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Interaction models One-shot (interaction model) MS-OFBA authentication MS-Sharepoint configuration MS-OFBA Configuration in Airlock Gateway and Airlock IAM Prerequisites SharePoint must be available as the target application. Configuration Configure SharePoint as Airlock Gateway (WAF) b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572332.html", "title": "OneSpan (Vasco) Digipass for mobile configuration", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto Push OneSpan Digipass for mobile config OneSpan (Vasco) Digipass for mobile configuration The configuration and creation of the “Digipass for Mobile” app is handled by OneSpan (Vasco) . This section only describes the configuration that" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945436.html", "title": "Terms of service (ToC)", "hits": [ "loginapp" ], "snippets": [ "tication Self-services Target applications Target application selection Access control (end-users) Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Terms and conditions Terms of service (ToC) Airlock IAM can be used as a central enforcement point for terms of service (ToC) before applications can be accessed. It provides the following features: Definition of multiple ToC texts in multiple languages. Ensure user consent to ToC" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435031113.html", "title": "Selection of authentication token and authTokenId usage", "hits": [ "loginapp" ], "snippets": [ "d usage Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945488.html", "title": "NextGenPSD2 (Berlin Group) with Airlock Secure Access Hub", "hits": [ "loginapp" ], "snippets": [ "h NextGenPSD2 Plugin features Notification for new TPPs Configuration Performance measures Scaling example STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation NextGenPSD2 (Berlin Group) with Airlock Secure Access Hub  Info This document describes how to use Airlock Gateway and IAM to protect a bank's PSD2 APIs using the NextGenPSD2 framework. Scope of the feature Airlock IAM only supports the “r" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006405.html", "title": "Digipass OTP tokens in Users management menu (Adminapp)", "hits": [ "loginapp" ], "snippets": [ "minapp) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Digipass OTP in Users menu Digipass OTP in Tokens menu Digipass admin use-cases Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notif" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504887.html", "title": "Available plugins", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins Available plugins Airlock IAM provides several LDAP plugins to connect to and extract data from the LDAP directory. This includes the following information: Password check, reset and change User information (user profile," ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415278.html", "title": "Airlock IAM as Policy Decision Point (PDP)", "hits": [ "loginapp" ], "snippets": [ "M as PDP Airlock Gateway as Policy Enforcement Point Sources of roles Author. of internal services Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Access control (end-users) Basic access control concepts Role-based AC example IAM as PDP Airlock IAM as Policy Decision Point (PDP) Airlock IAM  acts as a Policy Decision Point ​ and Policy Information Point for access control decisions. It provides the necessary information " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945461.html", "title": "Introduction to OAuth 2.0 and OIDC", "hits": [ "loginapp" ], "snippets": [ "rget applications OAuth and OIDC Introduction OAuth 2.0 grant types Usage recommendations Security best practices Terms and definitions IAM as AS/OP IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC Introduction Introduction to OAuth 2.0 and OIDC This chapter covers the basic conceptual knowledge as an introduction to OAuth 2.0/OIDC. It covers the following topics: Grant Types – overview of grant types supported by Airlock IAM. Usage recommendations – general information to con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615390.html", "title": "Flow step properties", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Step properties Flow step properties All flow steps share a common technical infrastructure and therefore they also share some common properties. The most important properties are explained in the following. Step ID Every step may define a unique step identifier - the step " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1661841843063.html", "title": "Authentication of REST requests", "hits": [ "loginapp" ], "snippets": [ "equests Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Request authentication REST call authn. with client certificates Customizing UIs and texts Security best practices Third-party licenses IAM REST APIs Request authentication Authentication of REST requests REST clients must be authenticated to access protector REST APIs in Airlock IAM. This article explains how REST clients are authenticated and where to configure this. Â" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415539.html", "title": "Unlock self-service example screen flow", "hits": [ "loginapp" ], "snippets": [ "ation Configuration management Authentication Self-services Public self-services User registration Unlock self-service Screen flow example Protected self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Public self-services Unlock self-service Screen flow example Unlock self-service example screen flow Assuming a user is locked (too many login failures) and the unlock self-service feature is turned on. Assumptions The user account is locked because of too many login failures. The unlock" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435031284.html", "title": "Transaction approval with mTAN (SMS)", "hits": [ "loginapp" ], "snippets": [ "N (SMS) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1629119835190.html", "title": "Application portal", "hits": [ "loginapp" ], "snippets": [ "ation management Authentication Self-services Public self-services Protected self-services Application portal User profile self-services User lockout self-service Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Protected self-services Application portal Application portal The application portal is a web UI in the loginapp that displays accessible applications and services to the end-user. It may be used as starting point after login and is implemented as a protected self-service. The applicatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1639690252968.html", "title": "ACR – Authentication Context Class Reference", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP ACR ACR – Authentication Context Class Reference Authentication Context Class Reference (ACR) is an OIDC concept that supports the following " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929251310.html", "title": "Use case: Propagating arbitrary non-persistent strings attributes with the Generic ID Propagator", "hits": [ "loginapp" ], "snippets": [ "pagator Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation Generic ID Propagator ID propagation with JWT Propagating non-persistent string attributes User representation (representee side) Failed logins and lockout config Temp lo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495504.html", "title": "Sensitive information", "hits": [ "loginapp" ], "snippets": [ "rmation Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best practices Sensitive information Sensitive information Airlock IAM usually deals with sensitive information su" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404706.html", "title": "User representation use cases", "hits": [ "loginapp" ], "snippets": [ " definitions Use cases System design Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation Use cases User representation use cases List of representable users Following our bank example for user representation , a customer service consultant may have to request a list of representable users from the system to choose the user he needs to represent. Providin" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945274.html", "title": "Application parameters", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Instances directory Application parameters Application parameters Application parameters are the fundamental parameters used to launch a process running Airlock IAM. For each instance, a template instance.properties is created, e.g.,  instances/auth/instance.properties . The i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816725.html", "title": "Java management extensions (JMX)", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics JMX Java management extensions (JMX) If you are interested in internal metrics like JVM or web server statistics, you can use Java Management Extensions (JMX). JMX is a Java technology for monitoring and managing devices, applications, and service-driven ne" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421874986.html", "title": "User Management Extension in the IAM Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Example: Hello World Example: Send message Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613069310907.html", "title": "Conceptual overview of simple realm administration", "hits": [ "loginapp" ], "snippets": [ "tration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Simple realm admi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1600698368517.html", "title": "Flows as Airlock IAM concept", "hits": [ "loginapp" ], "snippets": [ "ow error handling Protected Flows Scriptable plugins Lua and operating system dependencies Scriptable Step plugin Scriptable Step - Lua scripts Scriptable Step example 1 Scriptable Step example 2 Scriptable Step example 3 Scriptable Validator plugin Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Flows as Airlock IAM concept The Airlock IAM flow concept is a core concept that allows configuring workflows as a sequence of flow steps . IAM flows are mainly used for end-user interaction in the Loginapp and provide great flexibility in the design of user journeys. IAM f" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1702894079230.html", "title": "AWS KMS support for password encryption", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password AWS KMS support AWS KMS support for password encryption AWS KMS (Amazon Web Services Key Management Service) is a service Amazon provides. It can be used in IAM to: Encrypt password hashes before storing them in the user database. Password en" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1678383097806.html", "title": "Adminapp Content Security Policy (CSP)", "hits": [ "loginapp" ], "snippets": [ "y (CSP) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1715877709959.html", "title": "PAR configuration for OAuth 2.0 and OIDC authorization servers", "hits": [ "loginapp" ], "snippets": [ "servers Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413810.html", "title": "Device Token Authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens Usage Configuration Usage of Device Token Initial authentication Device Token registration test Register Device Token Device Token authn. SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710341.html", "title": "Airlock Gateway mapping upgrade", "hits": [ "loginapp" ], "snippets": [ "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Gateway mapping upgrade Airlock Gateway mapping upgrade There are several reasons why the IAM mapping(s) on Airlock Gateway may need to be updated: Use new IAM features that are not white-listed in the old Airlock Gateway mapping The mapping templates are i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759834064.html", "title": "User profile self-services", "hits": [ "loginapp" ], "snippets": [ "ation management Authentication Self-services Public self-services Protected self-services Application portal User profile self-services User lockout self-service Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Protected self-services User profile self-services User profile self-services User profile self-services allow the logged-in end-user to manage personal account data like the following (exemplary): Name Postal address Date of birth The email address Correspondence language The structure " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375368740.html", "title": "User representation - representee", "hits": [ "loginapp" ], "snippets": [ "esentee Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Voluntary password change authentication flow Additional Cronto device activation MS-OFBA configuration User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content secur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416255.html", "title": "Terms and definitions", "hits": [ "loginapp" ], "snippets": [ "rget applications OAuth and OIDC Introduction OAuth 2.0 grant types Usage recommendations Security best practices Terms and definitions IAM as AS/OP IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC Introduction Terms and definitions Terms and definitions Authenticator Attestation ID, AAID The AAID is a manufacturer-chosen identifier for the make and model of a FIDO Authenticator. Authenticators with the same ID share the same set of characteristics. The AAID must be set if the aut" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142439.html", "title": "Security aspects", "hits": [ "loginapp" ], "snippets": [ "aspects Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Security aspects Design Kit installation Using the Design Kit CLI Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Custo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1637831385759.html", "title": "Remember-Me configuration in Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945380.html", "title": "Password reset self-service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Password reset self-service If the user cannot remember the password, a new password can be chosen with this self-service. In order to do so, the user must usually provide (example): The username or alias. One of: " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006437.html", "title": "Matrix card management in the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1755485358766.html", "title": "Gateway Session Terminator Subscriber", "hits": [ "loginapp" ], "snippets": [ "hone Numbers from String Value Providers - Use case Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Event subscribers Gateway Session Terminator Subscriber Gateway Session Terminator Subscriber  Notice The Gateway Session Terminator Subscriber is only relevant when Airlock IAM is operated together with Airlock Gateway. The Gateway Session Terminator Subscribe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413593.html", "title": "Error in the second authentication factor", "hits": [ "loginapp" ], "snippets": [ " factor Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812959.html", "title": "IAM configuration for user consent step", "hits": [ "loginapp" ], "snippets": [ "k API calls User consent step HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration IAM configuration User consent step IAM configuration for user consent step The user consent application is treated as all other web applications protected by Airlock Gateway and IAM. There are no special PSD2-relevant settings." ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945326.html", "title": "Active directory password policy via LDAP", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password policies AD password policy via LDAP Active directory password policy via LDAP The following attributes are read from the AD and processed by Airlock IAM in order to apply the password policy. The attributes names are as specified in" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1593183841249.html", "title": "Limitations and security risks", "hits": [ "loginapp" ], "snippets": [ "roubleshooting Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Active Directory Limitations and security risks Limitations and security risks If MSAD is used as the sole persistency layer, without IAM database, only a limited set of features is supported in a secure manner. This is due to the fact that MSAD stores only a sing" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1606834938271.html", "title": "Terms and definitions relating to FIDO", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys Terms and definitions relating to FIDO Terms and definitions relating to FIDO Authenticator Attestation ID, AAID The AAID is a manufacturer-chosen identifier for the make and model of a FIDO Authenticator. Authenticators with the same ID share the " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945315.html", "title": "Troubleshooting", "hits": [ "loginapp" ], "snippets": [ "roubleshooting Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Active Directory Troubleshooting Troubleshooting Connection to AD fails when using SSL A failing connection to the Active Directory service can have multiple reasons: Reason 1: Firewalls blocking the request Check (for example using telnet) that a connection to Ac" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1718296884096.html", "title": "Migrating the Airlock 2FA app", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA 2FA app migration Migrating the Airlock 2FA app The Airlock 2FA solution provides a mobile app for second-factor authentication, which can be used together with a business application, such as an e-banking application. However, some Airlock customers p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341390832.html", "title": "Offline QR code authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors Offline QR code auth Use case Offline QR code authentication This article explains on a conceptual level how Airlock 2FA offline QR code authentication works. It also provides important detail information for correct use and conf" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1739468420381.html", "title": "On-failure Goto (flow concept)", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) On-failure Goto On-failure Goto (flow concept) The on-failure goto flow concept allows reacting to a flow failure by jumping to another step. A typical application of this feature is switching to an alternative authentication factor step if an external service is unavailabl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1637831383296.html", "title": "Authentication flow configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1627571813190.html", "title": "UI for account linking self-service configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Account linking persister Authentication flows for account linking Account linking self-service Self-services UI Google a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812971.html", "title": "Notify bank about new TPPs", "hits": [ "loginapp" ], "snippets": [ "n TPP authn. with NextGenPSD2 Plugin features Notification for new TPPs Configuration Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation TPP authn. with NextGenPSD2 Notification for new TPPs Notify bank about new TPPs A new technical client is added to IAM's technical client database “on-the-fly”, i.e. during API request authentication if it is not yet known to IAM. To inf" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443450.html", "title": "Step 6 – Creating a new plugin configuration", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 6 – Creating a new plugin configuration Step 6 – Creating a new plugin configuration Next, we show how to add a completely new configuration for a plugin by adding a new Password Generator plugin configuration. Go to: MAIN SETTINGS >> Passw" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1657822573988.html", "title": "MS-OFBA configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Voluntary password change authentication flow Additional Cronto device activation MS-OFBA configuration User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content secur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816685.html", "title": "Airlock IAM logging API", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Logging API Airlock IAM logging API To build a unified logging pipeline, the following log outputs are most suitable because structured log records allow for better information processing. The JSON-structure can be considered stable. structured-file structured-stdout el" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416219.html", "title": "AuthnContext doesn't match RequestedAuthnContext", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML AuthnContext mismatch to RequestAuthnContext AuthnContext doesn't match RequestedAuthnContext Exception:  Example com.sun.identity.saml2.common.SAML2Exception Possibility 1: If preceeded in the log file by: SAML2Utils.isAuthnContextMatching: AuthnContextClassRef urn:oasis:n" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006411.html", "title": "Authentication modes", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Authentication modes Authentication modes There are 3 different authentication modes available for Cronto. These modes are described for the login process, but apply analogously for transaction signing: Mode Description Scan & TAN The default mode" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945285.html", "title": "Securing Airlock IAM with HTTPS", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Securing with HTTPS Securing Airlock IAM with HTTPS Airlock Gateway and Microgateway communicate through HTTP requests and responses with Airlock IAM . HTTPS/TLS can be used to secure the communication between IAM and its client, including Air" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812965.html", "title": "Defining the signature scope", "hits": [ "loginapp" ], "snippets": [ "res Configuration Signature scope Other config properties TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation HTTP signature verification Configuration Signature scope Defining the signature scope The scope of the signature - i.e. the set of headers and optionally the body that are verified to be part of the signature - is specified by the configurat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1738063554373.html", "title": "YAML format specification", "hits": [ "loginapp" ], "snippets": [ "odifications Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config automation YAML format YAML format specification This document describes the YAML configuration format for Airlock IAM. Using examples, it explains the syntax and the meaning of all supported configuration concepts for IAM configuration and snippet files. General inform" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642782284123.html", "title": "Mobile-only token enrollment", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token enrollment Mobile-only token enrollment Mobile-only token enrollment In a scenario with a desktop browser and a mobile device, it is no problem to scan a QR code with the mobile from the screen. Doing the same thing in a mobile-only scenario will" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945276.html", "title": "Config Editor quickstart guide", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Config Editor quickstart guide The most important configuration tool for Airlock IAM is the web-based Config Editor . The Config Editor has the following main features: Most behavior of Airlock IAM components is configured in it. All changes can be " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404740.html", "title": "Auditing in user representation", "hits": [ "loginapp" ], "snippets": [ "cation Identity propagation Auditing Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation System design Auditing Auditing in user representation Events about the representation feature are logged in two log streams: Login Application - Logs technical information in an audit log. User Activity - Logs user activities. The following events create a log entr" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1702575901082.html", "title": "Configuration example: Microsoft Sharepoint SE integration with OIDC Hybrid Flow and Form Post", "hits": [ "loginapp" ], "snippets": [ "rm Post Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1632806979611.html", "title": "SSO configuration example for Google OP with Airlock IAM as OIDC client", "hits": [ "loginapp" ], "snippets": [ " client Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Google as OIDC OP example HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1781491741891.html", "title": "Realm Management functionality", "hits": [ "loginapp" ], "snippets": [ "onality Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849715364.html", "title": "Airlock 2FA token migration - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759806659.html", "title": "Authentication of end-users", "hits": [ "loginapp" ], "snippets": [ "st this browser Step-Up authentication Gateway vs. application triggered step-up Risk-based authentication Failed logins and temp locking Username transformation User transformation configuration hints Maintenance messages Management Examples in the Loginapp Usage and limitations Locations User representation Terms and definitions Use cases System design Representer authorization Representee authentication Identity propagation Auditing Flow diagrams Events and notifications Event producers Event attributes Event attribute examples Event subscribers Airlock 2FA Push Event Subscriber Gateway Session Terminator Subscriber Phone Numbers from String Value Providers - Use case Reliable event delivery Login from new device Actions on log out Self-" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1593183841297.html", "title": "One-shot authentication with authenticators", "hits": [ "loginapp" ], "snippets": [ "icators Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication Mapping for one-shot authentication One-shot authentication with flows One-shot authentication with authenticators JWKS signature verifier settings Front-Side Kerberos configuration MS-OFBA configuration OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668113317.html", "title": "Token enrollment", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token enrollment Token enrollment After downloading the Airlock 2FA app from the app store, it does not contain any cryptographic key material required for authentication. The end-user must first enroll an Airlock 2FA token with the app. Enrollment is " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233444253.html", "title": "Standard H2 deployment", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs H2 Standard deployment Standard H2 deployment If using H2 productively, please install and operate it separately from the IAM installation. Follow the instructions on http://www.h2database.com . Chapter content Installation (example)" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849697387.html", "title": "KB - MS-OFBA troubleshooting", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Interaction models One-shot (interaction model) MS-OFBA authentication Troubleshooting KB - MS-OFBA troubleshooting About this knowledge base article Troubleshooting knowledge base articles are designed to help you solve a problem. Often, we generate these articles based on real finding" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572348.html", "title": "Sources of roles", "hits": [ "loginapp" ], "snippets": [ " Basic access control concepts Role-based AC example Sources of roles Author. of internal services Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Access control (end-users) Basic access control concepts Sources of roles Sources of roles A user's access roles - in the above example, these are admin and customer - may originate from different sources. For all further considerations, there is a distinction between user roles a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945257.html", "title": "Overview of IAM interfaces", "hits": [ "loginapp" ], "snippets": [ "ectories Overview of interfaces Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses About Overview of interfaces Overview of IAM interfaces  Info This document gives an overview over IAM's interfaces, i.e. how users and other systems can interact with Airlock IAM. It does not list systems called by IAM (such as databases, LDAP, SMTP, SMS, etc.). Name Module Description Client Type I" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1710781876728.html", "title": "Upgrade Airlock IAM at runtime (rolling upgrade)", "hits": [ "release notes", "loginapp" ], "snippets": [ "t a time in an active-active setup. IAM session state is stored in an external Redis cluster and not in memory. The IAM version to upgrade to supports rolling updates. This is the case starting with IAM 8.2 and onwards unless otherwise stated in the release notes. The used database is supported for rolling updates by the schema upgrade scripts provided with Airlock IAM. Step 1 – Upgrade database schema Before upgrading the IAM instances, the database schema must be updated for the new release. To do so, use the database schema scripts provided on Relational databases for IAM .  