Skip Headers
Oracle® Fusion Middleware Administrator's Guide for Oracle Adaptive Access Manager
Release 11g (11.1.1)

Part Number E14568-06
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Master Index
Master Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
View PDF

7 Managing Knowledge-Based Authentication

This chapter introduces you to the concepts behind knowledge-based authentication (KBA), and provides information about managing tasks that impact challenge questions, validations and levels of logic algorithms used for answers, question categories, and levels of logic algorithms used for registration.

Sections in this chapter are:

7.1 Introduction and Concepts

This section describes knowledge based authentication (KBA) key concepts.

7.1.1 Knowledge Based Authentication

Oracle Adaptive Access Manager provides out-of-the-box secondary authentication in the form of knowledge based authentication (KBA). KBA is a secondary authentication method, an extension to the existing authentication method. It is presented after successful primary authentication (for example, a user entering a single factor credentials, such as a user name and password) to improve authentication strength.

KBA provides an infrastructure for

  • Users to select questions and provide answers which are used to challenge them later on

    KBA is used to authenticate an individual based on the user's answers substantiated by a real-time interactive question and answer process.

  • Levels of logic algorithm for registration

    Registration Logic manages the registration of challenge questions and answers.

  • Levels of logic algorithm for answers

    Answer Logic is made up of advanced matching algorithms (fuzzy logic) used by the system to intelligently detect the correct answers in the challenge response process. The algorithms and the level of Answer Logic are factors in evaluating answers.

  • Validations

    Validations are used to validate the answers given by a user at the time of registration.

KBA is used during online authentication of the user, which is automated, or a CSR challenge where the CSR interacts with the user to authenticate him before providing CSR services.

7.1.2 Challenge Response Process

The KBA solution consists of securing an application using a challenge/response process where users are challenged with one or more questions to proceed with their requested sign-on, transaction, service, and so on.

7.1.3 Challenge Response Configuration

The challenge/response process is controlled by a combination of properties and rules.

  • Question presented at random or round robin

    Presentation logic (random versus round robin) is configurable through properties. If the deployment supports Oracle Identity Manager integration, the presentation is round robin. The user is expected to answer all the registered questions online.

  • The number of attempts a user is allowed for each question is set by a property.

  • The total number of KBA challenge failures a user is allowed before he is locked out by Oracle Adaptive Access Manager is configured in a rule condition.

7.1.4 Registration

During registration, which could be enrollment, opening a new account, or another events such as a reset, the user is asked to select questions and provide answers. The order of questions that are presented to a user during the registration phase is random using configurable parameters.

Later on, the challenge questions selected at registration or during a reset may be used for challenge during high risk log ins, to access transactions, or sensitive information, or both, and so on. Oracle Adaptive Access Manager's Rules Engine and business rules are responsible for determining if it is appropriate to use challenge questions to authenticate the user.

7.1.5 Challenge Questions

The customer can configure a set of questions that are used to authenticate users. The Questions are grouped into several categories and the user can select questions from these categories. The out-of-the-box categories that questions can be grouped into are listed. The customer can configure questions from these categories.

  • Childhood

  • Sports

  • Your Birth

  • Parents, Grandparents, Siblings

  • Automobile

  • Education

  • Children

  • Your Employment

  • Significant Other

  • Pets

  • Miscellaneous

During registration, users are presented with several question menus. For example, he may be presented with three question menus. A user must select one question from each menu and enter answers for them during registration. Only one question from each question menu can be registered. These questions become the user's "registered questions."

When rules in OAAM Admin trigger challenge questions, the application displays the challenge questions and accepts the answers in a secure way for users. The questions can be presented in the QuestionPad, TextPad, and other pads, where the challenge question is embedded into the image of the authenticator, or simple HTML. These are configured through properties.

7.1.6 Question Set

KBA offers a large pool of questions, which is the framework for obtaining answers from the user during registration or reset. The Question Set is a fixed set of questions that is allotted to the user. This set is allotted at random and once for the user unless it is reset. It is generated based on the settings configured in the Registration Logic. This Question Set prevents any single user from having access to all the challenge questions. This is to prevent a fraudster from harvesting questions for use in a phishing exercise. A user can receive a new Question Set if a customer service representative resets it for the user.

