Activated Adaptive Authentication Blocks login.do Login

[Meloper]

After i activate the Property to use adaptive Authentication with sso.

I cant Login with my credentials anymore.

With Login.do....

Can i Run both.

Using adaptive Authentication for sso and Manual Login?

[Randheer Singh · Accepted solution]

The local login blocking is happening due to the Account recovery context policy.

The default policy blocks local login for all users. If you want you can modify the policy conditions to allow local login for users with certain roles or group membership.

If you want to allow local login for all users, you can deactivate the policy or turn off the glide.sso.acr.enabled system property.

Product documentation: https://docs.servicenow.com/bundle/vancouver-platform-security/page/integrate/single-sign-on/concept...

[Meloper]

Do you have an Idea how i can modify the Condition, so that maybe a User with "ADMIN" in his name can use login.do?

Should i change the FIlter Criteria from Authentication Scheme to Role Based MFA?

But i cant change the related Lists.

SSO - ACR Context is a allow policy for "Non Local Login Users", so in my understaning it should allowed or?

And Thank you of course for that great answer !

[Randheer Singh]

Thanks, @Meloper . You can add a new role filter criteria in the Non Local Login User policy. Example filter criteria name: Has Admin role.

Then you can modify the policy condition, which allows

• non local login user (authentication scheme is not Username and password)
• OR has Admin role

In this case, the allow policy will be true for admin users doing local login.

If you would like more details on Adaptive authentication, please consider enrolling in this less than 30 minutes long Adaptive Authentication learning course.

https://nowlearning.servicenow.com/lxp?id=learning_course&course_id=d2f3ec6a97ab59948934b67e6253af25

[Meloper]

Thanks again for your Reply.

i did your metioned ToDos in the Post Auth Policy Context....

In Table sys_auth_policy_context are 3 REcords.

1. Post Authentication Policy Context

2. Pre Authentication Policy Context

3. SSO - ACR Context

I can NOT add a 4, is that right?

In  "Pre Authentication Policy Context" there is the Deny Policy  "Global Blocking Policy" with no Policy and Condition.

- i guess this runs by default in Order 1

---

then there is "Post Authentication Policy Context"

for this i created add 2 Policies: Authentication Scheme AND has Admin Role

Also i Added two Condtions (in docs they mentioned that they will run like OR) 

1. Authentication Scheme Condition = Authentication Scheme IS SSO

2. as Admin Role Condition = Authentication Scheme IS Username AND Password AND has Admrin ROle IS true

----

i understand that you tell me that i have to these last Steps not in the POST Record i should do it in the "SSO - ACR Context" Record respectively in The Allow Non Local Login Users Policy?

is there a reason why i can to it in the POST?
Is there a specifiy Order for PRE POST/SSO -ACR?

I see there is the Type field in "sys_auth_policy_context " Table

https://docs.servicenow.com/en-US/bundle/utah-platform-security/page/integrate/authentication/concep...

Because of this i thought i can to it also in POST