Functional limitation To support upgrades at runtime, database schema changes must be designed to work with both the previous and the new IAM versions. The corres", "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Upgrade at runtime Upgrade Airlock IAM at runtime (rolling upgrade) Upgrading at runtime, also referred to as rolling upgrade , is the process of activating a new version of Airlock IAM without interrupting IAM operation. Airlock IAM supports rolling upgrad" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413595.html", "title": "Locked account", "hits": [ "loginapp" ], "snippets": [ "account Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504897.html", "title": "Account locking and validity attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins Account locking and validity attributes Account locking and validity attributes The next table shows attributes related to account validity and -locking . They are relevant for the LDAP Connector plugin. Attribute name (e" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731186.html", "title": "Configuration of IAM as OAuth Authorization Server / OpenID Provider", "hits": [ "loginapp" ], "snippets": [ "rovider Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Token Exchange Configuration Dynamic client registration Authentication flows Scope policies and filtering Translation of scopes configuration ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Consent persister configuration Remote consent OIDC session m" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945338.html", "title": "Matrix card authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Matrix card Matrix card authentication Matrix cards (also called “grid cards”) are used as a second factor to authenticate users. A user has a list of codes - typically printed on paper - that are requested to be entered in the authentication process. Airlock " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416177.html", "title": "Using Device Tokens to authenticate mobile apps", "hits": [ "loginapp" ], "snippets": [ ". API with Gateway sessions Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Authenticate apps with Device Tokens Using Device Tokens to authenticate mobile apps Device Tokens allow to bind a mobile app (or other REST clients) to an IAM account and use the involved device token as a non-user-interactive first or second authentic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813019.html", "title": "Defining the signature scope", "hits": [ "loginapp" ], "snippets": [ "iguration Signature scope Other config properties TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 HTTP request signature verification Configuration Signature scope Defining the signature scope The scope of the signature - i.e. the set of headers and optionally the body that are verified to be part of the signature - is specified by the configuration. It i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495506.html", "title": "Separation of IAM modules", "hits": [ "loginapp" ], "snippets": [ "modules Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best practices Separation of modules Separation of IAM modules Some features of IAM have been especially built to " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649928953593.html", "title": "Using the Flow Continuation Step in public self-service flows", "hits": [ "loginapp" ], "snippets": [ "e flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1637831287844.html", "title": "Trust this browser/device – persistent 2nd-factor authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Remember-Me Trust this browser Trust this browser/device – persistent 2nd-factor authentication Initial thoughts The following example targets a simple but common use case allowing to skip the second authentication factor on remembered browsers. It allows the user to choose not to be " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582211783253.html", "title": "Airlock 2FA as the second factor with IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Airlock 2FA as the second factor with IAM Airlock 2FA is a strong authentication solution in Airlock IAM. It provides a ready-to-use mobile app and a comprehensive set of services and interfaces. Main features Strong and frictionless user authenticatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945361.html", "title": "Username transformation: Login with multiple IDs", "hits": [ "loginapp" ], "snippets": [ "ion hints Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Username transformation Username transformation: Login with multiple IDs Airlock IAM may be configured such that users may log in using different user ids (e.g. a username as well as the email address). This concept is called Username transformation in IAM.  Info Example User John Doe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1757609593335.html", "title": "Introduction to FIDO and passkeys", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO and passkey concepts Introduction to FIDO and passkeys Airlock IAM’s FIDO implementation offers a range of configuration and usage options. This article provides an overview of the key FIDO concepts to help you make informed decisions when i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1631819651210.html", "title": "Identity propagation", "hits": [ "loginapp" ], "snippets": [ "tication Self-services Target applications Target application selection Access control (end-users) Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Identity propagation Identity propagation The term identity propagation is used to summarize various methods of how Airlock IAM can provide information about an authenticated user to a target application. Identity propagation is highly flexible so that identity information can be p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142455.html", "title": "Using the Design Kit CLI", "hits": [ "loginapp" ], "snippets": [ "Kit CLI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation menu configuration Page settings configuration Additional and custom attributes Response mocking configuration Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945507.html", "title": "Customizing UIs and texts", "hits": [ "loginapp" ], "snippets": [ "d texts Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Configuration Use in letters Security best practices Third-party licenses Customizing UIs and texts Customizing UIs and texts The user interface (styling) of the Loginapp and most " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1627907721326.html", "title": "Airlock 2FA letter generation task", "hits": [ "loginapp" ], "snippets": [ "on task Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration RADIUS server Cronto activation letters Airlock 2FA letter generation task Matrix card generation Customizing text elements Remember-Me token cleanup Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Service Container Configuration Airlock 2FA letter generation task Airlock 2FA letter generation task Airlock 2FA activation letters are generated by th" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415602.html", "title": "Screen flow 3: Usage within password reset self-service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions Example screen flows Usage within pwd. reset service Screen flow 3: Usage within password reset self-service The Password reset self-service asks for answers to verify the entered user" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404734.html", "title": "Representer authorization in user representation", "hits": [ "loginapp" ], "snippets": [ "cation Identity propagation Auditing Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation System design Representer authorization Representer authorization in user representation Before starting a user representation, the system checks whether the current representer is allowed to represent a particular user. In order to perform the necessary authorizatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759938869.html", "title": "Customizing text elements in the Transaction Approval module", "hits": [ "loginapp" ], "snippets": [ " module Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Customizing text elements Cronto message custom formatting Proof of transaction approval IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Transaction Approval Configuration Customizing text elements Customizing text elements in the Transaction Approval module Customizing texts of the Transaction Approval module is done " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1637831208229.html", "title": "Keep me logged-in", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Remember-Me Keep me logged-in Keep me logged-in Persistent authentication between sessions - initial thoughts The following example targets a simple but common use case with username and password authentication. The Keep me logged-in checkbox on the login screen activates the Remember-M" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443452.html", "title": "Step 7 – Activate changes", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 7 – Activate changes Step 7 – Activate changes To activate the changed configuration, click on the Activate icon in the toolbar: In the toolbar, click on the Activate icon: In the opening dialog, the configuration is validated. If the confi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1646385552651.html", "title": "Flash SMS support in Airlock IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods mTAN/SMS Flash SMS Flash SMS support in Airlock IAM A flash SMS (also called Class 0 SMS ) is a type of SMS message that gets displayed directly on the end-users phone screen and usually does not get automatically stored. Most Airlock IAM features using SMS suppor" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375380225.html", "title": "Configuration of Airlock IAM as OAuth 2.0 Client", "hits": [ "loginapp" ], "snippets": [ " Client Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Google as OIDC OP example HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929282064.html", "title": "Customizing the CAPTCHA look and feel", "hits": [ "loginapp" ], "snippets": [ "nd feel Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing the language switcher JS customization of additional attributes Customiz" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416171.html", "title": "Using the flow authentication API with JWTs and one-shot authentication", "hits": [ "loginapp" ], "snippets": [ "hn. API with JWTs and one-shot Request flow Configuration with JWT Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Flow authn. API with JWTs and one-shot Using the flow authentication API with JWTs and one-shot authentication  Info Use this variant if the REST client (e.g. mobile app) needs a bearer token that can also be used with 3rd party systems that are not co" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1600698221071.html", "title": "Token management self-service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token management Token management self-service Token management self-service The Airlock IAM Loginapp provides self-service features that allow logged-in users to manage their own Airlock 2FA app devices. It provides the following features: View Airloc" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1644518866691.html", "title": "SAML IDP URLs", "hits": [ "loginapp" ], "snippets": [ "DP URLs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URLs Authentication contexts SAML Single Logout with temporary Gateway role Load balancing setup Keystore generation Limitations SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-sho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416233.html", "title": "MetaAlias missing or entity IDs do not match", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML MetaAlias missing / entity IDs mismatch MetaAlias missing or entity IDs do not match Exception (on SP):  Example com.sun.identity.saml2.common.SAML2Exception: This Assertion Consumer Service is not the intended recipient. Some lines before (note the realm '/'):  Example 201" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960545.html", "title": "Troubleshooting Kerberos issues", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. Troubleshooting Troubleshooting Kerberos issues This article contains useful information in case the front-side Kerberos feature does not work as expected.  Info To enable more log information it may be useful to turn on Kerberos debugg" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815343.html", "title": "Use in letters", "hits": [ "loginapp" ], "snippets": [ "letters Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Configuration Use in letters Security best practices Third-party licenses Customizing UIs and texts MSWord report templates Extra informations in pwd letters Use in letters Use in " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1610721895507.html", "title": "Use case: FIDO token migration self-service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in IAM FIDO token migration Use case: FIDO token migration self-service This article describes the token migration self-service that can be used to move end-users from using an arbitrary second factor to using FIDO. The described process allow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945532.html", "title": "Connection drop with slash and/or backslash in the username", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Reasons for connection drops Connection drop with slash and/or backslash in the username Slash \"/“ and backslash ”\\\" are special characters that usually do not occur in a username. If a username contains one of those characters, the connection gets dropped by default. It is recommended " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945261.html", "title": "System requirements", "hits": [ "loginapp" ], "snippets": [ " Manual installation Getting started IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Installation on Linux System requirements System requirements Operating systems Distribution Supported release(s) Deprecations Red Hat Enterprise Linux (RHEL) 7 8 9 10 Ubuntu Server 18.04 LTS 20.04 LTS 22.04 LTS 24.04 LTS 26.04 LTS 18.04 LTS will be deprecated. Support will r" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1702575900735.html", "title": "OIDC Hybrid flow usage example", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812961.html", "title": "Plugin features", "hits": [ "loginapp" ], "snippets": [ "HTTP signature verification Plugin features Configuration TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation HTTP signature verification Plugin features Plugin features  Notice Two certificates of the TPP are involved in NextGenPSD2: The signing certificate used to sign HTTP requests The client certificate used in the SSL/TLS handshake (also called" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1659430054151.html", "title": "Extended tenant ID-dependent customization of the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "Extended tenant ID-dependent customization of the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572334.html", "title": "CrontoSign Swiss app", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto Push CrontoSign Swiss app CrontoSign Swiss app The CrontoSign Swiss app is not customizable, all customers in Switzerland use the same app, which is available through the standard app stores. The Bank Url Index property in the CrontoEngine " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1776358268025.html", "title": "Language selection mechanism", "hits": [ "loginapp" ], "snippets": [ "chanism Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Security best practices Third-party licenses Customizing UIs and texts Language selection mechanism Language selection mechanism When accessing an application login page (via the Loginapp ) or managing users in the Adminapp , the respective dialog appears in a specif" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945408.html", "title": "Device tokens - REST authentication API", "hits": [ "loginapp" ], "snippets": [ "ion API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens Usage Configuration Usage of Device Token Initial authentication Device Token registration test Register Device Token Device Token authn. SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404990.html", "title": "Segregation of users", "hits": [ "loginapp" ], "snippets": [ "f users Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Segregation of duties Segregation of users Privilege escalation p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813025.html", "title": "Configuration", "hits": [ "loginapp" ], "snippets": [ "nature verification TPP authn. with OAuth 2 and STET Plugin features Configuration Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 TPP authn. with OAuth 2 and STET Configuration Configuration  Info Please also refer to the information in the plugins and properties in the ConfigEditor by clicking on the symbol. IAM Config Property Value Description OAuth 2.0 Authorization Server Referenc" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1627907720789.html", "title": "Additional API methods", "hits": [ "loginapp" ], "snippets": [ "methods Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing the language switcher JS customization of additional attributes Customiz" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710329.html", "title": "Installation with installer script", "hits": [ "loginapp" ], "snippets": [ " Manual installation Getting started IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Installation on Linux Installer script Installation with installer script We recommended using the shell script installer as it is the quickest way to install Airlock IAM and follows our conventions by default. Download the Airlock IAM installer script from Airlock Techzone. T" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142575.html", "title": "Internationalization and translation", "hits": [ "loginapp" ], "snippets": [ "slation Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Customizing an existing product page Adding new pages HTML rendering and template variables Internationalization and translatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731233.html", "title": "Client Credentials grant usage", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421886158.html", "title": "User Management Extensions (Adminapp) Hello World Example", "hits": [ "loginapp" ], "snippets": [ "Example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Example: Hello World Example: Send message Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759809565.html", "title": "Event producers", "hits": [ "loginapp" ], "snippets": [ "tributes Event attribute examples Event subscribers Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Event producers Event producers IAM plugins can produce events that can be picked up and used, i.e., by event subscribers. For example, the plugin Airlock 2FA Token Controller produces an Airlock 2FA Device Deleted event in the Adminapp when an administrator del" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816669.html", "title": "Using systemd services with profiles", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Starting and stopping IAM systemd services with profiles Using systemd services with profiles  Info For general information on “profiles”, see Sandboxing with profiles . For every process, a separate service is required. For the profiles “internal” and “external”, the services â" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812997.html", "title": "IAM mapping for bank API calls", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Gateway configuration for STET PSD2 Gateway configuration for bank API calls IAM mapping for bank API calls IAM mapping for bank API calls  Notice Important The following changes to the IAM mapping are based on the latest IAM mapping template (download from " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731249.html", "title": "Weak authentication", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approva" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945339.html", "title": "RSA SecurID authentication over RADIUS", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Token auth via RADIUS RSA SecurID via RADIUS RSA SecurID authentication over RADIUS RSA SecurID can be connected to Airlock IAM using the RADIUS protocol.  Info This article explains how to connect to a RSA SecureID server using the standard RADIUS client plugins" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572336.html", "title": "Connectivity/firewall", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto Push Connectivity/firewall Connectivity/firewall In order to send push notifications via the Google and Apple push servers, IAM must be able to connect to the push servers. Make sure that the local firewall is configured accordingly, or con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1671126687361.html", "title": "User search in Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management User search Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652373182830.html", "title": "Lockout Self-Service in the Loginapp REST API/UI", "hits": [ "loginapp" ], "snippets": [ "Lockout Self-Service in the Loginapp REST API/UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443448.html", "title": "Step 5 – Simple configuration change", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 5 – Simple configuration change Step 5 – Simple configuration change In this example, the minimum password length is lowered from 8 (default configuration) to 6 in Password Policy plugin we previously looked up. Go to: MAIN SETTINGS >> Pass" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341380961.html", "title": "Configuration management in Airlock IAM", "hits": [ "loginapp" ], "snippets": [ "onfigurations Configuration activation timeout Configuration activation internals Module filenames Examples of activation state files Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration management in Airlock IAM This chapter describes the configuration management capabilities of Airlock IAM. The Config Editor , supported configuration management concepts, config formats, and features to support configuration automation.  Notice Note that this c" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642098258957.html", "title": "Dynamic step activation (DSA) - flow concept", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Dynamic step activation Dynamic step activation (DSA) - flow concept Dynamic step activation (DSA) is a flow concept that allows steps to activate (or deactivate) steps later in the flow. It gives the end-user (or REST client) control over optional steps. Example: Using the" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416229.html", "title": "SLO not working in SP", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML SLO not working SLO not working in SP Exception: If using IAM as SAML SP: the SLO doesn't work. Possible reasons: incorrectly configured SLO URL in sp.xml: must point to SP logout instead of IdP logout must point to /SPSloResponder/metaAlias/sp , not /logs/ Appender Parameters IAM Modules Loginapp Adminapp Transaction Approval Service Container API Policy Service STRUCTURED-FILE iam.lo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815327.html", "title": "Further examples using MessageFormat", "hits": [ "loginapp" ], "snippets": [ "eFormat Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Security best practices Third-party licenses Customizing UIs and texts MSWord report templates MessageFormat examples Further examples using MessageFormat Addresses One common requ" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945310.html", "title": "Airlock IAM database with fixed-size character columns", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs DB with fixed-size character columns Airlock IAM database with fixed-size character columns The default Airlock IAM database schema uses the VARCHAR type for its string columns. If there are database schemas with a fixed-length string type (CHAR) on" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1659429981009.html", "title": "SAML SP configuration for the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "SAML SP configuration for the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Prerequisites SP configuration Add SAML IDP SP Advan" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945312.html", "title": "Generic LDAP directories for IAM", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Generic LDAP directories for IAM This section describes how generic LDAP directories can be used in Airlock IAM (for the MS Active Directory, see Microsoft Active Directory for IAM ). IAM supports LDAP directories in two configurations: LD" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812963.html", "title": "Configuration", "hits": [ "loginapp" ], "snippets": [ "res Configuration Signature scope Other config properties TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation HTTP signature verification Configuration Configuration  Info Please also refer to the information in the plugins and properties in the ConfigEditor by clicking on the symbol.  