7.1.7 Registration Logic

Registration Logic manages the registration of challenge questions and answers. During KBA registration each user is presented with a Question Set, a subset of the challenge questions library. The Question Set is generally broken up into several drop-downs that have questions to select from. The drop-down with questions is called a "menu."

Figure 7-1 Drop-Downs (Menus)

Menus are shown.

The number of questions that appear on each menu, the number of categories per menu, and the number of questions that a user must register is configurable. Out-of-the-box, questions are grouped into categories. The challenge questions in the questions menus do not change unless the question set is changed. The user is required to select one question from each menu and enter answers for them. Only one question from each question menu can be registered.

Validations are applied to the answers provided by the user during registration. For example, if the question, "What year did you start junior high school," is assigned the Month-Day-Year (MMDDYY) validation, a user registering for this question is not allowed to provide "April 1st 1920" for the answer.

To configure the Registration Logic, you specify the settings for:

  • The question set generation

    • The number of questions to be registered

    • The number of questions per menu

    • The number of categories per menu

    The Question Set is generated based on the Registration Logic.

  • The validations that are applied to the answers

For information on setting Registration Logic, see Section 7.8, "Configuring the Registration Logic."

How do the KBA Registration Logic Settings Affect a Customer's Question Set?

Example configurations are presented in the following table.

Example Question/Menu Categories/Menu Questions/Category in a Menu
1 7 4 2+2+2+1
2 10 4 3+3+2+2
3 10 1 10

Example #1, shown on line 1, results in registration menus containing 2 questions from category A and 2 questions from category B and 2 questions from category C and 1 question from category D. This continues in a round robin fashion as needed. If there are any categories with an insufficient number of questions or an insufficient number of categories duplicate questions can result.

The following is an example of a configuration to avoid:

  • Number of questions user registers: 3

    The number of questions that a user must register. The new user registration should display the same number of question menus as the number of questions that a user must register.

  • Number of questions per menu: 5

    The number of questions that appear on each menu. The new user registration should display the same number of questions in each menu as the number of categories for each menu. The total number of questions from all the menus (number of questions multiplied by the questions in each menu) cannot exceed the total number of questions available in the database.

  • Number of categories per menu: 5

    The number of categories per menu. The new user registration should display the same number of categories for each menu as the number of questions in each menu.

The Question Set is the fixed set of questions that is allotted to the user. This set is allotted at random and once for the user. This is to avoid the user from discovering all the questions. In the example, fifteen or more categories are required, each with at least one question enabled. But if there are fewer than 15 categories and one of these categories has only one question enabled, some Question Sets have that question twice. The algorithm tries to use as many available categories as possible.

For example to generate a Question Set with:

  • 3 menus

  • 5 questions per menu

  • 5 categories per menu

The algorithm tries to pick one question each from 15 categories if 15 categories are available. The minimum number of questions per category should be equal to the number of questions in the Question Set divided by the total number of categories.

Pre-requisite for Configuring Registration Logic for Locales

The deployment administrator must ensure that there are enough questions in the database for each of the supported locale as configured in OAAM Admin during deployment; otherwise, the application displays only the English language questions during registration.

The number of locale-specific questions must be equal to or greater than the "Questions User Will Register" multiplied by the "Questions per Menu" multiplied by the "Categories per Menu."

7.1.8 Answer Logic

Answer Logic checks to see if the answer provided by the user matches closely to the ones provided during registration.

Answer Logic is made up of advanced matching algorithms used by the system to intelligently detect the correct answers in the challenge response process. The algorithms and the levels of logic are factors in evaluating answers.

Errors can be caused by simple input errors such as fat fingering, extra characters, misspellings, and so on. Common misspellings and abbreviations for example can be accepted if the basic information of the answer is correct.

