Hi @Dinesh90
There is a feature - Adaptive Authentication, in which we can restrict the user logins based on their login types, roles that user has, groups that user belongs to, location of the user etc etc. This is an OOB core plugin and should be available already in the recent releases. If not, then please install the adaptive authentication plugin and enable the adaptive authentication feature property - glide.authenticate.auth.policy.enabled = true.
The way to implement this constraint with Post Auth Policy is this -
In the Post auth policy context, you can create the policy to allow only admin users to do the local login. Here is how to craft the policy condition -
Policy Inputs (need to create it if not already available) -
1: Role Filter Criteria - hasAdminRole (role = admin)
2: Authentication Type ( Authentication type = username and password / SSO Login)
------------------------------------------------------------------------------------
Policy condition -
hasAdminRole = true AND Authentication Type = "Local Login"
OR
Authentication Type = "SSO Login"
------------------------------------------------------------------------------------
This should be sufficient as it will make sure if the user is logging via the user name and password, then only it can do the local login. However, with this, all the users will be able to login with SSO including admin users. If you want to further refine and dont want to allow the admin users to do sso login, you can add hasAdminRole condition in the second part with hasAdminRole = false.
---------------------------------------------------------------------------------------------------------------------------------------------
Second approach (recommended) -
The recommended way is to enable the Account Recovery feature if you want to only allow certain users to do the local login and force all the users to do the SSO Login.
This ensures that if something goes wrong with the SSO Config like certificates expired etc etc, you have the account recovery user to do the local login and make the required changes to fix the SSO Login issue.
This can be achieved via the other ways also, but I am recommending to use the ACR context only because, it will ensure that the admin users which are doing the local login have their accounts secured with second factor aka MFA.
As we are trying to enforce the MFA For all users doign local login from Yokohama onwards, it would be better to have an additional layer to security around the admin user logins.
However, there is a downside of this approach. The account recovery user will not have the admin privileges anymore and it will have limited access to fix the SSO related conifgurations.
Having said that, you can explore and evaluate both the approaches from both security and usability perspective and go with the one that suits better for you.
Please let me know if you have any further queries. If you have any queries on the adaptive authentication, there are plenty of resources/documentation available online and in the community.
Thanks!
Ambuj