Notice According to the NextGenPSD2 specification, the bank (AS" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572106.html", "title": "View toggles", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) View toggles View toggles View Toggles can be used to hide certain UI elements in order to have more space or focus on the necessary information. Icon Descrption Show / hide the plugin tree Show / hide the docking panels Show / hide the toolbar header" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812989.html", "title": "User-consent (interaction model)", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Interaction models User-consent User-consent (interaction model)  Info In the following, we illustrate the interaction between the end-user, the TPP and the bank when asking the end-user for a consent within an Authz Code Flow . The consent step is initiated" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652373181647.html", "title": "Risk-based authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Risk-based authentication Risk-based authentication Risk-based authentication takes one or more pieces of context information into account to assess the current risk. The authentication process can then be influenced based on the assessed risk. It can be used, for example, to omit the s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816693.html", "title": "Custom log agent/data collector", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Custom log agent / data collector Custom log agent/data collector Building on the structured-file or structured-stdout log outputs , various log collectors can be integrated with Airlock IAM. Typically, this is recommended, if there is already some form of unified loggi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413802.html", "title": "Sample Usage of Device Token (REST API Examples)", "hits": [ "loginapp" ], "snippets": [ "amples) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens Usage Configuration Usage of Device Token Initial authentication Device Token registration test Register Device Token Device Token authn. SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1674151143652.html", "title": "Internationalization (i18n) with language and country codes", "hits": [ "loginapp" ], "snippets": [ "y codes Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Security best practices Third-party licenses Customizing UIs and texts Language and country codes Internationalization (i18n) with language and country codes Language codes (only) 2-letter language codes from the ISO 639-1:2002 standard can cover most of the world's " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945337.html", "title": "CrontoSign push setup", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto Push CrontoSign push setup With CrontoSign push, the user receives a push notification that opens up the Cronto app on the smartphone. The user then can confirm or reject the login (or transaction) by simply pressing a corresponding button " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435053732.html", "title": "Configure the RADIUS server for Airlock 2FA", "hits": [ "loginapp" ], "snippets": [ "ock 2FA Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration RADIUS server Configure the RADIUS server for Airlock 2FA Cronto activation letters Airlock 2FA letter generation task Matrix card generation Customizing text elements Remember-Me token cleanup Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Service Container Configuration RADIUS server Configure the RADIUS server for Airlock 2FA Configure the RADI" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233447000.html", "title": "Initial configuration", "hits": [ "loginapp" ], "snippets": [ "eway configuration Microgateway configuration Securing with HTTPS HTTPS/TLS authn. HTTPS/TLS client authn. Gateway shows 503 / 400 on access User data source configuration Logging configuration Logging parameters Log4j 2 configuration files Changing Loginapp log level Logging to stdout only Sending logs to syslog Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Initial configuration Configuration files Instances d" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435031541.html", "title": "Configuration - REST authentication API", "hits": [ "loginapp" ], "snippets": [ "ion API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731259.html", "title": "Step-up with SSO ticket", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approva" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945458.html", "title": "OAuth 2.0 and OpenID Connect (OIDC) overview", "hits": [ "loginapp" ], "snippets": [ "uth consent Local consent Consent management Remote consent apps Remote consent protocol ACR PAR PKCE Client authentication DCR Session management OIDC session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Claims (user attributes) Account linking Social registration Mobile app use case Example: SPA (single-page application) Token Exchange service overview SAML API access control Flows" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812987.html", "title": "Bank API calls (interaction model)", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Interaction models Bank API calls Bank API calls (interaction model)  Info The following diagram illustrates the interaction between the TPP and the bank using the API call “GET /accounts” (AISP). It is the same for all other “Bank API Calls”. The di" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759809544.html", "title": "Events and notifications", "hits": [ "loginapp" ], "snippets": [ "hone Numbers from String Value Providers - Use case Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Events and notifications Event-based subscriber notifications The IAM modules Adminapp and Loginapp produce events on various occasions. Events are (Java) objects instances that are aimed to be processed asynchronously by an event subscriber. Any of the availabl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642782415579.html", "title": "Fine-grained customization using flow ID, step ID, and/or tenant ID", "hits": [ "loginapp" ], "snippets": [ "nant ID Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using flow, step, and tenant ID Customization using default HTML files UI customizations with JavaScript Customizing example (cancel button) Customization with tenant ID Customization with Resource Sets Design Kit " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816723.html", "title": "Using systemd", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics Using systemd Using systemd If Airlock IAM has been started by systemd (see Starting and stopping IAM ), you can use systemctl to get status information about the Airlock IAM process.  Example $ systemctl status airlock-iam*\n● airlock-iam-auth.service - " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615495.html", "title": "Username transformation configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Username transformation configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812991.html", "title": "Gateway configuration for bank API calls", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Gateway configuration for STET PSD2 Gateway configuration for bank API calls Gateway configuration for bank API calls The “bank API calls” (calls from the TPPs to the bank's PSD2 APIs) require the following Gateway configuration: Chapter content Virtual h" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816665.html", "title": "Creating systemd services", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Starting and stopping IAM Creating services Creating systemd services A service-file must be created, defining how the service should be started. The default directory for systemd services is “/etc/systemd/system”; services have the “.service” file name extension. The CLI can be used" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815335.html", "title": "Plugins", "hits": [ "loginapp" ], "snippets": [ "Plugins Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Security best practices Third-party licenses Customizing UIs and texts MSWord report templates Plugins Plugins The following plugins support Word-to-PDF conversion: Plugin Descript" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1593183841266.html", "title": "One-shot interaction model", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Interaction models One-shot (interaction model) One-shot interaction model In the one-shot interaction model , each HTTP request is checked in the Airlock Gateway by calling a dedicated One-shot end-point in Airlock IAM . It is thought to verify authentication tokens obtained from othe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1694711191135.html", "title": "Prepare self-registered account for 2nd-factor enrollment", "hits": [ "loginapp" ], "snippets": [ "ollment Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in after self-registration Stealth mode for self-registration Self-registration example CAPTCHAs Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp U" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731243.html", "title": "Forced user re-authentication", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approva" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341394725.html", "title": "Airlock 2FA Futurae service setup", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Airlock 2FA Futurae service setup Airlock 2FA Futurae service setup The Airlock 2FA is based on the Futurae cloud service . Airlock IAM therefore requires a service account to access the Futurae cloud. The diagram shows how the Airlock 2FA solution dep" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945327.html", "title": "Password end-to-end encryption", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password end-to-end encryption Password end-to-end encryption End-to-end encryption (E2EE) of user passwords ensures uninterrupted protection from the web browser all the way to Airlock IAM. Passwords entered by the user into the Airlock IAM " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812999.html", "title": "Gateway configuration for user consent", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Gateway configuration for STET PSD2 Gateway configuration for user consent Gateway configuration for user consent The user consent application is treated as all other web applications protected by Airlock Gateway and IAM. To protect the consent application r" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1661841841921.html", "title": "Browser/Device Management Self-Service (Remember-Me)", "hits": [ "loginapp" ], "snippets": [ "ber-Me) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504903.html", "title": "Various attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins Various attributes Various attributes The next table shows various additional attributes relevant for the LDAP Connector plugin. Attribute name (examples) Usage Type LDAP Connector plugin LDAP Token List Persister plugin " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495512.html", "title": "Authentication concepts", "hits": [ "loginapp" ], "snippets": [ "oncepts Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642782259259.html", "title": "Use case: Identity propagation configuration with JWT", "hits": [ "loginapp" ], "snippets": [ "ith JWT Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation Generic ID Propagator ID propagation with JWT Propagating non-persistent string attributes User representation (representee side) Failed logins and lockout config Temp lo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945525.html", "title": "Sandboxing with profiles", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Sandboxing with profiles Sandboxing with profiles Sandboxing is the process by which components of Airlock IAM can be separated from other components or resources. With profiles, sandboxing can be applied to/between web application modules such as Loginapp and Adminapp. Why use sandboxing? D" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572095.html", "title": "Plugin overview", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Plugin overview Plugin overview On top, the type, the identifier and optionally the parent, as well as a comment are shown for each plugin configuration: Type : Shows the plugin type (e.g., mTAN Message Provider or Database User Persister ). The type is " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929280371.html", "title": "CAPTCHAs in the Loginapp REST API and the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "CAPTCHAs in the Loginapp REST API and the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642782416463.html", "title": "Customizing the language switcher", "hits": [ "loginapp" ], "snippets": [ "witcher Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing the language switcher JS customization of additional attributes Customiz" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1709045030278.html", "title": "Example 1 - Scriptable Step in self-registration flow", "hits": [ "loginapp" ], "snippets": [ "ow error handling Protected Flows Scriptable plugins Lua and operating system dependencies Scriptable Step plugin Scriptable Step - Lua scripts Scriptable Step example 1 Scriptable Step example 2 Scriptable Step example 3 Scriptable Validator plugin Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Scriptable plugins Scriptable Step plugin Scriptable Step example 1 Example 1 - Scriptable Step in self-registration flow The example presented is only useful to demonstrate the capabilities of the scriptable step and how it can interact with Airlock IAM. The example is lim" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945279.html", "title": "Security best practices", "hits": [ "loginapp" ], "snippets": [ "actices Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1655396277782.html", "title": "Flow step plugins in IAM flows", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Flow step plugins in IAM flows Flow step plugins in IAM flows In Airlock IAM, flow step plugins can be combined to form IAM flows. This allows implementing complex workflows such as multi-factor authentication with step-up and token activation. IAM flows" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849713554.html", "title": "Airlock 2FA hardware token and device selection - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945283.html", "title": "Airlock Gateway for Airlock IAM configuration", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway configuration Airlock Gateway for Airlock IAM configuration  Notice The IAM Loginapp must be placed behind an Airlock Gateway or Microgateway. It is configured as a back-end application that can authenticate sessions. See also Separat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945517.html", "title": "Generic token REST endpoint", "hits": [ "loginapp" ], "snippets": [ "ndpoint Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller Generic token REST endpoint UI configuration User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements L" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1781491740413.html", "title": "Realm administration", "hits": [ "loginapp" ], "snippets": [ "tration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1632211986856.html", "title": "The Generic ID Propagator plugin", "hits": [ "loginapp" ], "snippets": [ " plugin Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation Generic ID Propagator ID propagation with JWT Propagating non-persistent string attributes User representation (representee side) Failed logins and lockout config Temp lo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960539.html", "title": "Front-Side Kerberos configuration (one-shot flow)", "hits": [ "loginapp" ], "snippets": [ "t flow) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication Mapping for one-shot authentication One-shot authentication with flows One-shot authentication with authenticators Front-Side Kerberos configuration MS-OFBA configuration OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652877887985.html", "title": "Customizing non-UI-related text elements in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Customizing non-UI-related text elements in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text element" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759809574.html", "title": "Event notification configuration in the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849713225.html", "title": "Airlock 2FA passcode - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API One-Touch login Online QR code login Usernameless QR login Passcode Hardware token / device selection Token migration Mobile-only auth Lock user on fraud FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006413.html", "title": "Supported apps and devices", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Supported apps / devices Supported apps and devices App/Device Cronto Handler in IAM Supported Features OneSpan (Vasco) Digipass for Mobile Vasco Cronto Handler All 3 authentication modes. Once activated with Cronto, the app could also be used as " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1612361355393.html", "title": "FIDO passwordless authentication - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication 2nd factor authn. Passwordless authn. Token migration Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me confi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813017.html", "title": "Configuration", "hits": [ "loginapp" ], "snippets": [ "iguration Signature scope Other config properties TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 HTTP request signature verification Configuration Configuration  Info Please also refer to the information in the plugins and properties in the ConfigEditor by clicking on the symbol.  Notice According to the STET specification, all TPP requests must be si" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710486.html", "title": "Use cases", "hits": [ "loginapp" ], "snippets": [ "ker image Container deployment Use cases Troubleshooting Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade IAM as Docker image Use cases Use cases This section provides some use cases when working with Docker Airlock IAM images. Quick start with docker-compose.yml The Running IAM with Docker describes how to get Airlock IAM up and running with Docker when using the Docker CLI. Howe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1639690251641.html", "title": "Scope configuration in IAM flows", "hits": [ "loginapp" ], "snippets": [ "M flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering Translation of scopes configuration ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configu" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945364.html", "title": "Access control for end-users (authorization)", "hits": [ "loginapp" ], "snippets": [ "M as PDP Airlock Gateway as Policy Enforcement Point Sources of roles Author. of internal services Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Access control (end-users) Access control for end-users (authorization) To manage access control Airlock IAM and Airlock Gateway must be integrated and configured correctly. Access control is important both for the protection of target applications and for the protection of interna" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945514.html", "title": "Generic token controller for token management in the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller Generic token REST endpoint UI configuration User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements L" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142516.html", "title": "Changing UI texts and translations with the Loginapp Design Kit", "hits": [ "loginapp" ], "snippets": [ "Changing UI texts and translations with the Loginapp Design Kit Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812993.html", "title": "Virtual host for bank API calls", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Gateway configuration for STET PSD2 Gateway configuration for bank API calls Virtual host for bank API calls Virtual host for bank API calls Configure a virtual host to expose the bank's PSD2 APIs to the TPP using an SSL server certificate. Enable “Client C" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668119333.html", "title": "Configuring API policy service", "hits": [ "loginapp" ], "snippets": [ "tion Self-services Target applications OAuth and OIDC SAML API access control Solution overview Tech-Client management API access control configuration Configuring API policy service Configuring IAM Tech-Client management Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control API access control configuration Configuring API policy service Configuring API policy service Prerequisites You need to be logged in to the Airlock IAM Adminapp and be able to access the Config Editor. The IAM bundle API Access Management must be licensed. The database schema of Ai" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945489.html", "title": "NextGenPSD2 interaction models", "hits": [ "loginapp" ], "snippets": [ "eraction models Configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Interaction models NextGenPSD2 interaction models  Info This section explains how Airlock protects interactions between the end-user, the TPP and the bank and shows how this can be achieved with the Airlock components. The interactions can b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626165444410.html", "title": "SSO tickets in the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "SSO tickets in the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Voluntary passwo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613069310947.html", "title": "Use Case: Regular end-users as simple realm administrators", "hits": [ "loginapp" ], "snippets": [ "trators Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Simple realm admi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1662655608087.html", "title": "JS customization of additional attributes", "hits": [ "loginapp" ], "snippets": [ "ributes Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing the language switcher JS customization of additional attributes Customiz" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1625752917694.html", "title": "Single sign-on (SSO) ticket authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods SSO tickets Single sign-on (SSO) ticket authentication End-users can be authenticated by presenting so-called SSO tickets .  Info In Airlock IAM , SSO tickets are statements about an authenticated end-user issued by another system. They contain the name or id of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759809570.html", "title": "Event notification configuration in the Loginapp", "hits": [ "loginapp" ], "snippets": [ "Event notification configuration in the Loginapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816701.html", "title": "Main log format", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Log message formats Main log format Main log format This article describes the log line format of logs written by the MAIN appender for each IAM module (web server, access, structured, parsable, etc. logs use different formats).  Notice Note that the parsable log file variants (e.g. logina" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945492.html", "title": "Performance measures (scaling example) for NextGenPSD2 (Airlock IAM)", "hits": [ "loginapp" ], "snippets": [ "Configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures Scaling example STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Performance measures Performance measures (scaling example) for NextGenPSD2 (Airlock IAM) The Airlock Gateway sends all bank API request to Airlock IAM for verification according to NextGenPSD2 (see NextGenPSD2 interaction models for details" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945293.html", "title": "Best practices - Configuration contexts and context retention policy", "hits": [ "loginapp" ], "snippets": [ "commended use cases Non-recommended use cases Config contexts vs. IAM instances External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Best practices Best practices - Configuration contexts and context retention policy  Info Required reading If you are not familiar with the concept of configuration contexts, read this first: Configuration contexts Configuration contexts were introduced" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375384481.html", "title": "Processing claims (user attributes) from the AS in IAM", "hits": [ "loginapp" ], "snippets": [ "DC Introduction IAM as AS/OP IAM as Client/RP Claims (user attributes) Account linking Social registration Mobile app use case Example: SPA (single-page application) Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as Client/RP Claims (user attributes) Processing claims (user attributes) from the AS in IAM IAM can process user claims - pieces of information about a user - from different resources and use them in authentication flows and identity propagation. In this context, the term resource " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652877886331.html", "title": "Use case: Email OTP authentication flow configuration", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Email OTP Email OTP config. example Use case: Email OTP authentication flow configuration This use case describes the configuration of the Email OTP Authentication Step . It assumes that there is a valid target application configuration with a Username Password Au" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945473.html", "title": "OAuth 2.0 scopes", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP OAuth 2.0 scopes OAuth 2.0 scopes The purpose of OAuth 2.0 scopes is to limit the access rights granted to an OAuth client through an access to" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668118977.html", "title": "Plan management", "hits": [ "loginapp" ], "snippets": [ "ement Authentication Self-services Target applications OAuth and OIDC SAML API access control Solution overview Tech-Client management Profile management Plan management API key management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Tech-Client management Plan management Plan management The plans section shows a summary of plans assigned to a Tech-Client . Each plan has an identifier (e.g. accounts ) and an optional rate limit (e.g. 10 requests/s ). Click on the Manage button or open the Plans tab to edit plan " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1659429980997.html", "title": "SAML SP setup with the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "SAML SP setup with the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Prerequisites SP configuration Add SAML IDP SP Advan" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572110.html", "title": "Loading and saving a configuration", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Loading/saving configurations Loading and saving a configuration A configuration can be saved and downloaded. Create, upload, and download Use the following icons to create, upload, or download a configuration: Icon Description Creates a new and empty co" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1656675605591.html", "title": "Transaction approval flow selection", "hits": [ "loginapp" ], "snippets": [ "lection Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812957.html", "title": "IAM configuration for bank API calls", "hits": [ "loginapp" ], "snippets": [ "k API calls User consent step HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration IAM configuration Bank API calls IAM configuration for bank API calls In order to verify the bank API calls (e.g. /payments, /accounts/, etc.) the following configuration steps are necessary. See linked separate detail pages whe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1706097846451.html", "title": "Usernameless QR code authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors Usernameless QR code auth Use case Usernameless QR code authentication This article explains on a conceptual level how Airlock 2FA usernameless QR code authentication works. It also provides important detailed information for cor" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945333.html", "title": "OATH OTP authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods OATH OTP OATH OTP authentication Airlock IAM supports authentication with software- and hardware-based OATH OTP one-time passwords. This article explains how to configure this authentication method as second factor. General features of OATH OTP in Airlock IAM: End" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1660036343464.html", "title": "Digipass OTP configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Digipass OTP in Users menu Digipass OTP in Tokens menu Digipass admin use-cases Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notif" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945288.html", "title": "Configuration environments", "hits": [ "loginapp" ], "snippets": [ "ts In the Config Editor Examples Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config environments Configuration environments Configuration environments allow centralized management of the configuration of multiple similar IAM instances.  