The following algorithms are available and can be configured for your requirements:

  • Phonetics

  • Missing character(s)

  • Extra character(s)

  • Common misspellings

  • Common abbreviations

  • Common acronyms

  • Keyboard fat fingering

  • Common nicknames

  • Regional spelling differences

  • Date Format

The Answer Logic algorithms can be enabled or disabled and the intensity or strength of some algorithms (the level of Answer Logic used to evaluate answers given for challenge questions) can also be configured. For example, high risk transactions such as wire transfers may require a high degree of certainty (i.e. exact match) whereas accessing personal, non-sensitive information may require a lower degree of response certainty.

Answer Logic algorithms are available for both the online challenge and CSR phone challenge processes. Online settings are applied for answers the user provided online using the application. Phone challenge settings are applied for answers provided by users over the phone and entered by the CSR. The online challenge and CSR phone challenge Answer Logic are completely independent of each other. They can be configured separately.

For example, you can set the online challenge logic strength to high and the CSR phone challenge logic strength to low. For the CSR phone challenge logic strength, you may have provided more margin for error, because CSRs are listening to the answers over the phone and entering the answers.

7.1.9 Validations

Validations are used to validate the answers given by a user at the time of registration. Validations can be at the local level, to associated with each individual question, or at the global level, to be applied to all the questions presented to the user.

There are no automated validations to ensure that question specific validations and global validations do not conflict. Administrators must take care not to configure the same validations for local and global. For example, validation for a question should not be set to numeric only if the alpha only is set as a global validation.

Question Registration Validation (Local)

Each question can be assigned unique validations to control the answers a user is allowed to register. For example, if the business team wants to force users to answer a particular question using a specific date format.

The scope of validations applied to an individual question is local. Local validations are specified during the creation of a question.

Global Registration Validation (Global)

Global validations control the answers a user is allowed to register for all questions. Global validations influence all answer registration. For example, if the "Four-digit year (YYYY)" validation is applied globally then only numeral answers are accepted during KBA registration. This would be a problem if there are questions available to users that would normally have alphanumeric answers.

Global validations are specified during the configuration of Registration Logic.

Global-Local Validation

The scope of validations can be applied to individual questions or a combination of questions.

7.1.10 Failure Counters

Failure counters are used to lock out fraudsters so that they are unable to obtain the answers/questions.

KBA uses two failure counters. They are:

  • the Online Counter

  • the Phone Counter

The maximum number for online challenges and phone challenges are configurable. The phone counter maximum is "per question."

For the following example, assume:

  • Max online = 3

  • Max phone (per question) = 3

If the user is answering challenge questions online, and if the user is given three attempts to provide a correct answer, a total of three attempts is allowed. Each failure increments the Online Counter. The user is locked out of the session after three attempts. The online only challenge is designed to limit the exposure of questions to fraudsters.

If the user is answering challenge questions over the phone, and if the user is given three attempts at answering each question, a total of nine attempts is allowed. Each failure increments the Phone Counter. The user is locked out of the session after nine attempts.

For the next challenge, the next question is displayed. A success for an online or a phone challenge automatically resets all counters to zero.

7.1.11 KBA Resets

Authenticator uses questions as additional credentials to help prevent fraud. A customer service representative (CSR) can reset these questions for the user when necessary. The CSR can reset KBA-related items for a user, as described.

7.1.11.1 Reset Challenge Questions

The CSR resets a user's challenge questions. The system deletes the existing questions and answers and generates a new question set for the user to register from. Registration of challenge questions is required at the next log in to the Web site.

7.1.11.2 Reset Challenge Questions and the Set of Questions to Choose From

The CSR resets the user's challenge question set (challenge questions and the set of questions to register from). Registration of challenge questions is required at the next log in to the Web site.

7.1.11.3 Increment User to the Next Question

The CSR resets the user's next question so the system advances the user to the next challenge question in the list of registered questions. So if the user is currently being asked question A, question B or C is now asked. A different challenge question is presented at the next log in to the Web site.

7.1.11.4 Unlock a User

When the CSR unlocks the user that has been locked out of the system because of failed challenge questions. Unlocking the user resets the user's failure counter.

