|
At the Community the question arises again and again whether the multi-factor authentication can be bypassed under certain circumstances. For example users would like to log in directly and without MFA when they're accessing the ServiceNow instance from a secure (company) network. In fact, it is possible to implement such exceptions using the Adaptive Authentication feature of ServiceNow and this article describes what configurations are necessary to realize that scenario. |
|
Install and configure Adaptive Authentication
(1) Go to System Definition > Plugins and search for the plugin with ID com.snc.adaptive_authentication and install it. If this plugin is already installed, you can skip this.
(2) Navigate to Adaptive Authentication > Authentication Policies > All Policies, enable column "Active" and disable all policies except "Step down MFA policy". This policy needs to be "Active=true". Later, if you are more familiar with adaptive authentication, you can add/activate additional policies to fit any security requirements.
(3) Open the properties page of the adaptive authentication application and activate it by ticking the first checkbox. Don't forget to save that properties page!
The MFA context determines whether a user must provide a second form of authentication when logging in. There are two strategies for applying the MFA:
- Step-Up MFA Policy: No MFA is activated by default and MFA is enforced to users when the policy conditions evaluate to true.
- Step-Down MFA Policy: Enforces MFA by default. MFA is not enforced only when the policy conditions evaluate to true.
(1) Navigate to Adaptive Authentication > MFA Context, select at "Default Policy" the value "Step-Down MFA Policy" and save the record. If a confirmation dialog appears, you can click on "Ok".
(2) Open the "Step-Down MFA Policy" record.
(3) In the related list "Policy Inputs" click on "New".
(4) In the next screen select "IP Filter Criteria"
(5) Enter a suitable name and specify the IP address ranges which are allowed to bypass the MFA and click "Submit"
(6) Back at the "Step-Down MFA Policy" record click on "New" at the related list "Policy Conditions".
(7) Enter a suitable name, select the previously created IP filter criteria at the "Condition" field and choose "is true". Then "Submit" the record.
(8) Back at the record remove any OOTB "Policy Conditions" by selecting the records and selecting "Delete" from the list menu at the bottom:
(9) Remove any existing OOTB "Policy Inputs" by selecting the "Edit" button at the respective related list and moving the OOTB Policy Inputs to the left side. Then save the selection.
(1) If not already active, open the properties page of the multi-factor authentication application and activate it by ticking the first checkbox. Don't forget to save that properties page!
(2) Log in to your instance from with in the specified IP range. You should not be forced to register an MFA device or to enter the MFA code. Then try to log in from another network, for example via a mobile device (without a company VPN). Now you should get a screen for registering an MFA device or, if already done, for entering the MFA code.