Info Configuration environments vs. configuration variables Some use cases of the configuration variables feature o" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547570446.html", "title": "Airlock 2FA configuration overview", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Configuration overview Airlock 2FA configuration overview Airlock 2FA is integrated into Airlock IAM and is configured using various plugins. The configuration is organized around the Airlock 2FA Settings plugin that contains all common settings. All o" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1672991889089.html", "title": "Azure AD B2C", "hits": [ "loginapp" ], "snippets": [ " AD B2C Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1739468439122.html", "title": "License and usage analytics", "hits": [ "8.5.", "loginapp" ], "snippets": [ "ig Example license analytics data The following example shows what data is included in the license analytics data. Note that it has been abbreviated for easier readability.  Example {\n \"createdAt\": \"2025-08-26T16:18:16.393+01:00\",\n \"iamVersion\": \"8.5.0\",\n \"license\": {\n \"licenseText\": \"-----BEGIN LICENSE-----\\neJyNVtlyo0gW/ZUJP0-----END LICENSE-----\n \"structured\": {\n \"bundles\": [\n \"API_ACCESS_MANAGEMENT\",\n \"IDM\",\n \"FEDERATION_IDP_OP\",\n ...\n ],\n \"environment\": \"Development and Integration\",\n \"issuedOn\": \"2024-12-01\",\n \"licensedInstances\": 100,\n \"licensedMac48Addresses\": [\"11:22:33:44:55:66\"],\n \"licensedTags\": [\n \"OAuthSocialRegistration\",\n \"OAuthTokenExchan", "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation License and usage analytics License and usage analytics Airlock IAM can send usage data to the Airlock cloud service. Data science methods are applied to this information to uncover real-world usage patterns. The results guide Airlock in prioritizing development efforts, ensuring that new an" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1610721897157.html", "title": "Use case: FIDO passkey management", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in IAM FIDO passkey management Use case: FIDO passkey management This article shows an example of how to manage end-users' FIDO credentials. Goal Understand how authentication with FIDO can be enabled for an end-user. Understand how to manage " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1639690252988.html", "title": "ACR configuration with flows", "hits": [ "loginapp" ], "snippets": [ "h flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759810304.html", "title": "Password repositories", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password repositories Password repositories Airlock IAM supports different types of password repositories, i.e. types of systems that store information required for checking passwords: Type Description Relational database Password hash values" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404662.html", "title": "Maintenance Messages menu in the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435026353.html", "title": "Activation letter enrollment", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token enrollment Activation letter enrollment Activation letter enrollment This article explains on a conceptual level how Airlock 2FA devices/tokens are enrolled using activation letters with QR code and 16-digit activation code sent to the user by th" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613466007368.html", "title": "Security best practices for OAuth 2.0 and OIDC", "hits": [ "loginapp" ], "snippets": [ "rget applications OAuth and OIDC Introduction OAuth 2.0 grant types Usage recommendations Security best practices Terms and definitions IAM as AS/OP IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC Introduction Security best practices Security best practices for OAuth 2.0 and OIDC For OAuth 2.0 and OpenID Connect, the following security best practices are recommended: For mobile apps, the user-agent should be the system browser as recommended by RFC 8252 . It should not be an embe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594199615513.html", "title": "Temporary locking configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929286196.html", "title": "Instance configuration", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Instances directory Instance configuration Instance configuration Airlock IAM instance configuration Some fundamental settings of an instance is not stored in the main configuration file ( iam-config.yaml or medusa-configuration.xml ). Such settings are referred to as applicatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1691686262920.html", "title": "Use case: FIDO passkey self-service for end users", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in IAM FIDO end-user self-service Use case: FIDO passkey self-service for end users This article shows an example of how end-users can manage their FIDO passkeys. The following screenshot shows the full self-service feature set for end users: " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495496.html", "title": "Changing Loginapp log level", "hits": [ "loginapp" ], "snippets": [ "Changing Loginapp log level Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration files Instances directory Config Editor quickstart guide Gateway - Microgateway configuration User data source configuration Logging configuration Logging parameters Log4j 2 configuration files Changing Loginapp log level Logging to stdout only Sending logs to syslog Using custom plugins Configuration management Authentication Self-services Target applications OAu" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731221.html", "title": "Usage examples of the authorization server", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approva" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006439.html", "title": "Matrix card generation in the Service Container", "hits": [ "loginapp" ], "snippets": [ "ntainer Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration RADIUS server Cronto activation letters Airlock 2FA letter generation task Matrix card generation Customizing text elements Remember-Me token cleanup Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Service Container Configuration Matrix card generation Matrix card generation in the Service Container Matrix cards letters are usually not generated di" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1691686267663.html", "title": "Performance Tuning", "hits": [ "loginapp" ], "snippets": [ " Tuning Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812995.html", "title": "Mapping for bank API calls", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Gateway configuration for STET PSD2 Gateway configuration for bank API calls Mapping for bank API calls Mapping for bank API calls For each type of bank API call (e.g. “/accounts”, “/payments”, “/consents”/) a mapping with the following PSD2-speci" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1747745191355.html", "title": "Support for OIDC back-channel logout", "hits": [ "loginapp" ], "snippets": [ " logout Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652877537393.html", "title": "Additional Cronto device activation in authentication flows in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Additional Cronto device activation in authentication flows in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815248.html", "title": "Get technical clients", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Tech-clients management Examples Get tech clients Get technical clients Returns all technical clients known to the IAM database. HTTP Request: Get Technical Clients  Terminal box GET /auth-admin/rest/tech-clients/ HTTP Response: List of Technical Cl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945486.html", "title": "PSD2 support in Airlock IAM", "hits": [ "loginapp" ], "snippets": [ "APIs Identity propagation Terms and conditions PSD2 support PSD2 implementation NextGenPSD2 implementation STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support PSD2 implementation PSD2 support in Airlock IAM Airlock's Role in PSD2 implementation Airlock Gateway and IAM help banks to meet PSD2 requirements with the following features: Access control for bank PSD2 services HTTP request signature verification Strong customer au" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731223.html", "title": "Authorization code flow usage", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1721740988463.html", "title": "JWKS endpoint", "hits": [ "loginapp" ], "snippets": [ "ndpoint Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST AP" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375362344.html", "title": "Advanced HTML customization", "hits": [ "loginapp" ], "snippets": [ "ization Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing the language switcher JS customization of additional attributes Customiz" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731204.html", "title": "Dynamic client registration configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945543.html", "title": "Third-party licenses", "hits": [ "loginapp" ], "snippets": [ "icenses Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Third-party licenses Third-party licenses Third-party licenses are distributed with the software. They are stored under the following path  Terminal box res/third-party-license For your convenience, a copy of the third party license information is also provided here. Licenses Login UI Licenses Admin " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435075184.html", "title": "API access control", "hits": [ "loginapp" ], "snippets": [ "t processing API access control in detail Tech-Client management Profile management Plan management API key management API access control configuration Configuring API policy service Configuring IAM Tech-Client management Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control API access control The Airlock Secure Access Hub offers a comprehensive set of API protection features. One of them is controlling access to protected APIs using API keys . The solution involves the Airlock Gateway as policy enforcement point and Airlock IAM to manage and provide " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1781491740411.html", "title": "Realm-based access control and administration", "hits": [ "loginapp" ], "snippets": [ "tration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495494.html", "title": "Log4j 2 configuration files", "hits": [ "loginapp" ], "snippets": [ " Operation Initial configuration Configuration files Instances directory Config Editor quickstart guide Gateway - Microgateway configuration User data source configuration Logging configuration Logging parameters Log4j 2 configuration files Changing Loginapp log level Logging to stdout only Sending logs to syslog Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Logging configuration Log4j 2 configuration files Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945535.html", "title": "Maintenance messages", "hits": [ "loginapp" ], "snippets": [ "ion Configuration management Authentication Interaction models Authentication methods Remember-Me Step-Up authentication Risk-based authentication Failed logins and temp locking Username transformation Maintenance messages Management Examples in the Loginapp Usage and limitations Locations User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Maintenance messages Mainte" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1610645267216.html", "title": "Use case: FIDO passkey as 2nd factor or approval step in IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in IAM FIDO as 2nd factor / approval Use case: FIDO passkey as 2nd factor or approval step in IAM This article explains on a conceptual level how to use FIDO as the 2nd factor for user authentication or as an approval step in self-services wit" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652877890299.html", "title": "Voluntary password change authentication flow", "hits": [ "loginapp" ], "snippets": [ "on flow Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Voluntary password change authentication flow Additional Cronto device activation MS-OFBA configuration User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content secur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816675.html", "title": "Using profiles", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Sandboxing with profiles Using profiles Using profiles  Info In some scenarios (e.g. some Docker deployments) it is preferable to use the environment to emulate profiles. Instead of creating a profile properties file, the environment can be used to change which modules are enabled. For ever" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759813359.html", "title": "RADIUS server", "hits": [ "loginapp" ], "snippets": [ " server Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration RADIUS server Configure the RADIUS server for Airlock 2FA Cronto activation letters Airlock 2FA letter generation task Matrix card generation Customizing text elements Remember-Me token cleanup Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Service Container Configuration RADIUS server RADIUS server The RADIUS server exposes a limited set of Airlo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375362957.html", "title": "User representation – representee configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "User representation – representee configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759833989.html", "title": "Public self-services for end-users", "hits": [ "loginapp" ], "snippets": [ "ation Configuration management Authentication Self-services Public self-services User registration Unlock self-service Screen flow example Protected self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Public self-services Public self-services for end-users This article provides conceptual information about publicly available (no authentication required) self-services for end-users. Public self-services in other chapters More public self-services are described in chapter Authentication" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572093.html", "title": "Plugin properties", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Plugin properties Plugin properties Below the header fields, all configurable properties of the selected plugin are listed and can be configured. According to their type, they are presented in simple text fields, lists, or drop-down fields. The following" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636414110.html", "title": "Flow processing internals", "hits": [ "loginapp" ], "snippets": [ "REST request / response Session tracking REST API Next Step Codes Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) General information Flow processing Flow processing internals This section provides internals about flow processing and helps to better understand how flows are processed and configured. Flow state machine The flow state machine controls in what order steps are processed an" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443446.html", "title": "Step 4 – Find reconfigure plugins", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 4 – Find reconfigure plugins Step 4 – Find reconfigure plugins Before changing something in the configuration, you have to find the corresponding component in the configuration. There are two ways to find a component: Using the plugin tree " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613069310904.html", "title": "Simple realm administration", "hits": [ "loginapp" ], "snippets": [ "tration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Simple realm admi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1678772785808.html", "title": "JWKS signature verifier settings for authentication flows", "hits": [ "loginapp" ], "snippets": [ "n flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication JWKS signature verifier settings Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary pa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496066.html", "title": "Module filenames", "hits": [ "loginapp" ], "snippets": [ "onfigurations Configuration activation timeout Configuration activation internals Module filenames Examples of activation state files Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Configuration activation internals Module filenames Module filenames Each running module writes its own file. The file name is MedusaConfigActivationstate. Example file names:  Example MedusaConfigActivationstate.loginapp MedusaConfigActiv" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945290.html", "title": "Storing sensitive configuration values externally", "hits": [ "loginapp" ], "snippets": [ "ration secrets Storing values with Config Editor Storing values using CLI Keystore tools Technical information IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management External configuration secrets Storing sensitive configuration values externally Configuration files usually contain sensitive values such as: passwords for database accounts or directory service accounts shared secrets passwords for key stores Sensitive configuration values s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1693917388944.html", "title": "Storing session state in an external Redis session repository", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Externalize session state in Redis Storing session state in an external Redis session repository This article describes how to store Airlock IAM session state in a Redis session repository . Airlock IAM relies on session state stored on the server side. Most requests processed by Airlock IAM" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945368.html", "title": "Self-services for end-users", "hits": [ "loginapp" ], "snippets": [ "services User registration Unlock self-service Screen flow example Protected self-services Application portal User profile self-services User lockout self-service Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Self-services for end-users Airlock IAM's Loginapp offers public and protected self-services for end-users. This chapter gives an overview of supported self-services and points to further information. The idea behind self-services Provide user-friendly services around the user account an" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1786675737162.html", "title": "Airlock 2FA Push Event Subscriber", "hits": [ "loginapp" ], "snippets": [ "hone Numbers from String Value Providers - Use case Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Event subscribers Airlock 2FA Push Event Subscriber Airlock 2FA Push Event Subscriber The Airlock 2FA Push Event Subscriber plugin sends custom notification messages to the Airlock 2FA app whenever a configured IAM event occurs. Typical use cases are notificatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815246.html", "title": "Example REST calls", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Tech-clients management Examples Example REST calls The example REST calls assume that the clients using this REST API are authenticated using the HTTP Basic Auth (to configure other authentication schemes, see configuration in Adminapp  >> REST API" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815250.html", "title": "Lock/unlock technical clients", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Tech-clients management Examples Lock / unlock tech clients Lock/unlock technical clients The example shows how to lock and unlock a single technical client. HTTP Request: Lock a Technical Client  Terminal box POST /auth-admin/rest/tech-clients/616b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582211785116.html", "title": "Terms and definitions", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Solution overview Terms and definitions Terms and definitions activation letter An activation letter is a letter (PDF) usually sent to the user by a trusted mail service. Activation letters are often used to verify the physical address information supp" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636414240.html", "title": "Flow Engine interaction with REST API", "hits": [ "loginapp" ], "snippets": [ "REST request / response Session tracking REST API Next Step Codes Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) General information REST request / response Flow Engine interaction with REST API The following diagram gives a schematic view of how the flow engine processes flow steps and how the flow engine interacts with the REST API.  Info The example below illustrates the fact, tha" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572486.html", "title": "Public self-services UIs", "hits": [ "loginapp" ], "snippets": [ "ces UIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST API" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816695.html", "title": "Using Fluentd", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Custom log agent / data collector Using Fluentd Using Fluentd Fluentd (or td-agent ) has many features and can collect and route different types of logs to different destinations. Filtering audit logs, user-trail, reporting records, different log levels, etc. is possib" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1689952158019.html", "title": "Flow conditions on first device usage", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token enrollment Conditions on first device usage Flow conditions on first device usage First Usage of Device is a condition that will return true when a particular device is used for the first time. This condition has the following properties: The con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496044.html", "title": "Config example scenarios and usage", "hits": [ "loginapp" ], "snippets": [ "ts In the Config Editor Examples Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Config environments Examples Config example scenarios and usage Consider the following example scenarios - multiple instances with very similar configuration: Example: Description: Stages Test and Production IAM instance in test: environment TEST IAM instance in production: " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816703.html", "title": "Structured log format", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Log message formats Structured log format Structured log format The structured log output is line-delimited JSON (or “JSON Lines”). The basic structure of each line, the message format for detailed log messages, is described in the table below.  Notice The available fields are stable, b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1646935255035.html", "title": "Mapping Flow steps to REST API next step codes", "hits": [ "loginapp" ], "snippets": [ "REST request / response Session tracking REST API Next Step Codes Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) General information REST API Next Step Codes Mapping Flow steps to REST API next step codes When using the REST API exposed by an IAM flow, the set of possible Next Step Codes are of particular interest. Next Step Codes in the REST API When developing a single page applicat" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416167.html", "title": "Using gateway-generated cookies for session tracking", "hits": [ "loginapp" ], "snippets": [ "ader-based session tracking Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Flow auth. API with Gateway sessions Session tracking Gateway session cookies Using gateway-generated cookies for session tracking In this configuration example, we use HTTP cookies between the REST client and Airlock Gateway which works primarily for b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710331.html", "title": "Manual installation without installer script", "hits": [ "loginapp" ], "snippets": [ " Manual installation Getting started IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Installation on Linux Manual installation Manual installation without installer script It is also possible to install Airlock IAM manually. Basically, you have to perform the same actions the installer would: Download the Airlock IAM application archive, e.g. airlock-iam- 8.0" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1755485389219.html", "title": "Configuring the Airlock Secure Access Hub reporting bundle", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Elasticsearch / Kibana reporting Configuring the Airlock Secure Access Hub reporting bundle Configuring the Airlock Secure Access Hub reporting bundle Airlock Gateway and Airlock IAM can be configured to send their logs directly to an external Elasticsearch and Kibana " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816667.html", "title": "Customizing systemd services", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Starting and stopping IAM Customizing services Customizing systemd services The following example shows the generated service unit file: instances/auth/airlock-iam-auth.service  Terminal box [Unit]\nDescription=Airlock IAM - auth\n \n[Service]\nType=simple\nUser=airlock\nWorkingDirectory=/home/ai" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1720717688801.html", "title": "PAR configuration for OAuth 2.0 and OIDC Clients", "hits": [ "loginapp" ], "snippets": [ "Clients Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Google as OIDC OP example HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945374.html", "title": "Unlock self-service", "hits": [ "loginapp" ], "snippets": [ "ation Configuration management Authentication Self-services Public self-services User registration Unlock self-service Screen flow example Protected self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Self-services Public self-services Unlock self-service Unlock self-service The unlock self-service allows end-users that have been locked out because of too many login failures to unlock the user account by providing the 2nd authentication factor. The user can then try to log in again. The self-servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945403.html", "title": "Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1760669362749.html", "title": "Release and support", "hits": [ "release notes", "loginapp" ], "snippets": [ "Release and support Toggle navigation About Release and support Release notes Changelog Required upgrade actions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release an", "ctions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release and support Release and support  Info See what is new in IAM 8.7 : IAM 8.7 - Release notes . Release lifecycle Airlock IAM provides two Long Term Support (LTS) releases per year: Spring LTS release : Typically end of March Fall LTS release : Typically end of September During the year, several" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668114834.html", "title": "Solution overview", "hits": [ "loginapp" ], "snippets": [ "tion Self-services Target applications OAuth and OIDC SAML API access control Solution overview Terms and definitions Request processing API access control in detail Tech-Client management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Solution overview Solution overview The following diagram shows how a request is processed by the Airlock Gateway using API keys with Airlock IAM.  