7.1.11.5 Ask Question (KBA Phone Challenge)

The CSR uses the user's challenge questions for phone authentication and enters user's response. If the user answers the question correctly, the question failure counter and increment question counter are reset. The system automatically takes appropriate action depending on the status such as unlocking the user. Information about phone and online failures is provided in Section 7.1.10, "Failure Counters." High level flows for the Ask Question action is presented in Chapter 4, "Managing and Supporting CSR Cases." The matrix in Section 7.1.10, "Failure Counters" contains detailed examples for individual flows.

7.1.12 Disable Question and Category Logic

This section describes the logic to handle disabled questions and categories.

Disabling Logic

The disabling logic is as follows for KBA:

  • If you disable the last remaining question in a category, the category is automatically disabled as well.

  • The number of active categories must be equal to or greater than the maximum number of categories in the question menu. An error message results when you try to disable a category and this requirement is not met.

Consequences

The following table summarizes the disable results.

Table 7-1 Disable Results in Question and Category Logic

Disable Question or Category New customers user with question in question set users with question registered

Question

The disabled question is not used to generate new users' question sets.

At re-registration or when a user changes his preference: Disabled question are replaced with another question from the same category.

The disabled question continues to be active.

If the user is re-registering or changing user preference, the disabled question is replaced with another question from the same category.

Category

The disabled category is not used to generate new users' question sets.

At re-registration or when a user changes his preference: All questions in the disabled category are replaced with questions from a new category that has not been used to generate current question set.

Questions from the disabled category continue to be active.

If the user is re-registering or changing user preference, all questions in the disabled category are replaced with questions from a new category that has not been used to generate the current question set.


7.1.13 Locked Status

Locked is the status that OAAM Admin sets if the user fails the question challenge. The "Locked" status is only used if the KBA or OTP Anywhere is in use. A user is locked out of the session after the failure counter reaches the maximum number of failures. After the user is locked out, a Customer Service Representative must reset the status to Unlocked before the account can be used to enter the system.

7.2 Setting Up KBA Overview

This section outlines the steps to manage the library, registration and answer processing of the challenge questions.

7.2.1 Loading Challenge Questions

The challenge questions must be loaded into Oracle Adaptive Access Manager before the users can be asked to register. For information on loading challenge questions, see Section 2.6, "Importing the OAAM Snapshot."

7.2.2 Setting Up KBA

To set up KBA:

7.2.3 Setting Up Challenge

To set up challenge:

  • Set up the Registration Logic - Validations are used to validate the answers given by a user at the time of registration.

    For information, see Section 7.8, "Configuring the Registration Logic."

  • Set up the Answer Logic - The Answer Logic settings can be configured for the exactness required for challenge question answers and for answering threshold/tolerance, such as the level of fat fingering, typos, abbreviations, and so on.

    For information, see Section 7.9, "Adjusting Answer Logic."

7.2.4 User Flow

The following diagram illustrates the user experience with the KBA framework implemented.

Figure 7-2 KBA User Flow

This diagram illustrates the KBA user flow

Use Case: New User Registration

This section illustrates an example of the new user registration experience.

The use case: You are Helen, a new Acme Corp customer. You have heard the horror stories about online identity theft and it has kept you from utilizing the online service Acme offers. This month however Acme did a customer education campaign showing the many ways customers are protected while online. You feel much better and your trust in the Acme brand has been bolstered. Today you are logging in for the first time.

Directions: Complete the registration flow to log in for the first time.

  1. Open the application.

  2. On the first sign in page, enter <user name> in the User Name field and press Continue.

  3. On the second sign in page, enter <password> into the secure TextPad and click Enter.

    The Your New Security Profile page is displayed with information about Security Image and Phrase and Security Questions and Answers.

  4. Click Continue to register your security profile.

    The Your Security Device page is displayed with a personalized virtual authentication device. On the page you are given options to learn more about your device, obtain a new image and phrase, and upgrade to a higher security device.

  5. If you want, you can select a new image and phrase by clicking the image and phrase link or select a new device by clicking the Upgrade link.

    Click the image and phrase link until you find a device you want.

