Red Hat Single Sign-On Administration

In RH-SSO, an authentication flow is a set of actions and verifications that RH-SSO performs during a log in, a registration, or any other workflow managed in the realm.

RH-SSO includes by default different authentication flows. You cannot remove or add steps to the default authentication flows, but you can modify them to suit your requirements. You can also create new authentication flows.

You can access the definition of the RH-SSO authentication flows from Configure → Authentication, in the Flows tab. You can navigate through the different authentication flows by using the drop-down menu.

Each RH-SSO authentication flow has one or more authentication types. The following are examples of authentication types:

As a general explanation for authentication flows, the Auth Type parameter is the action to execute. If an Auth Type is indented, then it is in a sub-flow and the previous non-indented Auth Type parameter is its parent. RH-SSO executes sub-flows depending on the results from the parent execution.

You can control the authentication action by using a set of radio buttons:

RH-SSO defines the following eight built-in flows

You can hover over the question marks to get more information about each built-in flow.

The following image is the definition of the Browser built-in authentication flow.

Figure 3.25:

The RH-SSO Browser authentication flow.

The Browser flow has four authentication types, which RH-SSO evaluates sequentially.

The first one tests if the browser has an existing identity cookie, because the user could be previously identified.

The Kerberos authentication type is disabled. Thus, the identity provider (IdP) is not going to test if the HTTP header for Kerberos exists.

The third test, the Identity Provider Redirector, determines if the realm has any federated identity provider.

If there are other providers, and the user chooses to authenticate against one of them, then the user browser redirects to the login page of that IdP.

If the previous alternative checks have not succeeded in authenticating the user, then the last authentication type in this flow is the Forms authentication type. The Forms authentication type has two nested authentication types. The nested Username Password Form authentication type is required. Thus, the showing of the form is mandatory, because there were no authentications with the previous tests. The Browser - Conditional OTP authentication type shows another form to enter the OTP password, only if the user has configured OTP as required.

Most of the common use cases are covered by the existing built-in flows, but as an RH-SSO administrator you can create new authentication flows, and configure them to act as the actions by default. You can configure which authentication flows are in use from the Configure → Authentication page, in the Bindings tab.

Figure 3.26: The RH-SSO authentication flow bindings.

You can also define the authentication flow at a client level, to apply only to a specific application.

As an RH-SSO administrator, you can configure the realm to perform common actions for all client applications and users. These actions include, among others, configuring the OTP, showing a terms and conditions page, updating the user locale, or updating the password.

Figure 3.27: The list of available required actions for the realm.

You can also mark the required actions as a default action. If you mark an action as a default action, then it is executed for each new user.

You can mark actions as default actions from the Configure → Authentication page, in the Required Actions tab.

In the Manage → Users page, you can also define required actions for any specific user.

You can apply common security features to the applications that use RH-SSO as their identity and access management (IaM) system. There are authentication features related to password policies and One Time Password (OTP) configuration, related to using Kerberos, or related to using credential types different from the username and password.

The following is a list and descriptions of important features that you can use from the Configure → Realm Settings. To see the full list of the authentication features refer to the References section.