Info The focus of the following is on API key-based access control. All other API protection features - such as filtering or enforcing" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006391.html", "title": "Use-case 1 - Login", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password policies AD password policy via LDAP Use-case 1 - Login Use-case 1 - Login If configured, on each login of a user, his/her current password is checked against the password policy set in the AD. To retrieve the current policy, Airlock" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731198.html", "title": "Grants and flow configuration overview", "hits": [ "loginapp" ], "snippets": [ "verview Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Token Exchange Configuration Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435038594.html", "title": "Transaction approval", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Transaction approval Transaction approval The following flow diagram shows how transaction approval with Airlock 2FA works in general. It uses One-Touch as an illustration. Other methods (online and offline QR code or mobile-only variants) are not show" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006395.html", "title": "Use-case 3 - Password generation", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password policies AD password policy via LDAP Use-case 3 - PWD generation Use-case 3 - Password generation Airlock IAM is able to configure Extended String Generator plugins that generate passwords (password generator config plugin). For exa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416223.html", "title": "SLO exception in debug mode", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML SLO exception SLO exception in debug mode Exception:  Example FedLib: SPSingleLogout: SPSingleLogout.processLogoutRequest (...) com.sun.identity.plugin.session.Session Exception:  Example Current sessionID (...) does not match requested sessionID (...) Reason: The SP has mu" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233444255.html", "title": "Installation (example)", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs H2 Standard deployment Installation (example) Installation (example)  Notice Installation Hints The following installation instructions for Linux are thought as installation hint / example and do not come with any guarantee by Ergon/Airlock. Free s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416239.html", "title": "IDP entity ID not found in SP", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML Entity ID not found IDP entity ID not found in SP Exception (on SP, with Artifact Binding):  Example SAML2 Exception: Couldn't find IDP based on the SourceID in the artifact.  Example com.sun.identity.saml2.common.SAML2Exception: Couldn't find IDP based on the SourceID in " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815244.html", "title": "Configuration, authentication and access control", "hits": [ "loginapp" ], "snippets": [ "implementation STET PSD2 About tech clients Data model Supported authn. types Tech-clients management Config. and access ctrl. Examples Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Tech-clients management Config. and access ctrl. Configuration, authentication and access control For configuration and REST client authentication, please refer to the information about the Adminapp REST API on IAM REST APIs . In the Adminapp main co" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960574.html", "title": "REST behavior of permanent and temporary locking during authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504893.html", "title": "User attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins User attributes User attributes The next table shows user-related attributes. They are relevant for the LDAP Connector plugin. Attribute name (examples) Usage Type LDAP Connector plugin LDAP Token List Persister plugin LD" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415630.html", "title": "Manage existing mobile phone numbers", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods mTAN/SMS mTAN/SMS services Manage mobile numbers Manage existing mobile phone numbers Goal of this workflow Let the logged-in user manage the phone numbers used for authentication. Outline of workflow The user must be logged in to use this self-service: Open the s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496008.html", "title": "Storing sensitive configuration values using the IAM CLI (command-line interface)", "hits": [ "loginapp" ], "snippets": [ "ration secrets Storing values with Config Editor Storing values using CLI Keystore tools Technical information IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management External configuration secrets Storing values using CLI Storing sensitive configuration values using the IAM CLI (command-line interface) Use the following IAM CLI commands to list and set sensitive configuration values:  Example Example: Print Usage Message $ iam sensitive-" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945503.html", "title": "Getting issuer certificates for PSD2", "hits": [ "loginapp" ], "snippets": [ "APIs Identity propagation Terms and conditions PSD2 support PSD2 implementation NextGenPSD2 implementation STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support Issuer cert. for PSD2 Getting issuer certificates for PSD2 The European Payment Services Directive relies for its security on PKI technology. To establish trust all participants are required to verify each others certificates. To execute the verification the CA certifi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375385829.html", "title": "Loginapp UI as OAuth or OIDC client configuration", "hits": [ "loginapp" ], "snippets": [ "Loginapp UI as OAuth or OIDC client configuration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OI" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1675772875165.html", "title": "Using environment variables in the configuration", "hits": [ "loginapp" ], "snippets": [ "g automation Config environments Configuration variables Configuration contexts External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration variables Using environment variables in the configuration Configuration variables make it possible to outsource parts of the configuration to environment variables. Configuration variables are resolved at configuration activation time during the startup of Airlo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1592482454621.html", "title": "Using multiple apps in one service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Solution overview Multiple apps in one service Using multiple apps in one service Multiple different apps may be used at the same time with the same Airlock 2FA service. but some restrictions apply. Migration of apps is a use case scenario where the a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945417.html", "title": "Message provider configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233443456.html", "title": "Step 1 – Access the Config Editor", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 1 – Access the Config Editor Step 1 – Access the Config Editor Open the Airlock IAM Adminapp URL in a web browser. Select the UI language if required.  Info To find out the Adminapp URL use the command iam info -i  in the" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1720717695995.html", "title": "OAuth 2.0/OIDC consent management", "hits": [ "loginapp" ], "snippets": [ "OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent Local consent Consent management Remote consent apps ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP OAuth consent Consent management OAuth 2.0/OIDC consent management Consent management self-service in Loginapp Users are asked to deny or grant" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413804.html", "title": "Initial authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens Usage Configuration Usage of Device Token Initial authentication Device Token registration test Register Device Token Device Token authn. SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496016.html", "title": "Recommended use cases for configuration contexts", "hits": [ "loginapp" ], "snippets": [ "commended use cases Non-recommended use cases Config contexts vs. IAM instances External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Best practices Recommended use cases Recommended use cases for configuration contexts The following use cases are good examples of what configuration contexts were designed for.  Info Common properties of recommended use cases The configuration context " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233444265.html", "title": "Using the embedded H2 database", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs H2 Embedded H2 Using the embedded H2 database IAM may be started with an embedded H2 database which can be used for testing and demoing. It roughly offers the following features: Implemented as “IAM module” (like the Loginapp, Adminapp, etc.). H" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496028.html", "title": "Planning configuration contexts", "hits": [ "loginapp" ], "snippets": [ "contexts Planning configuration contexts Configuration and usage Best practices External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Planning configuration contexts Planning configuration contexts The use of configuration contexts requires thorough planning and careful configuration. The following content guides you through those two stages. Step 1 - Determine the configuration contex" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341395075.html", "title": "Organizations, services, and admin roles", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Airlock 2FA Futurae service setup Organizations / services / admin roles Organizations, services, and admin roles In order to create Futurae service accounts to use Airlock 2FA, access to Futurae's admin web interface is required. To keep security up, " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1691686261636.html", "title": "FIDO passkey management self-service configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142537.html", "title": "Customization of the Loginapp UI layout using default HTML files", "hits": [ "loginapp" ], "snippets": [ "Customization of the Loginapp UI layout using default HTML files Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006397.html", "title": "Necessary rights of the service account for password change/reset", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password policies AD password policy via LDAP Rights to service PWD change/reset Necessary rights of the service account for password change/reset The password change is carried out by the service account user. It cannot be carried out by the" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1702894079228.html", "title": "Password end-to-end encryption configuration with AWS KMS in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Password end-to-end encryption configuration with AWS KMS in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416169.html", "title": "Using header tokens for session tracking", "hits": [ "loginapp" ], "snippets": [ "ader-based session tracking Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Flow auth. API with Gateway sessions Session tracking Header-based session tracking Using header tokens for session tracking In this configuration example, we use HTTP header tokens between the REST client and Airlock Gateway to track sessions. This is " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435037857.html", "title": "Transaction approval with Airlock 2FA", "hits": [ "loginapp" ], "snippets": [ "ock 2FA Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415596.html", "title": "Secret question example screen flows", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions Example screen flows Secret question example screen flows Chapter content Screen flow 1: Enable secret questions in Adminapp Screen flow 2: Record answers from the user Screen flow 3: U" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1660804711176.html", "title": "Front-Side Kerberos configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Front-Side Kerberos configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1659942663176.html", "title": "Adding SAML IDP to the SP configuration for the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Adding SAML IDP to the SP configuration for the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Prerequisites SP configuration Add SAML IDP SP Advan" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945538.html", "title": "User-group dependent settings", "hits": [ "loginapp" ], "snippets": [ "ettings Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813003.html", "title": "IAM OAuth 2.0 authorization server settings with remote consent", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 OAuth AS settings with remote consent IAM OAuth 2.0 authorization server settings with remote consent Airlock IAM's AS (OAuth Authorization Server) must be configured for STET. It includes configuring the following Steps: General AS " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435032961.html", "title": "Usage examples of REST authentication API", "hits": [ "loginapp" ], "snippets": [ "ion API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636414242.html", "title": "Session tracking", "hits": [ "loginapp" ], "snippets": [ "REST request / response Session tracking REST API Next Step Codes Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) General information Session tracking Session tracking The flow state machine keeps track of the state (possible next steps, tags, red flags, etc.) in a session. A session is referenced by the REST client using either (depending on configuration): An HTTP Cookie An HTTP head" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668114928.html", "title": "Terms and definitions", "hits": [ "loginapp" ], "snippets": [ "tion Self-services Target applications OAuth and OIDC SAML API access control Solution overview Terms and definitions Request processing API access control in detail Tech-Client management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Solution overview Terms and definitions Terms and definitions API An application programming interface (API) is an interface or communication endpoint and defines how software components interact. Concerning the Airlock Gateway (WAF), we use the term API to denote a set of service e" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416039.html", "title": "The Airlock 2FA message provider", "hits": [ "loginapp" ], "snippets": [ "rovider Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435031075.html", "title": "Parameter step and message providers", "hits": [ "loginapp" ], "snippets": [ "oviders Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572346.html", "title": "Role-based access control example", "hits": [ "loginapp" ], "snippets": [ "M as PDP Airlock Gateway as Policy Enforcement Point Sources of roles Author. of internal services Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Access control (end-users) Basic access control concepts Role-based AC example Role-based access control example This example demonstrates how roles can be used to manage access to different target applications. The following picture shows a simple architecture sketch, where Airloc" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731266.html", "title": "Session management usage", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816683.html", "title": "Log rotation", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Generating log outputs Log rotation Log rotation Most log files are rotated daily. The Application parameters containing rotate.max-days can be used to configure the maximum number of log files to keep. Note that because of technical limitations, web server log file rotation may behave diff" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1757609592984.html", "title": "Use case: FIDO passkeys as first auth factor in IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in IAM FIDO as first factor Use case: FIDO passkeys as first auth factor in IAM This article explains how to use FIDO passkeys as a first authentication factor. This can be both in parallel with password authentication or as a standalone authe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960623.html", "title": "Adminapp REST API", "hits": [ "loginapp" ], "snippets": [ "EST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945410.html", "title": "User self-registration REST API", "hits": [ "loginapp" ], "snippets": [ "EST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in after self-registration Stealth mode for self-registration Self-registration example CAPTCHAs Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp U" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1710781866628.html", "title": "Local consent", "hits": [ "loginapp" ], "snippets": [ "OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent Local consent Consent management Remote consent apps ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP OAuth consent Local consent Local consent Asking end users for their consent to scopes explicitly is at the core of the OAuth 2.0 and OpenID Co" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731212.html", "title": "Loginapp UI configuration", "hits": [ "loginapp" ], "snippets": [ "Loginapp UI configuration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR conf" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006429.html", "title": "Cronto activation letter generation", "hits": [ "loginapp" ], "snippets": [ "eration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration RADIUS server Cronto activation letters Airlock 2FA letter generation task Matrix card generation Customizing text elements Remember-Me token cleanup Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Service Container Configuration Cronto activation letters Cronto activation letter generation Cronto activation letters are generated by the Token Task " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652877890324.html", "title": "Voluntary password change authentication flow", "hits": [ "loginapp" ], "snippets": [ "on flow Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375385051.html", "title": "Cronto message custom formatting", "hits": [ "loginapp" ], "snippets": [ "matting Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Customizing text elements Cronto message custom formatting Proof of transaction approval IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Transaction Approval Configuration Cronto message custom formatting Cronto message custom formatting This chapter explains how to customize the visual appearance of Cronto messages an" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572492.html", "title": "Customization with Loginapp Design Kit", "hits": [ "release notes", "loginapp" ], "snippets": [ "port new IAM features published after the new Loginapp Design Kit has been made available. All IAM customers and partners were informed via an email newsletter in January 2026. More information will be provided as available in the release videos and release notes of new releases. The scope of the Loginapp Design Kit is: UI styling using SCSS Adjusting translations Changing the layout (header/footer/content) Modifying existing product pages Adding new pages Chapter content Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Design Kit upgrade procedure", "Customization with Loginapp Design Kit Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Security aspects Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation m" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960535.html", "title": "Active Directory configuration", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. AD configuration Active Directory configuration This section outlines the required settings in Active Directory to run Front-side Kerberos. Ergon recommends using the best encryption type possible (currently AES 256). This guide describe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945262.html", "title": "Performance tuning and scaling best practices", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Performance tuning Performance tuning and scaling best practices There are various aspects that influence the performance and ability to scale an Airlock IAM system depending on the precise usage scenario. This article highlights the most common bottlenecks. Audit log In Airlock IAM audit lo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1723740206631.html", "title": "Escaping HTML values in emails", "hits": [ "loginapp" ], "snippets": [ " emails Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435052424.html", "title": "Advanced configuration of Airlock Gateway for Airlock IAM", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway configuration Advanced Gateway configuration Advanced configuration of Airlock Gateway for Airlock IAM Expert Settings for enabling HTTP Keep-Alive for SSL Connections to Airlock IAM If the connection to the back-end is SSL protected, " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812943.html", "title": "Gateway configuration for bank API calls", "hits": [ "loginapp" ], "snippets": [ "ser consent IAM configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration Gateway configuration Gateway configuration for bank API calls Gateway configuration for bank API calls The “Bank API Calls” (calls from the TPPs to the bank's PSD2 APIs) require the following Gateway configuration: Chapter " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415598.html", "title": "Screen flow 1: Enable secret questions in Adminapp", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions Example screen flows Enable secret question Screen flow 1: Enable secret questions in Adminapp This section flow shows how to add a secret questions token to an existing user and how to" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415622.html", "title": "Self-migration to mTAN/SMS", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods mTAN/SMS mTAN/SMS services Self-migration Self-migration to mTAN/SMS Goal of this workflow Mark users that should change the authentication method from another 2nd factor to mTAN/SMS and let them migrate at the next login (or by a specific point in time). Outline " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1750301320272.html", "title": "User management in the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management User search Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415216.html", "title": "IAM account creation based on remote IDP data (social registration)Â", "hits": [ "loginapp" ], "snippets": [ "DC Introduction IAM as AS/OP IAM as Client/RP Claims (user attributes) Account linking Social registration Mobile app use case Example: SPA (single-page application) Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as Client/RP Social registration IAM account creation based on remote IDP data (social registration) This feature allows to automatically create IAM accounts based on the provider's data. The created account is stored in the Loginapp's user repository.  Notice This feature requi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613465988623.html", "title": "FIDO token registration - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1755485390167.html", "title": "Transaction Approval with FIDO2", "hits": [ "loginapp" ], "snippets": [ "h FIDO2 Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404704.html", "title": "Terms and definitions in user representation", "hits": [ "loginapp" ], "snippets": [ " definitions Use cases System design Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation Terms and definitions Terms and definitions in user representation representer Loginapp The part of an Airlock IAM instance that authenticates e.g. support-users before they can access the representer application. representer application An application in the represe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496006.html", "title": "Storing sensitive configuration values using the Config Editor", "hits": [ "loginapp" ], "snippets": [ "ration secrets Storing values with Config Editor Storing values using CLI Keystore tools Technical information IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management External configuration secrets Storing values with Config Editor Storing sensitive configuration values using the Config Editor Use the Secure External Storage Manager - it can be opened in two ways: Click on the  button in the toolbar. The dialog supports adding, removing," ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504091.html", "title": "Loginapp Configuration", "hits": [ "loginapp" ], "snippets": [ "Loginapp Configuration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1691686282380.html", "title": "Self-sovereign identities (SSI)", "hits": [ "loginapp" ], "snippets": [ "ssages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) SSI configuration hints Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Self-sovereign identities (SSI) Self-sovereign identities (SSI) SSI overview Self-Sovereign Identities (SSI) is the underlying standard for the new E-ID in Switzerland and the EUDI in the European Union. The legal base is expected to be put into force in 2026/2027 and the technical stan" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413587.html", "title": "Successful authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1629119839488.html", "title": "Latest login information in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Latest login information in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421874953.html", "title": "Generic Token Controller UI configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller Generic token REST endpoint UI configuration User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements L" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1610721891198.html", "title": "Use case: FIDO passwordless (usernameless) authentication in IAM", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO in IAM FIDO passwordless authentication Use case: FIDO passwordless (usernameless) authentication in IAM This article explains, on a conceptual level, how to authenticate end-users using FIDO passwordless as the sole factor (no username, no pa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945300.html", "title": "User data source configuration", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration User data source configuration User data source configuration Configuration of user directories The user directory is configured with property MAIN SETTINGS >> Data Sources : The above example shows an LDAP Connector as the main user data source.  