    If you clicked Upgrade and decided against the upgrade, you can revert to the default security device by clicking the Revert link.

  6. Click Continue to accept the security device, image and phrase.

    The Security Questions set up page is displayed.

  7. Select a question from the pull-down menu, and then answer the question in the TextPad, and click Enter.

  8. Repeat Step 7 until you have completed selecting the questions and entering the answers.

    A welcome page appears with a message that you are successfully logged in.

Use Case: User Login

This section illustrates an example of the user login experience.

Use case: It has been a week since you completed the registration process on your laptop at work. Today you are on a business trip to another state and you are logging in on your laptop from using free Wi-Fi at a local coffee shop.

Directions: Try to log in to the application using a different IP (this should be a public IP and should belong to a different state).

  1. Log in on your laptop using free Wi-Fi at a coffee shop in another state.

    1. On the first sign in page, enter <user name> in the User Name field and press Continue.

    2. On the second sign in page, enter <password> into the secure TextPad and click Enter.

      A page appears asking you to answer a security question. The question appears in QuestionPad. You are asked a challenge question because the public IP group and uncommon state rules are triggered.

      The public IP group rule contains the "Location: in IP group" condition and the uncommon state rule contains the "User: state first time for user" condition.

  2. Enter the answer to the security question in QuestionPad and press Enter.

    If you answer the question successfully, you are logged in.

7.3 Setting Up the System to Use Challenge Questions

This section provides a summary of the steps you must take to set up your system to use challenge questions.

For information on performing a phased rollout KBA and enabling challenge questions, see Chapter 8, "Enabling Challenge Questions."

Task [ ]
Import the OAAM Snapshot [ ]
Link the appropriate policies to the user group that you want KBA to be enabled for. [ ]
Ensure that KBA properties are set [ ]
Enable policies for your security and business needs [ ]

7.3.1 Ensure Policies are Available

A full snapshot of policies, dependent components and configurations is shipped with Oracle Adaptive Access Manager. The snapshot is in the oaam_base_snapshot.zip file and located in the MW_HOME/IDM_ORACLE_HOME/oaam/init directory.

If you are using pre-packaged policies, ensure that the OAAM snapshot has been imported. If you are not using pre-packaged policies, use this chapter as a guideline for enabling challenge questions.

To import the snapshot, refer to the instructions in Section 2.6, "Importing the OAAM Snapshot."

7.3.2 Ensuring that KBA Properties/Default Properties are Set

Ensure that the bharosa.kba.active property is set to true. See Chapter 28, "Using the Properties Editor" for information on modifying properties.

7.3.3 Ensure Challenge Questions are Available

The challenge questions must be present in Oracle Adaptive Access Manager before the users can be asked to register. Challenge questions are included in the OAAM snapshot. For information on importing the snapshot which contains the questions, see Section 2.6, "Importing the OAAM Snapshot."

If you are need to use challenge questions in languages other than English, import the appropriate oaam_kba_questions_locale.zip files from the MW_HOME/IDM_ORACLE_HOME/oaam/kba_questions directory. The locale identifier locale specifies the language version.

7.3.4 Enabling Policies

Link policies that pertain to your business and security needs to a user group to which you want KBA to be enabled. For information on importing policies, see Chapter 10, "Managing Policies, Rules, and Conditions."

7.4 Accessing Configurations in KBA Administration

This section describes how to navigate to KBA administration tasks in OAAM Admin. You can navigate to KBA tasks through the Navigation tree. The KBA Infrastructure provides you with access to all questions, validations, categories, registration and Answer Logic, and other elements.

These are the subnodes under KBA, which provide access to the configurations in the KBA infrastructure:

For alternative methods to open search pages, refer to Section 3.9, "Search, Create, and Import." Validation Search and Edit, Registration Logic and Answer Logic pages can be opened in the same manner as the search pages.

Note that you cannot open the KBA node.

7.5 Managing Challenge Questions

The KBA functionality enables you to manage challenge questions.

You can perform the following task for challenge questions:

7.5.1 Searching for a Challenge Question

Use the Questions Search page to view a list of all challenge questions and search for a question based on various criteria. The Questions Search page provides access to the Questions Details page for any question. When the Questions Search page first appears, the Search Results table is displayed with default filter values.

To search for a question:

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

    An example Questions Search page is shown in Figure 7-3.

    Figure 7-3 Questions Search page

    The KBA Question search page is shown.

    The Questions Search page displays a Search section and a Search Results table that shows a summary of the questions that match your search criteria.

  2. Specify criteria in the Search Filter to locate the questions and click Search.

    The search filter criteria are described in Table 7-2.

    If you want to reset the search parameters to the default setting, use the Reset button.

    Table 7-2 Question Search Criteria

    Field Description

    Question ID

    The ID for the question.

    Question Keyword

    The keyword in the question.

    Status

    The status of the question: Active or disabled.

    Category

    The category to which the question belong. For example: education, pets, sports and so on.

    Locale

    The language the question is in. For example, English, Finnish, Czech, and so on.

    Validations

    Global validations. For example: Four-digit year (YYYY), Month Day (MMDD), and so on

    Answer Logic Hints

    A hint added to questions individually to affect the Answer Logic used to evaluate given answers. For example: Date Answer Hint.

    Created Date

    A timeframe within which the question was created

    Update Time

    A timeframe within which the question was modified.


The Search Results table displays a summary of questions that match the criteria specified. By default, questions are sorted on Question Name, but you can sort questions on Update Time, Created Date, Status, Question, and Category.

In the Search Results table, click the question link to view more details. The Question Details page appears.

Table 7-3, "Question Action menu commands" lists the commands that are available through the Action menu. You can select one or more questions and perform actions on those questions.

Table 7-3 Question Action menu commands

Command Description

New Question

Creates a new question. By default, the question is enabled on create. You can create a question for any locale.

Create Like

Creates a new case that is similar— or "like"—an existing question.

Edit Selected

Enables you to edit the selected question.

Edit Category

Opens the category of the selected question.

Delete Selected

Deletes questions

Activate Selected

Activates questions

Deactivate Selected

Deactivates questions

Import Questions

Imports questions

Export Selected

Exports questions as .XML files


Except for creating a question, edit selected, and edit category, all other operations are bulk operations.

7.5.2 Viewing Question Details and Statistics

The Question Details page provides information such as:

  • Question Sets with Question

  • Users Registered for Question

  • Percentage of Users Registered For Question

  • Percentage of Successful Challenges

  • Percentage of Unsuccessful Challenges

  • Question ID

  • Last Updated Date

To view question statistics:

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. From the Questions Search page, click the question of interest in the Search Results table

    The Question Detail page appears with the statistics.

7.5.3 Creating a New Question

To create a new question

  1. In the Navigation tree, double-click Questions under KBA. The Questions Search page is displayed.

  2. From the Questions Search page, click the New Questions button.

    The New Questions page appears where you can enter details to create a new question.

    Alternative methods to open create pages are listed in Section 3.9, "Search, Create, and Import."

    When the New Question page first appears, the default value for the question status is Active.

    Question, Category, Status, and Locale are required fields.

  3. Pick a locale from the list of locales available.

    By default, the Locale menu displays English and 26 other default locale languages.

  4. Type the new question in the Question field.

    The question names must be unique across categories.

  5. From the Category list, select the category of question you want.

    By default, there is no data in the Category list. You must import the challenge questions ZIP files (oaam_kba_questions_<locale>.zip) for data to appear in the Category menu. You can also create a new category.

  6. In the Locale list, select the language you want.

    By default, the Locale menu displays English and 26 other default locale languages.

  7. Each question can be assigned unique validations to control the answers a user is allowed to register. To assign a local validation, select the validation type from the Registration Validation list.

    The local validations you select in this step control the answers a user is allowed to register for this particular question. It does not control the registration of answers for all questions.

    For information on the difference between global and local validations, refer to Section 7.1.9, "Validations."

  8. In the Answer Logic Hints list, select the type of Answer Logic Hint you want.

    A hint can be added to questions individually to affect the Answer Logic used to evaluate given answers. This is performed to better tune the logic for the type of question. This is especially important for date related questions.