Notice Configuration Templates " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142561.html", "title": "Adding new pages", "hits": [ "loginapp" ], "snippets": [ "w pages Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Customizing an existing product page Adding new pages HTML rendering and template variables Internationalization and translatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731238.html", "title": "Resource access with access token", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security b" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413591.html", "title": "Error in the first authentication factor", "hits": [ "loginapp" ], "snippets": [ " factor Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945498.html", "title": "HTTP request signature verification for STET", "hits": [ "loginapp" ], "snippets": [ "iguration Signature scope Other config properties TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 HTTP request signature verification HTTP request signature verification for STET This document describes how to use the plugin (within the Loginapp's one-shot feature HTTP request authentication (One-Shot flow) ) in order to provide STET compliant HTTP signa" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496018.html", "title": "Non-recommended use cases for configuration contexts", "hits": [ "loginapp" ], "snippets": [ "commended use cases Non-recommended use cases Config contexts vs. IAM instances External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Best practices Non-recommended use cases Non-recommended use cases for configuration contexts  Notice The following use cases are not recommended but are known to work in controlled setups. Keep in mind the following, when implementing them: The configu" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945307.html", "title": "MSSQL as Airlock IAM database", "hits": [ "8.5.", "8.4.", "loginapp" ], "snippets": [ "hema-migration-8_6-8_7.sql Upgrades IAM 8.6 database schema for release IAM 8.7. iam-schema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator “admin” with password “password” (works with demo configuration).  Notice For performance tuning hints, see: Performance tuning and scaling best practices JDBC connector (JDBC driver) Look up the JRE release version installed with Airlock IAM: Read the release file in the /jre folder of the IAM installation with the following command.  Terminal box cat /", "hema-migration-8_5-8_6.sql Upgrades IAM 8.5 database schema for release IAM 8.6. iam-schema-migration-8_4-8_5.sql Upgrades IAM 8.4 database schema for release IAM 8.5. iam-schema-migration-8_3-8_4.sql Upgrades IAM 8.3 database schema for release IAM 8.4. insert-admin.sql Inserts an administrator “admin” with password “password” (works with demo configuration).  Notice For performance tuning hints, see: Performance tuning and scaling best practices JDBC connector (JDBC driver) Look up the JRE release version installed with Airlock IAM: Read the release file in the /jre folder of the IAM installation with the following command.  Terminal box cat /opt//jre/release OR Run the command java -version in the /jre/bin f", "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs MSSQL MSSQL as Airlock IAM database This page describes how to use an MSSQL database with the Airlock IAM database schema. In order to use Airlock IAM with this database, a JDBC connector/driver library is required.  Notice The chosen data layer ha" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816711.html", "title": "Reporting attributes", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Log message formats Structured log format Reporting attributes Reporting attributes In Elasticsearch, all structured log documents use the “airlock-iam” index template / mapping which specifies all fields. Key Description Example action_group action_group combines different actions into " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945539.html", "title": "Access control to the Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Segregation of duties Segregation of users Privilege escalation p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1593183841299.html", "title": "Mapping for one-shot authentication", "hits": [ "loginapp" ], "snippets": [ "ication Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication Mapping for one-shot authentication One-shot authentication with flows One-shot authentication with authenticators Front-Side Kerberos configuration MS-OFBA configuration OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435050781.html", "title": "Configuration of application and service mappings", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway configuration Application/service mappings Configuration of application and service mappings Depending on the used IAM features, use the corresponding Denied Access URL and Authentication Flow in the Airlock Gateway mapping of the appl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1610721896043.html", "title": "Simple FIDO authentication example", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys Simple FIDO example Simple FIDO authentication example Requirements The end-user requires a FIDO-compliant authenticator or passkey . The end-user needs access to a client device like a smartphone with a FIDO-enabled app or a computer with a web br" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504093.html", "title": "Adminapp Configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management User search Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Digipass OTP in Users menu Digipass OTP in Tokens menu Digipass admin use-cases Matrix card management Remember-Me configuration Generic token controller Generic token REST endpoint UI configuration User Management Extensions Example: Hello World" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1721740988070.html", "title": "OAuth 2.0 OIDC Configuration override", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP OAuth 2.0 OIDC Configuration override OAuth 2.0 OIDC Configuration override Different clients may have different requirements. To meet this req" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668112711.html", "title": "Authentication factors", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors Authentication factors Airlock 2FA allows authenticating users in different ways: Factor Description One-Touch Pushes a message to the user's smartphone and asks the user to approve by pressing a button. Online QR code Scan a QR " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849690675.html", "title": "About the MS-OFBA protocol", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Interaction models One-shot (interaction model) MS-OFBA authentication MS-OFBA protocol About the MS-OFBA protocol MS-OFBA Protocol When using a setup of an Airlock Gateway and Airlock IAM , these components take over the complete handling of the MS-OFBA protocol. The target MS-SharePo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142505.html", "title": "Changing the Loginapp UI appearance with the Design Kit", "hits": [ "8.4.", "loginapp" ], "snippets": [ "d input field. To enable the toggle, add the variable $iam-show-password-toggle to the _custom-variables.scss file and set it to true (the default is false):  Example $iam-show-password-toggle: true;  Notice This feature is available as of release 8.4. To enable the feature in an older SDK setup, store the eye icons as svg files under $CUSTOM_DIRECTORY/src/assets/custom/img . Use the following file names: eye-regular.svg eye-slash-regular.svg Additionally, refer to the “old” src folder from a newer SDK setup (version 8.4 or higher). Once you have deployed this change, the “Show Password” toggle is visible in the Password input field on the username/password login and password reset pages of your web application: /> One-Shot Authentication ) A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1600698220464.html", "title": "Token migration enrollment", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token enrollment Token migration enrollment Token migration enrollment This article explains how an end-user can enroll an Airlock 2FA device/token without an activation letter. The end-user is first authenticated and can then enroll an Airlock 2FA dev" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945437.html", "title": "Securing REST APIs/service APIs", "hits": [ "loginapp" ], "snippets": [ "hot Request flow Configuration with JWT Authenticate apps with Device Tokens OAuth 2 for native apps Request flow Configuration Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Securing REST APIs/service APIs This tutorial shows different ways how to protect REST APIs using the Airlock Secure Access Hub . It is especially thought for protecting APIs used by mobile apps . Further information about the REST API (especially Authe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328144202.html", "title": "User enumeration protection in the public self-service flows", "hits": [ "loginapp" ], "snippets": [ "e flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341380787.html", "title": "Hardware tokens for Airlock 2FA", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Solution overview Hardware tokens Hardware tokens for Airlock 2FA Airlock 2FA supports hardware tokens for authentication and transaction approval. They are typically used as an alternative to the Airlock 2FA app (or a custom smartphone app) for the fo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1693917403479.html", "title": "Airlock Microgateway for Airlock IAM configuration", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Microgateway configuration Airlock Microgateway for Airlock IAM configuration One primary use case for Airlock Microgateway is to protect applications such as Airlock IAM against attacks. For Airlock IAM to operate correctly, it requires infor" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495500.html", "title": "Sending logs to syslog", "hits": [ "loginapp" ], "snippets": [ " Operation Initial configuration Configuration files Instances directory Config Editor quickstart guide Gateway - Microgateway configuration User data source configuration Logging configuration Logging parameters Log4j 2 configuration files Changing Loginapp log level Logging to stdout only Sending logs to syslog Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Logging configuration Log4j 2 configuration files Sen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415280.html", "title": "Airlock Gateway as Policy Enforcement Point", "hits": [ "loginapp" ], "snippets": [ "M as PDP Airlock Gateway as Policy Enforcement Point Sources of roles Author. of internal services Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Access control (end-users) Basic access control concepts Role-based AC example Airlock Gateway as Policy Enforcement Point Airlock Gateway as Policy Enforcement Point The Airlock Gateway acts as Policy Enforcement Point for access decisions. It decides for each request whether the" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1678772784676.html", "title": "JWKS signature verifier settings for one-shot authenticator", "hits": [ "loginapp" ], "snippets": [ "ticator Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication Mapping for one-shot authentication One-shot authentication with flows One-shot authentication with authenticators JWKS signature verifier settings Front-Side Kerberos configuration MS-OFBA configuration OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416175.html", "title": "Configuration using JWT bearer tokens", "hits": [ "loginapp" ], "snippets": [ "hn. API with JWTs and one-shot Request flow Configuration with JWT Authenticate apps with Device Tokens OAuth 2 for native apps Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs Flow authn. API with JWTs and one-shot Configuration with JWT Configuration using JWT bearer tokens This article describes how to configure Airlock IAM and Airlock Gateway for using JWT bearer tokens with one-shot authentication. Client authentication a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812945.html", "title": "Virtual host", "hits": [ "loginapp" ], "snippets": [ "ser consent IAM configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration Gateway configuration Gateway configuration for bank API calls Virtual host Virtual host Configure a virtual host to expose the bank's PSD2 APIs to the TPP using an SSL server certificate. Enable “Client Certificate Verificati" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710335.html", "title": "Upgrade a single installation", "hits": [ "loginapp" ], "snippets": [ "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Upgrade Airlock IAM Upgrade a single installation Upgrade a single installation The following example describes the most common upgrade situation in which a single Airlock IAM has been installed and can be upgraded with a newer IAM version. We assume, that an instance name aut" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668115382.html", "title": "Request processing", "hits": [ "loginapp" ], "snippets": [ "tion Self-services Target applications OAuth and OIDC SAML API access control Solution overview Terms and definitions Request processing API access control in detail Tech-Client management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Solution overview Request processing Request processing The following flow diagram shows how a request sent by a Tech-Client is processed by the Airlock Gateway when applying access control based on API keys. Prerequisites The Tech-Client is in possession of an API key issued by Air" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404684.html", "title": "Maintenance Message Locations", "hits": [ "loginapp" ], "snippets": [ "ion Configuration management Authentication Interaction models Authentication methods Remember-Me Step-Up authentication Risk-based authentication Failed logins and temp locking Username transformation Maintenance messages Management Examples in the Loginapp Usage and limitations Locations User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Maintenance messages Locati" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668118336.html", "title": "Tech-Client management", "hits": [ "loginapp" ], "snippets": [ "ement Authentication Self-services Target applications OAuth and OIDC SAML API access control Solution overview Tech-Client management Profile management Plan management API key management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Tech-Client management Tech-Client management Tech-Clients are managed in the Airlock IAM Adminapp or over the Adminapp REST API . Prerequisites Tech-Client management must be enabled in the IAM Adminapp configuration. The administrator must have the required privileges to manage te" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1662655608015.html", "title": "Additional and custom attributes", "hits": [ "loginapp" ], "snippets": [ "ributes Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation menu configuration Page settings configuration Additional and custom attributes Response mocking configuration Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945314.html", "title": "Microsoft Active Directory for IAM", "hits": [ "loginapp" ], "snippets": [ "roubleshooting Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Active Directory Microsoft Active Directory for IAM Airlock IAM can be used with MSAD (Microsoft Active Directory) in several ways, depending on how end-users are authenticated. Authentication setup and MSAD recommendation Username and password-only authentication" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504907.html", "title": "Password reset-related attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins PW reset-related attributes Password reset-related attributes The next table shows attributes related to password resets. They are relevant for the LDAP Password Self-Service Token Persister plugin. Attribute name (exampl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613069310944.html", "title": "Usage of simple realm administration", "hits": [ "loginapp" ], "snippets": [ "tration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Simple realm admi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945485.html", "title": "PSD2 support", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support PSD2 support What is PSD2? With the PSD2 EU Directive - the 2nd Payment Services Directive - the European Union regulates the interaction between so-called TPPs (Third Party Provider; e.g. a fintech company) and banks through APIs. This page documents to what extent an" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1612361353459.html", "title": "FIDO configuration overview", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys Configuration overview FIDO configuration overview This article describes how FIDO features are configured in Airlock IAM .  Info For details about configuration please refer to the plugin and property descriptions in the Config Editor. The FIDO S" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1786675736253.html", "title": "Before you start", "hits": [ "loginapp" ], "snippets": [ "u start Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Role-based access control Realm-based access control Realm administration Before you start " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1720717696063.html", "title": "OAuth 2.0 claims", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP Claims OAuth 2.0 claims Claims are used in tokens to provide information to clients (ID token) and to resources (access token). The configurati" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849688264.html", "title": "One-shot target application configuration for MS-OFBA", "hits": [ "loginapp" ], "snippets": [ "MS-OFBA Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication Mapping for one-shot authentication One-shot authentication with flows One-shot authentication with authenticators Front-Side Kerberos configuration MS-OFBA configuration OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006427.html", "title": "Cronto Token Controller configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945256.html", "title": "Reference architecture", "hits": [ "loginapp" ], "snippets": [ "ectories Overview of interfaces Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses About Reference architecture Reference architecture The following diagram shows how Airlock IAM and Airlock Gateway are used together. It also shows example usages of some IAM features." ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613466017331.html", "title": "OpenID Connect Session Management 1.0 overview", "hits": [ "loginapp" ], "snippets": [ " OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OIDC session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP Session management OIDC session management OpenID Connect Session Management 1.0 overview Airlock IAM implements the OpenID Connect Session Man" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920815252.html", "title": "Delete API client", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Tech-clients management Examples Delete API client Delete API client The following call is used to remove a technical client from the IAM database: HTTP Request: Delete a Technical Client  Terminal box DELETE /auth-admin/rest/tech-clients/616b45df-5" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233446998.html", "title": "Installation and upgrade", "hits": [ "loginapp" ], "snippets": [ "er installation arrangements Gateway mapping upgrade Upgrade IAM with Docker Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Installation and upgrade Hardware requirements Recommended hardware profiles for Airlock IAM (valid for OS installation and deployment with Docker): Minimum requirements Minimum (for demo purposes) 1 CPU 2.0 GHz 4 GB RAM Low Up to 5 logins/sec 1 x 4-Core CPU 3.0 GHz 8 GB RAM " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1702894079224.html", "title": "Password end-to-end encryption configuration with Java key store in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Password end-to-end encryption configuration with Java key store in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1613466041717.html", "title": "Session-less protected REST APIs", "hits": [ "loginapp" ], "snippets": [ "ST APIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1636653086505.html", "title": "Remember-Me in authentication flows", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Remember-Me Remember-Me in authentication flows The Airlock IAM Remember-Me solution allows for simplifying authentication flows for the users based on persistent cookies stored in the user's web browser (or any other client). When activated, it stores a persistent cookie in the browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945354.html", "title": "Client certificate for browser authentication (X.509)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Client cert. authn (X.509) Client certificate for browser authentication (X.509) Airlock IAM can authenticate users by verifying X.509 client certificates. A client certificate can be used in the SSL handshake by the browser to authenticate the user already while " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710424.html", "title": "Troubleshooting", "hits": [ "loginapp" ], "snippets": [ "ker image Container deployment Use cases Troubleshooting Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade IAM as Docker image Troubleshooting Troubleshooting This troubleshooting chapter explains how to identify and resolve common issues. Bind mounts and permissions The previous examples use simple bind mounts with the “-v” option. For integration and testing, bind mounts are " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731835.html", "title": "Airlock IAM as OAuth Authorization Server (AS)/OpenID Provider (OP)", "hits": [ "loginapp" ], "snippets": [ "uth consent Local consent Consent management Remote consent apps Remote consent protocol ACR PAR PKCE Client authentication DCR Session management OIDC session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approva" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812985.html", "title": "TPP client registration (interaction model)", "hits": [ "loginapp" ], "snippets": [ "for STET PSD2 HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 Interaction models TPP client registration TPP client registration (interaction model)  Info The following diagram illustrates the interaction between the TPP and IAM to register the TPP's OAuth 2.0 Client with the bank. Step Name Component Description 1 Che" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849683610.html", "title": "Mobile-only authentication (app-to-app or SDK)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors Mobile-only auth (app-to-app / SDK) Use case Mobile-only authentication (app-to-app or SDK) This article explains on a conceptual level how Airlock 2FA mobile-only authentication works. It covers both the app-to-app and the SDK u" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812967.html", "title": "Other config properties", "hits": [ "loginapp" ], "snippets": [ "res Configuration Signature scope Other config properties TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation HTTP signature verification Configuration Other config properties Other config properties Property Value Description HTTP Signature Certificate Loader “HTTP Signature X.509 Certificate Header Loader” with header name “TPP-Signature-Cert" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495514.html", "title": "Identity propagation", "hits": [ "loginapp" ], "snippets": [ "agation Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849712101.html", "title": "Airlock 2FA change device name - REST flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services Configuration of self-services Usage of self-services Example config for self-services Change device name for 2FA FIDO token registration FIDO passkey management self-service configuration Digipass OTP activation User representation (representer side) Session-less protected REST APIs Lockout Self-Service in the Loginapp REST API/UI Browser" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1639690251538.html", "title": "Flow authentication with the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "Flow authentication with the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1629119835241.html", "title": "Application Portal configuration in the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "Application Portal configuration in the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services User representation (representer side) Application porta" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1699611532188.html", "title": "Online QR code authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors Online QR code auth Use case Online QR code authentication This article explains on a conceptual level how Airlock 2FA online QR code authentication works. It also provides important detailed information for correct use and confi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960638.html", "title": "Usage - User self-registration flows", "hits": [ "loginapp" ], "snippets": [ "n flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in after self-registration Stealth mode for self-registration Self-registration example CAPTCHAs Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp U" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495508.html", "title": "Requirements for a secure configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1655396277715.html", "title": "Step 3 – Load demo configuration", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Config Editor quickstart guide Step 3 – Load demo configuration Step 3 – Load demo configuration In this quick guide, we use the Demo configuration template that is included in every Airlock IAM installation. To apply the Demo configuration : In the toolbar, click on the New " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415664.html", "title": "Flow tags and red flags", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Flow tags and flags Flow tags and red flags Tags are properties acquired during a flow and they are stored in the flow session. Tags can be used to control the flow and act as guards ensuring particular steps have successfully completed. The following attributes are stored " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1702894079226.html", "title": "Password end-to-end encryption configuration with HSM in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Password end-to-end encryption configuration with HSM in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893496010.html", "title": "Using standard keystore tools", "hits": [ "loginapp" ], "snippets": [ "ration secrets Storing values with Config Editor Storing values using CLI Keystore tools Technical information IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management External configuration secrets Keystore tools Using standard keystore tools Airlock IAM uses JCEKS keystores as the default type for external secrets. Standard tools i.e. keytool can be used to manage secrets and to create new keystores. See the keytool man pages for details. " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1720717695604.html", "title": "PKCE configuration for IAM as OAuth 2.0/OIDC authorization server", "hits": [ "loginapp" ], "snippets": [ " server Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration Non-interactive OIDC authenti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495520.html", "title": "Security considerations Docker container usage", "hits": [ "loginapp" ], "snippets": [ "r usage Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best practices Docker security Security considerations Docker container usage When running Airlock IAM as a Docker" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1580218960537.html", "title": "One-shot vs. redirect flow", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. One-shot vs. redirect flow One-shot vs. redirect flow Airlock Gateway supports different types of authentication flows: Redirect: the browser is redirected to access Airlock IAM for authentication. One-Shot: the browser is not redirected" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416189.html", "title": "SAML web browser SSO with POST binding", "hits": [ "loginapp" ], "snippets": [ "uth and OIDC SAML Terms and definitions SSO with POST binding SSO with HTTP artifact binding SAML Single Logout (SLO) HTTP Proxy for artifact binding Asynchronous public key renewal Troubleshooting SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML SSO with POST binding SAML web browser SSO with POST binding With POST binding the SAML assertion issued by the Airlock IAM (IDP) is transmitted through the clients' web browser to the SP. If possible, Artifact Binding should be used for various reasons (see below). (Optional; this step can be s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495516.html", "title": "Self-services", "hits": [ "loginapp" ], "snippets": [ "ervices Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945303.html", "title": "Relational databases for IAM", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Relational DBs Relational databases for IAM Chapter content Oracle as Airlock IAM database MySQL as Airlock IAM database MariaDB as Airlock IAM database MSSQL as Airlock IAM database PostgreSQL as Airlock IAM database H2 as Airlock IAM database Airlock IAM databas" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812947.html", "title": "API mapping", "hits": [ "loginapp" ], "snippets": [ "ser consent IAM configuration HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration Gateway configuration Gateway configuration for bank API calls API mapping API mapping For each type of bank API call (e.g. “/accounts”, “/payments”, “/consents”/) a mapping with the following PSD2-specific settings " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416249.html", "title": "Recommendations for using OAuth and OIDC", "hits": [ "loginapp" ], "snippets": [ "rget applications OAuth and OIDC Introduction OAuth 2.0 grant types Usage recommendations Security best practices Terms and definitions IAM as AS/OP IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC Introduction Usage recommendations Recommendations for using OAuth and OIDC OAuth 2.0/OpenID Connect in general OAuth 2.0 / OpenID Connect must be considered a framework for designing solutions to delegate access. The framework allows for a lot of flexibility. For any solution designed " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893495528.html", "title": "HTTPS/TLS with authentication of IAM", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Securing with HTTPS HTTPS/TLS authn. HTTPS/TLS with authentication of IAM Configuration of Airlock Gateway The use of HTTPS/TLS in conjunction with a server certificate for IAM guarantees that only IAM can send commands using the Airlock Gatew" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375380545.html", "title": "Account linking and registration flow configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Account linking persister Authentication flows for account linking Account linking self-service Self-services UI Google a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416045.html", "title": "mTAN transaction approval example message", "hits": [ "loginapp" ], "snippets": [ "message Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1655396097020.html", "title": "Username password authentication in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Username password authentication in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Password E2EE JKS Password E2EE HSM Password E2EE A" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759810383.html", "title": "Password change self-service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password change self-service Password change self-service Airlock IAM knows two types of password change self-services: Voluntary password change The user chooses to change the password and enters the old and the new password. Airlock IAM pro" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731865.html", "title": "Protected self-service UIs", "hits": [ "loginapp" ], "snippets": [ "ice UIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services User representation (representer side) Application portal OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421886568.html", "title": "User Management Extensions (Adminapp) Send Message Example", "hits": [ "loginapp" ], "snippets": [ "Example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Example: Hello World Example: Send message Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649928967687.html", "title": "Email link password reset flow example (using flow continuation)", "hits": [ "loginapp" ], "snippets": [ "uation) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Simple password reset Complex password reset Email link password reset Reset locked users Secret questions Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Addit" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1645446434186.html", "title": "Limitations of SAML in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Limitations of SAML in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URL" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572406.html", "title": "Prerequisites to setup IAM as SAML IDP", "hits": [ "loginapp" ], "snippets": [ "AML IDP Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URLs Authentication contexts SAML Single Logout with temporary Gateway role Load balancing setup Keystore generation Limitations SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-sho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920816715.html", "title": "Reporting log attribute: Factor and factor_detail", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Log message formats Structured log format Reporting attributes factor / factor_detail Reporting log attribute: Factor and factor_detail factor Description factor_detail Description certificate Authentication factors based on X.509 certificates and PKI infrastructure. No factor details are p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142482.html", "title": "Page settings configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation menu configuration Page settings configuration Additional and custom attributes Response mocking configuration Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945292.html", "title": "Configuration contexts", "hits": [ "loginapp" ], "snippets": [ "commended use cases Non-recommended use cases Config contexts vs. IAM instances External configuration secrets IAM Config Editor (UI) Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management Configuration contexts Configuration contexts Configuration contexts are used to determine the specific configuration of Airlock IAM based on how IAM is accessed. Using this feature, it is possible for IAM to behave differently, e.g., based on the client or the target URL. Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945415.html", "title": "Transaction approval REST API", "hits": [ "loginapp" ], "snippets": [ "EST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Airlock 2FA message provider mTAN message provider Cronto Message Provider mTAN message example Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with em" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006409.html", "title": "Cronto activation", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto activation Cronto activation To end-users authenticating with Cronto, an activation cryptogram is typically sent by letter. This type of letter is called the activation letter and is the starting point for activating new devices and apps (f" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945512.html", "title": "Extra information in password (and similar) letters", "hits": [ "loginapp" ], "snippets": [ "letters Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Configuration Use in letters Security best practices Third-party licenses Customizing UIs and texts MSWord report templates Extra informations in pwd letters Extra information in p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945455.html", "title": "Creating a key store for SAML", "hits": [ "loginapp" ], "snippets": [ "or SAML Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URLs Authentication contexts SAML Single Logout with temporary Gateway role Load balancing setup Keystore generation Limitations SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-sho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1592482454424.html", "title": "Alternatives to the Airlock 2FA App", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Solution overview Alternative 2FA Apps Alternatives to the Airlock 2FA App Using Airlock 2FA is not limited to the Airlock 2FA app. You may use the following alternatives: White-label app Futurae offers the service to build a custom white-label app: ba" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1730261087847.html", "title": "Configuration files", "hits": [ "loginapp" ], "snippets": [ "teway - Microgateway configuration User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Configuration files Configuration files This article provides an overview of all the files that are available for configuration and parametrization after installing Airlock IAM. Standard file layout The following table describes the standard file layout of Airlock IAM after insta" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759947200.html", "title": "Health check endpoints, responses, and security", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics LR(S) probes Endpoints, responses, and security Health check endpoints, responses, and security Available endpoints The following table shows the endpoints available for health checks: Check Endpoint Liveness /health/live Readiness /health/ready The health " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142428.html", "title": "Quickstart guide", "hits": [ "loginapp" ], "snippets": [ "t guide Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Security aspects Design Kit installation Using the Design Kit CLI Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Custo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1639690253025.html", "title": "Translation of scopes configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Dynamic client registration Authentication flows Scope policies and filtering Translation of scopes configuration ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configu" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328140726.html", "title": "User enumeration protection", "hits": [ "loginapp" ], "snippets": [ "tection Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Authentication concepts Identity propagation Self-services User enumeration protection Escaping HTML values Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415594.html", "title": "How are secret questions used in Airlock IAM?", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions Usage of secret questions How are secret questions used in Airlock IAM? Secret questions are used in the Password reset self-service to verify the user identity.  Info MAIN USAGE Secr" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813901.html", "title": "Data model", "hits": [ "loginapp" ], "snippets": [ "t PSD2 implementation NextGenPSD2 implementation STET PSD2 About tech clients Data model Supported authn. types Tech-clients management Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Data model Data model Tech-clients are stored in the IAM database roughly using the following two-tiered structure: This data structure is two-tiered with the following intention: Tech-client: the principal entity that controls the tech-client includ" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945297.html", "title": "Configuration activation internals", "hits": [ "loginapp" ], "snippets": [ "onfigurations Configuration activation timeout Configuration activation internals Module filenames Examples of activation state files Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Configuration activation internals Configuration activation internals Overview This tutorial describes how configuration changes are activated in Airlock IAM.  Info Scope This information is about the main configuration ( iam-config.yaml or medusa-confi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945388.html", "title": "IAM REST APIs", "hits": [ "loginapp" ], "snippets": [ "ST APIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Request authentication REST call authn. with client certificates Customizing UIs and texts Security best practices Third-party licenses IAM REST APIs IAM REST APIs The following REST APIs are provided by Airlock IAM. REST API references API Reference In this documentation Loginapp REST API Reference Loginapp REST API Adminapp REST API Reference Adminapp REST API Transact" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421880439.html", "title": "Token Exchange service overview", "hits": [ "loginapp" ], "snippets": [ "e Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC Introduction IAM as AS/OP IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC Token Exchange service overview Token Exchange service overview Token Exchange is a service that is specified in RFC 8693 . The Token Exchange service is able to receive and validate security tokens and issue new security tokens in response. This exchange of security tokens serves many " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945277.html", "title": "IAM Config Editor (UI)", "hits": [ "loginapp" ], "snippets": [ "onfigurations Configuration activation timeout Configuration activation internals Module filenames Examples of activation state files Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) IAM Config Editor (UI) The Airlock IAM Config Editor is integrated in the Adminapp. To open the Config Editor, log in to the Adminapp and click the Configuration link in the menu (see the screenshot below).  Notice The admin user needs appropriate permi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759891602.html", "title": "Target application selection", "hits": [ "loginapp" ], "snippets": [ "tication Self-services Target applications Target application selection Access control (end-users) Securing REST / service APIs Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Target application selection Target application selection To protect target applications and services, the Airlock Gateway decides, based on its policy, whether an HTTP request has sufficient access rights or not. If not, the request is typically sent in one way or another to Airlo" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710428.html", "title": "Obtaining the Docker image", "hits": [ "loginapp" ], "snippets": [ "ker image Container deployment Use cases Troubleshooting Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade IAM as Docker image Obtaining the Docker image Obtaining the Docker image There are two ways to obtain Airlock IAM Docker images: By pulling the image directly from the (private image repository) quay.io.  Notice In Spring 2024, all IAM Docker images have been migrated from D" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1773337498149.html", "title": "IAM 8.7 - Required upgrade actions", "hits": [ "release notes", "loginapp" ], "snippets": [ "IAM 8.7 - Required upgrade actions Toggle navigation About Release and support Release notes Changelog Required upgrade actions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release an", "ctions Deprecation announcement Incubating features Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Release and support Required upgrade actions IAM 8.7 - Required upgrade actions This section describes changes in Airlock IAM 8.7 that may  require manual changes. Whether changes are necessary depends on the features used and/or custom extensions.  Notice Upgrading an Airlock IAM version may requir" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1629119825526.html", "title": "Logged-in after self-registration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Logged-in after self-registration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in after self-registra" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572484.html", "title": "User self-registration UIs", "hits": [ "loginapp" ], "snippets": [ "ion UIs Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST API" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404696.html", "title": "Using the PKCS #11 security provider", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password HSM support Using the PKCS #11 security provider Using the PKCS #11 security provider When launching Airlock IAM, the path to the java.security  file must be specified in JAVA_OPTS .  Example #in instances//instance.properti" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416179.html", "title": "Using OAuth 2 for native apps (RFC 8252)", "hits": [ "loginapp" ], "snippets": [ " Flow authn. API with JWTs and one-shot Authenticate apps with Device Tokens OAuth 2 for native apps Request flow Configuration Identity propagation Terms and conditions PSD2 support OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications Securing REST / service APIs OAuth 2 for native apps Using OAuth 2 for native apps (RFC 8252) This variant is thought for mobile apps that require persistent login (app is logged in for a long time, e.g. several months). Using the OAuth 2 refresh mechanism, this requirement can be " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1659429981007.html", "title": "Prerequisites to setup IAM as SAML SP", "hits": [ "loginapp" ], "snippets": [ "SAML SP Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Prerequisites SP configuration Add SAML IDP SP Advanced Configuration SAML SP URLs Keystore generation Limitations Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142502.html", "title": "Customization with the Design Kit", "hits": [ "loginapp" ], "snippets": [ "ign Kit Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance IAM HTML body attributes Change UI texts and translations Customization using flow, step, and tenant ID Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Additional API methods CAPTCHA customizing Customizing t" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1741268927271.html", "title": "Transaction approval with email OTP", "hits": [ "loginapp" ], "snippets": [ "ail OTP Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945426.html", "title": "Authentication of REST API calls with client certificates (X.509)", "hits": [ "loginapp" ], "snippets": [ "(X.509) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Request authentication REST call authn. with client certificates Customizing UIs and texts Security best practices Third-party licenses IAM REST APIs REST call authn. with client certificates Authentication of REST API calls with client certificates (X.509) This guide explains how to authenticate REST clients using X.509 client certificates by enforcing mutual authentica" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1589475710412.html", "title": "Using the container image", "hits": [ "loginapp" ], "snippets": [ "ker image Container deployment Use cases Troubleshooting Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade IAM as Docker image Container deployment Using the container image This section describes how to work with the Airlock IAM Docker image after completing the setup (see Running IAM with Docker ). It covers common configuration use cases for local environments. The examples use " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945528.html", "title": "Processing log output", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Processing log output Processing log output The following picture gives a conceptual overview of the logging and reporting pipeline. The logging mechanism in Airlock IAM supports multiple different use case scenarios: Docker – customers that want to integrate log output into docker environ" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1661841840378.html", "title": "Client fingerprinting-based lockout", "hits": [ "loginapp" ], "snippets": [ "lockout Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404738.html", "title": "Identity propagation in user representation", "hits": [ "loginapp" ], "snippets": [ "cation Identity propagation Auditing Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation System design Identity propagation Identity propagation in user representation After the SSO ticket containing the representee's identity has been received by the representee's Loginapp, the identity is propagated to the representee application using the configured i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920813013.html", "title": "Dynamic client registration (DCR) setup", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 OAuth AS settings with remote consent DCR setup Dynamic client registration (DCR) setup To configure DCR for STET, add the plugin OAuth 2.0 Dynamic Client Registration in the authorization server configuration ( Loginapp >> OAuth 2." ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945501.html", "title": "Technical client in IAM and tech-clients REST API", "hits": [ "loginapp" ], "snippets": [ "ed authn. types Tech-clients management Config. and access ctrl. Examples Get tech clients Lock / unlock tech clients Delete API client Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support About tech clients Technical client in IAM and tech-clients REST API This chapter explains the concept of technical clients and shows how to use the Adminapp REST API to manage them. With the term technical client or tech-client we refer to REST API clients or other " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1591893504905.html", "title": "Matrix card attributes", "hits": [ "loginapp" ], "snippets": [ "tive Directory Installation on Linux IAM as Docker image Upgrade Airlock IAM Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Installation and upgrade Data sources Generic LDAP directories Available plugins Matrix card attributes Matrix card attributes The next table shows matrix card attributes relevant for the LDAP Token List Persister plugin. Attribute name (examples) Usage Type LDAP Connector plugin LDAP Token List Persi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1652877867144.html", "title": "Email OTP authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Email OTP Email OTP authentication In email authentication, a one-time password (OTP, also referred to as token code ) is sent to the user's email address. The code is then entered into an input field by the user. Authentication with email OTP can be used as the s" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945381.html", "title": "Secret questions for password reset self-service", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password Password reset self-service Reset using secret questions Secret questions for password reset self-service Airlock IAM can be configured to ask a user to answer questions in order to gain some confidence in the user's identity. This can be us" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945497.html", "title": "Airlock IAM configuration for STET PSD2", "hits": [ "loginapp" ], "snippets": [ "t app config. HTTP request signature verification TPP authn. with OAuth 2 and STET Note on performance for STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support STET PSD2 IAM config. for STET PSD2 Airlock IAM configuration for STET PSD2 This document describes how to configure Airlock IAM to use the STET PSD2 features. Related documents: STET interaction models for details about how the Airlock Suite is involved in securing PS" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636416221.html", "title": "Missing default AssertionConsumerService in SP metadata", "hits": [ "loginapp" ], "snippets": [ "tch SLO not working Host flag without FQDN MetaAlias missing / entity IDs mismatch NPE at SAML processing CoT list mismatch Entity ID not found Unsupported SAML signature algorithms in IAM 7.6 and later API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses SAML Troubleshooting SAML Missing def. AssertionConsumerService Missing default AssertionConsumerService in SP metadata Exception:  Example java.lang.IndexOutOfBoundsException  (at com.sun.identity.saml2.profile.SPSSOFederate.createAuthnRequest(SPSSOFederate.java:726))Exception: com.sun.identity.sam" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636415731.html", "title": "Goto (flow concept)", "hits": [ "loginapp" ], "snippets": [ "PI access control Flows (Airlock IAM concept) General information Step properties Flow tags and flags Selection and conditions Goto On-failure Goto Dynamic step activation Failed factor attempts Flow error handling Protected Flows Scriptable plugins Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Flows (Airlock IAM concept) Goto Goto (flow concept) Goto describes the process of jumping from one step to another independently of the configured step order. The Goto concept A Goto jump has a source step and a target step . Source step A source step can have several potential Goto targets. They are" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572108.html", "title": "Configuration validation", "hits": [ "loginapp" ], "snippets": [ "ew toggles Configuration validation Loading/saving configurations Configuration activation timeout Configuration activation internals Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Configuration management IAM Config Editor (UI) Configuration validation Configuration validation In the toolbar on top of the Config Editor, the validation environment can be selected: OFF : Property values are not validated. Default : Properties are validated to follow simple constraints, e.g., it i" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572338.html", "title": "Airlock Gateway configuration", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto Push Gateway configuration Airlock Gateway configuration Push-enabled Cronto apps need to communicate directly with Airlock IAM (via Airlock Gateway ). If a recent Gateway mapping template for IAM is in use, it should be sufficient to activ" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1629119827092.html", "title": "Cronto token self-management", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Self-management Cronto token self-management Airlock IAM provides Cronto related self-services for logged-in users with the corresponding access rights. List of services in the Cronto token self-management The following self-services are available" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945286.html", "title": "Airlock Gateway reports Status 503 or Status 400 when trying to access Airlock IAM (HTTP Header Size)", "hits": [ "loginapp" ], "snippets": [ " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway shows 503 / 400 on access Airlock Gateway reports Status 503 or Status 400 when trying to access Airlock IAM (HTTP Header Size) Symptoms Trying to access Airlock IAM Loginapp, Airlock Gateway reports logs like the following (not provid" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142568.html", "title": "HTML rendering and template variables", "hits": [ "loginapp" ], "snippets": [ "riables Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Customization with the Design Kit Change UI appearance Change UI texts and translations Customization using default HTML files UI customizations with JavaScript Advanced HTML customization Customizing an existing product page Adding new pages HTML rendering and template variables Internationalization and translatio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945523.html", "title": "Operation", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Operation Chapter content IAM Command-Line Interface CLI Starting and stopping IAM Sandboxing with profiles License and usage analytics Generating log outputs Processing log output User trail logging Correlation ID Log message formats Monitoring, health checks, and metrics Performance tuning" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1715877709957.html", "title": "PKCE - Proof Key for Code Exchange", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as AS/OP PKCE PKCE - Proof Key for Code Exchange PKCE is an OAuth 2.0 standard specified in RFC 7636 – Proof Key for Code Exchange by OAuth Public Cli" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1632806980435.html", "title": "Identity propagation configuration in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "Identity propagation configuration in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404688.html", "title": "Configuring the JVM for PKCS #11", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Username and password HSM support Configuring the JVM for PKCS #11 Configuring the JVM for PKCS #11 PKCS #11 support is enabled in Java by first configuring a security provider with a configuration file for the specific HSM in use. Create a Sun PKCS #11 security p" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1612361355652.html", "title": "FIDO authentication in the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "FIDO authentication in the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authen" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1608232185057.html", "title": "FIDO authentication (Passkeys)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods FIDO / Passkeys FIDO authentication (Passkeys) FIDO (Fast Identity Online) is a framework of open technical specifications for single or multifactor authentication. In case FIDO is not mixed with other password- or username-based authentication factors, it can eff" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945511.html", "title": "Report templates based on Word documents", "hits": [ "loginapp" ], "snippets": [ "cuments Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Language and country codes Language selection mechanism MSWord report templates Plugins Parameter replacement MessageFormat examples Extra informations in pwd letters Configuration Use in letters Security best practices Third-party licenses Customizing UIs and texts MSWord report templates Report templates based on Word documents A set of IAM pl" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759809583.html", "title": "Examples of available event attributes", "hits": [ "loginapp" ], "snippets": [ "tributes Event attribute examples Event subscribers Reliable event delivery Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Events and notifications Event attribute examples Examples of available event attributes Consider the event MTAN Token Registered . This event can originate from 3 different sources: Adminapp – when an administrator registers a mobile phone number for a user. Authentication Flow Step " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945334.html", "title": "Digipass OTP authentication (OneSpan)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Digipass OTP Digipass OTP authentication ( OneSpan ) Airlock IAM includes components for using Digipass OTP tokens from OneSpan (Vasco)for strong authentication. Digipass OTP tokens are hardware OTP generators that display a time-based 6-digit code. Supported IAM " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435024903.html", "title": "One-Touch authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Authentication factors One-Touch authentication Use case One-Touch authentication This article explains on a conceptual level how Airlock 2FA One-Touch authentication works. It also provides important detail information for correct use and configuratio" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435054139.html", "title": "Token management (Airlock 2FA)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Token management Token management (Airlock 2FA) This article shows how to manage Airlock 2FA tokens for users. Goal Understand how Airlock 2FA can be enabled for a user. Understand how to manage Airlock 2FA tokens. Learn how to prepare a user for migra" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1644518953005.html", "title": "Privilege escalation prevention", "hits": [ "loginapp" ], "snippets": [ "vention Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Sensitive information Separation of modules Secure configuration Privilege escalation prevention OS, JRE and network Docker security Auditability Hash functions Custom extensions Third-party licenses Security best practices Privilege escalation prevention Privilege escalation prevention The following list of security reco" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945278.html", "title": "Logging configuration", "hits": [ "loginapp" ], "snippets": [ " Operation Initial configuration Configuration files Instances directory Config Editor quickstart guide Gateway - Microgateway configuration User data source configuration Logging configuration Logging parameters Log4j 2 configuration files Changing Loginapp log level Logging to stdout only Sending logs to syslog Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Logging configuration Logging configuration There are" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404666.html", "title": "Maintenance messages", "hits": [ "loginapp" ], "snippets": [ "essages Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows SSO tickets in the Loginapp UI User representation - representee Maintenance messages Remember-Me configuration Voluntary password change authentication flow Additional Cronto device activation MS-OFBA configuration User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization with Loginapp Design Kit Content secur" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1642782502780.html", "title": "SAML IDP setup with the Loginapp REST API", "hits": [ "loginapp" ], "snippets": [ "SAML IDP setup with the Loginapp REST API Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URL" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1757609593818.html", "title": "One-shot authentication with flows", "hits": [ "loginapp" ], "snippets": [ "h flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication Mapping for one-shot authentication One-shot authentication with flows One-shot authentication with authenticators Front-Side Kerberos configuration MS-OFBA configuration OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Log" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1649929046362.html", "title": "Email links for user verification in self-registration flows", "hits": [ "loginapp" ], "snippets": [ "n flows Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Configuration Usage of self-registration Email links for user verification 2nd-factor enrollment Logged-in after self-registration Stealth mode for self-registration Self-registration example CAPTCHAs Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp U" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1644518868627.html", "title": "Authentication context classes in the SAML IDP", "hits": [ "loginapp" ], "snippets": [ "AML IDP Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup Prerequisites IDP configuration Adding SPs to the IDP SAML IDP URLs Authentication contexts SAML Single Logout with temporary Gateway role Load balancing setup Keystore generation Limitations SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-sho" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759947213.html", "title": "Configuration of health checks endpoints", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation Monitoring, health checks, metrics LR(S) probes Configuration of health checks endpoints Configuration of health checks endpoints The health check endpoints are configured in the instance.properties file or as an environment variable: IP filtering Port number instance.properties iam.health.a" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404736.html", "title": "Representee authentication in user representation", "hits": [ "loginapp" ], "snippets": [ "cation Identity propagation Auditing Flow diagrams Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication User representation System design Representee authentication Representee authentication in user representation When the representation starts, the authenticity of the representee is based on the authenticity of the representer. The representee's identity is then forwarded to the represe" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413597.html", "title": "Effects of temporary locks", "hits": [ "loginapp" ], "snippets": [ "y locks Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1675772867987.html", "title": "Clean-up task for user trail logs in database", "hits": [ "loginapp" ], "snippets": [ "re Externalize session state in Redis Reasons for connection drops Geolocation feature Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Operation User trail logging User trail clean-up Clean-up task for user trail logs in database The user trail logs in the database can be cleaned-up periodically by a scheduled task service. In the Config Editor, go to: Service Container >> Services >> Task Scheduler Config >> Service In the Task Sche" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572330.html", "title": "Push notification sender plugin", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto Push IAM push notification sender plugin Push notification sender plugin To use the Cronto push notification feature, the Cronto Handler plugin must be configured with the two flags Enable Online Validation and Enable Push Notifications ena" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1668421887059.html", "title": "Token Exchange Configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration Grants and flows Token Exchange Configuration Dynamic client registration Authentication flows Scope policies and filtering ACR in flows PAR configuration PKCE configuration for IAM as OAuth 2.0/OIDC authorization server Client authentication configuration private_key_jwt Local consent Remote consent OIDC session management Certificate-Bound Access Tokens Loginapp UI configuration " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328142469.html", "title": "Navigation menu configuration", "hits": [ "loginapp" ], "snippets": [ "uration Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Quickstart guide Design Kit installation Using the Design Kit CLI Design Kit configuration Navigation menu configuration Page settings configuration Additional and custom attributes Response mocking configuration Customization with the Design Kit Design Kit upgrade procedure Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email servic" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1585668119116.html", "title": "API key management", "hits": [ "loginapp" ], "snippets": [ "ement Authentication Self-services Target applications OAuth and OIDC SAML API access control Solution overview Tech-Client management Profile management Plan management API key management API access control configuration Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses API access control Tech-Client management API key management API key management The API keys of a Tech-Client are managed in the API keys tab. Each Tech-Client may have zero or more API keys . Click the Generate API key button to add a new API key . The following attributes may be managed for each API" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1595233404672.html", "title": "Maintenance messages examples in the Loginapp", "hits": [ "loginapp" ], "snippets": [ "Maintenance messages examples in the Loginapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Interaction models Authentication methods Remember-Me Step-Up authentication Risk-based authentication Failed logins and temp locking Username transformation Maintenance messages Management Examples in the Loginapp Usage and limitations Locations User representation Events and notifications Login from new device Actions on log out Self-sovereign id" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594636413589.html", "title": "Interpreting error responses", "hits": [ "loginapp" ], "snippets": [ "sponses Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API Flow-based authentication Configuration Examples Username password authentication in the Loginapp REST API Airlock 2FA authn. in Loginapp REST API FIDO authentication Device tokens SSO ticket authentication Front-Side Kerberos Identity propagation User representation (representee side) Failed logins and lockout config Temp locking configuration Remember-Me configuration Voluntary password change authentication flow" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594920812953.html", "title": "IAM configuration", "hits": [ "loginapp" ], "snippets": [ "k API calls User consent step HTTP signature verification TPP authn. with NextGenPSD2 Performance measures STET PSD2 About tech clients Issuer cert. for PSD2 Tech client interceptors OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Target applications PSD2 support NextGenPSD2 implementation Configuration IAM configuration IAM configuration Prerequisites In order to use the NextGenPSD2 features with Airlock Suite, the following requirements must be met: The IAM license must contain the required NextGenPSD2 license bundle (and dep" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328147887.html", "title": "Self-unlock flow example", "hits": [ "loginapp" ], "snippets": [ "example Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Self-unlock Failed factor attempts User enumeration protection Flow Continuation Step Initialize next authentication flow CAPTCHAs Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597341395656.html", "title": "Airlock 2FA order process and creating services", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Airlock 2FA Futurae service setup Airlock 2FA order and creating services Airlock 2FA order process and creating services The order process does not cover the creation of the first service account. This will ensure that service account credentials are " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1623759814802.html", "title": "FIDO token management in the IAM Adminapp", "hits": [ "loginapp" ], "snippets": [ "dminapp Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration UI configuration/access options Adminapp REST API User management Password management Airlock 2FA configuration FIDO configuration Cronto token controller configuration Digipass OTP configuration Matrix card management Remember-Me configuration Generic token controller User Management Extensions Maintenance messages User-group dependent settings Access control Event notification Customizing text elements Log viewer Content security policy (CSP) Servi" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328140828.html", "title": "REST API service overview", "hits": [ "loginapp" ], "snippets": [ "verview Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST AP" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1593183841337.html", "title": "Gateway- vs. application-triggered step-up", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Step-Up authentication Gateway vs. application triggered step-up Gateway - vs. application-triggered step-up Gateway -triggered step-up Ideally, applications requiring higher authentication levels are determined in the Airlock Gateway with separate mappings requiring a role that trigger" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1726159375701.html", "title": "Cooldown period with one-device policy", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Airlock 2FA Cooldown period Special use case - CPOD Cooldown period with one-device policy This article explains how to configure the cooldown period feature combined with the one-device policy (short: CPOD), where only one valid 2FA device per end-user is allowed" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1597849731256.html", "title": "Strong authentication", "hits": [ "loginapp" ], "snippets": [ "t applications OAuth and OIDC Introduction IAM as AS/OP URLs and endpoints OAuth 2.0 scopes Claims OAuth consent ACR PAR PKCE Client authentication DCR Session management OAuth 2.0 OIDC Configuration override SSO tickets Flow authentication with the Loginapp UI AS usage examples Authz Code Flow usage Hybrid Flow usage Client Credentials grant usage Token Exchange Use Case example Resource access with token Forced user re-authentication Weak authentication Strong authentication Step-up with SSO ticket Session management usage PAR use case example IAM as Client/RP Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approva" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435031232.html", "title": "Authentication of the delegating entity (REST client authentication)", "hits": [ "loginapp" ], "snippets": [ "cation) Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration Transaction approval REST API Flow selection User identifying step Param. step and message providers Auth token and authTokenId usage Approval steps Message provider config Authn. of delegating entity Approval with Airlock 2FA Transaction with mTAN Approval with Cronto Push Approval with email OTP Approval with FIDO2 Customizing text elements Cronto message custom formatting Proof of " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945510.html", "title": "Content security policy", "hits": [ "loginapp" ], "snippets": [ " policy Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Customization with Loginapp Design Kit Content security policy WCAG One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Loginapp Configuration Loginapp UI Content security policy Content security poli" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1626375385330.html", "title": "Configure Airlock IAM as OIDC Relying Party using discovery", "hits": [ "loginapp" ], "snippets": [ "scovery Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI One-shot authentication OAuth / OIDC OAuth AS/OP Configuration OAuth Client / RP Configuration OAuth Client configuration OIDC RP (Client) configuration OIDC RP (Client) with discovery PAR configuration PKCE configuration for IAM as OAuth 2.0 OIDC client Authentication flows Loginapp REST UI Account linking and registration Google as OIDC OP example HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Con" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1689952155511.html", "title": "Cleanup on user lock", "hits": [ "loginapp" ], "snippets": [ "er lock Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event notification Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST AP" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1660804706998.html", "title": "SAML SP Advanced Configuration Topics", "hits": [ "loginapp" ], "snippets": [ " Topics Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Protected self-services SAML IDP setup SAML SP setup Prerequisites SP configuration Add SAML IDP SP Advanced Configuration SAML SP URLs Keystore generation Limitations Cleanup on user lock Customizing non-UI text elements Additional and custom attributes JWKS endpoint Loginapp UI One-shot authentication OAuth / OIDC HTTP Basic Auth access SMTP email service Event" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1582547572488.html", "title": "Airlock Gateway configuration for the Loginapp UI", "hits": [ "loginapp" ], "snippets": [ "Airlock Gateway configuration for the Loginapp UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Loginapp UI Loginapp UI configuration Authentication and authorization flows User self-registration UIs Public self-services Protected self-services OIDC and OAuth Airlock gateway (WAF) SAML Customization " ] }, { "url": "https://docs.airlock.com/iam/latest/index/1583435033992.html", "title": "Password reset in the Loginapp REST API / UI", "hits": [ "loginapp" ], "snippets": [ "Password reset in the Loginapp REST API / UI Toggle navigation About Release and support Installation and upgrade Operation Initial configuration Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Loginapp REST API Service overview Authentication REST API User self-registration REST API Public self-services Password reset Simple password reset Complex password reset Email link password reset Reset locked u" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1579527945357.html", "title": "Front-side Kerberos authentication", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Front-side Kerberos authn. Front-side Kerberos authentication With front-side Kerberos, Airlock IAM authenticates users based on a Kerberos ticket. This allows the implementation of single sign-on in Windows environments for all target applications connected to Ai" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1614328202164.html", "title": "Example: SPA (Single-page Application) with IAM as OAuth client", "hits": [ "loginapp" ], "snippets": [ "DC Introduction IAM as AS/OP IAM as Client/RP Claims (user attributes) Account linking Social registration Mobile app use case Example: SPA (single-page application) Token Exchange service overview SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses OAuth and OIDC IAM as Client/RP Example: SPA (single-page application) Example: SPA (Single-page Application) with IAM as OAuth client Using single-page applications (SPA) in OpenID Connect setups poses some security risks since web browsers insufficiently protect access and refresh tokens. In this co" ] }, { "url": "https://docs.airlock.com/iam/latest/index/1594028006419.html", "title": "Cronto configuration (main settings)", "hits": [ "loginapp" ], "snippets": [ "formation Maintenance messages User representation Events and notifications Login from new device Actions on log out Self-sovereign identities (SSI) Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Authentication Authentication methods Cronto (OneSpan) Cronto configuration Cronto configuration (main settings) All Cronto-related Airlock IAM features make use of the Cronto Handler plugin. It is configured in MAIN SETTINGS >> Authentication Settings >> CrontoSign Settings . Vasco Cronto Handler vs." ] }, { "url": "https://docs.airlock.com/iam/latest/index/1789663966107.html", "title": "Configuration of IAM mappings", "hits": [ "8.4.", "loginapp" ], "snippets": [ " listed above. Instead, configure the OpenAPI settings directly in the corresponding basic mappings. For more information, see OpenAPI specification and validation .  Notice The handling of blocked REST requests has also changed slightly in Gateway 8.4. Previously, blocked REST requests returned the error page directly. Starting with Gateway 8.4, blocked requests result in a 303 See Other response that redirects the client to the appropriate error page. CSRF protection  Notice CSRF token protection of Airlock Gateway: The Airlock Gateway CSRF token protection feature is activated on all Loginapp REST mappings using the mapping template 7.6 and newer . This may require small changes to custom single-page applications to handle possible CSR", " Gateway shows 503 / 400 on access User data source configuration Logging configuration Using custom plugins Configuration management Authentication Self-services Target applications OAuth and OIDC SAML API access control Flows (Airlock IAM concept) Loginapp Configuration Adminapp Configuration Service Container Configuration Transaction Approval Configuration IAM REST APIs Customizing UIs and texts Security best practices Third-party licenses Initial configuration Gateway - Microgateway configuration Gateway configuration Configuration of IAM mappings Configuration of IAM mappings  Notice If you have not upgraded to Airlock IAM 8.7 yet, use the Airlock Gateway mapping templates that correspond to your currrent IAM version: Airlock IAM 8.6" ] } ]