    These hints help the Answer Logic function more successfully on some questions, for example, on date related questions. If a question has the date answer hint applied then the abbreviations, phonetics and fat fingering Answer Logic runs first, and then special date format logic is applied.

  9. Click Apply. A confirmation dialog appears telling you that the question was created successfully.

  10. Click OK to dismiss the dialog.

    The Question Detail page appears for the newly created question.

    After the question has been created, you can edit details.

Note:

The deployment administrator must ensure that there are enough questions in the database for each of the supported locale as configured in OAAM Admin during deployment; otherwise, OAAM Server displays only the English language questions during registration.

The number of locale-specific questions must be equal to or greater than the "Questions User Will Register" multiplied by the "Questions per Menu" multiplied by the "Categories per Menu."

7.5.4 Creating a Question Like Another Question

To create a new question that is similar to an existing question:

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. From the Questions Search page, select the row corresponding to the question of interest.

  3. Click the Create Like icon.

    The Create Like dialog appears with pre-populated data from the original question. Pre-populated fields are Category, Locale, Status, Answer Logic Hints, and Registration Validations. Question, Category, Status and Locale are required fields. The Create Like icon is disabled if multiple rows are selected.

    You can create a question for any locale.

  4. Type the new question in the Question field.

  5. Edit any of the other fields if you want.

  6. Click OK.

    The Question Detail page appears for the newly created question.

    If you click Cancel, the Questions Search page appears.

7.5.5 Editing a Question

The Question Details page enables you to activate/disable questions and edit the question, question category, locale, and registration and answer validation. Read-only question statistics are available in the Question Statistics section. If you edit a question, users using that question receive the updated question.

To edit a question

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Questions Search page, search for the questions you are interested in.

  3. Click the hyperlinked question you want to edit.

    The Question Details page appears.

  4. Make the changes you want.

    You cannot edit the Question ID or last updated time.

  5. Click Apply to save the changes or Revert to discard them.

    If you click Revert, the edited details are reverted to the initial state.

7.5.6 Importing Questions

To import questions:

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Questions Search page, click Import Questions or select Import Selected from the Actions menu.

  3. In the Import Questions dialog, type the path and name of the file; or use the Browse (...) button to locate the ZIP file that contains the questions, and then select the file.

  4. Click Open and then click Import.

    If you import questions that belong to a category not currently in the system, the category is also imported. If you import a question with the same ID number as an existing question, the existing question is overwritten.

    A confirmation dialog displays the status of the operation and a list of questions that were imported into the system.

  5. Click Done.

7.5.7 Exporting Questions

Multiple questions can be selected and exported.

To export questions:

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Questions Search page, search for the questions you are interested in.

  3. Select the rows corresponding to the questions of interest.

  4. Select the Export icon or Export from the Actions menu.

  5. In the Export dialog, click the Export button.

    The selected questions are exported.

7.5.8 Deleting a Question

To delete a question, follow these instructions.

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Questions Search page, search for the questions you are interested in.

  3. Select the rows corresponding to the questions of interest and click Delete or select Delete Selected from the Actions menu.

    The Delete button and Delete Selected menu item are enabled only if a question is selected.

    A Confirm Delete dialog is displayed with a list of questions and question IDs.

  4. Click Delete to delete the questions.

    Deleted questions are not available for new registrations but users currently registered for these questions can continue to use them.

    A confirmation dialog is displayed.

  5. In the confirmation dialog, click OK.

An error is displayed when you try to delete a question that is in used by a registered user.

When a user tries to delete multiple questions and if a few questions are associated with the user, the system bypasses the associated questions and deletes the rest and displays a message to user that the following list was not deleted. Deleted questions are not available for new registrations but the user currently registered for these questions can continue to use them.

7.5.9 Disabling a Question

To disable a question

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Questions Search page, search for the question you want to disable.

  3. Select the rows corresponding to the questions you want to disable.

  4. Press the Deactivate button or select Deactivate from the Actions menu.

    The selected questions are disabled.

Alternatively, you can disable a question by clicking the hyperlinked question on the Questions Search page, and then selecting Disable in the Status field on the Questions Details page.

The following scenarios occur when a question is disabled:

  • The disabled question cannot be used to generate a new user's Question Set.

  • At re-registration or reset, the disabled question is replaced with another question from the same category for those users who had the disabled question in their question set.

  • The disable question remains active for users who have registered the question. If the user is re-registering or changing user preference, the disabled question is replaced with another question from the same category.

7.5.10 Activating Questions

To activate questions:

  1. Navigate to the Questions Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Questions Search page, search for the questions you are interested in.

  3. Select the rows corresponding to the questions you want to activate.

  4. Press the Activate button or select Activate from the Actions menu.

    The selected questions are activated.

7.6 Setting Up Validations for Answer Registration

You can manage and define validations that are used on answers given by users at the time of registration.

This section provides instructions to set up global validations that control the answers a user is allowed to register for all questions. For information on the difference between global and local validations, refer to Section 7.1.9, "Validations."

7.6.1 Using the Validations Page

The Validations page enables you to perform the following functions:

Navigate to the Validations page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

An example Validations page is shown in Figure 7-4.

Figure 7-4 Validations Page

The KBA Validation page is shown.

By default, validations are sorted on Validation Name, but you can sort validations on Updated.

Table 7-4, "Validation Action menu commands" lists the commands that are available through the Action menu. You can select one or more validations and perform actions on those questions.

Table 7-4 Validation Action menu commands

Command Description

Add

Adds a new validation.

Import

Imports validations

Export

Exports validations

Delete

Deletes validations


7.6.2 Adding a New Validation

You can add a new validation to the system when needed. Validations are defined for use during challenge questions registration.

To add a validation:

  1. Navigate to the Validations page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. From the Validations page, click the New Validation button.

    The Add a New Validation page appears where you can enter details to create a new validation.

    Alternatively, you can open the Add a New Validation page by:

    • Selecting the Add Validation button from the Search Results toolbar.

    • Selecting New Validation from the Actions menu in Search Results.

  3. In the Validation Type list, select the validation scheme you want to add.

    You might, for example, select the validation type, Maximum Length. This validation scheme allows the customer to create a validation for the maximum allowed length for the answer.

    The parameters of the validation appears in the Validation Parameters Details area of the Validations page.

    Note:

    · The fields displayed on the page depends on the validation type selected.
  4. In the Name field, enter the name you want for this instance of the validation scheme.

    When you create a validation from available validation schemes in the system, you are adding an instance of validation. You can then customize that instance.

  5. Specify validation parameter that correspond to your validation type.

    For example, validation parameter can be 30 for an instance of Maximum Length validation. This validation instance restricts the user from entering an answer longer than 30 characters in length.

    Table 7-5 Validation Parameters

    Validation Type Label for Fields Description for Validation Parameter Example for note

    Inappropriate Language

    Enter Inappropriate Words

    Inappropriate language for answer

    Example: Sloppy, Wrong, Yucky

    Regex

    Enter Regex Pattern

    Real expression pattern string for the answer.

    For example, pattern can be "[A-Za-z0-9]+" for Alpha-numeric validation.

    If the answer entered by the user is not as per the configured regular expression pattern; then, the validation fails and a configured error message is displayed.

    Example: [0-9]+

    Date

    Enter Date Notation

    Date/Time pattern string for the answer.

    For example, the pattern can be "MMddyy" for Month Day Year validation.

    If the date/time answer entered by the user is not as per the configured pattern, the validation fails and a configured error message is displayed.

    Example: MMDDYY

    Minimum Length

    Enter Minimum Length

    Minimum length (number) for the answer.

    If the length of the answer entered by the user is less than the configured value, the validation fails and a configured error message is displayed.

    Example: 3

    Maximum Length

    Enter Maximum Length

    Maximum allowed length (number) for the answer.

    If length of the answer entered by the user is above the configured value, the validation fails and a configured error message is displayed.

    Example: 3

    Repeated Character

    Enter Number of Repeating Characters

    Allowed number of repeated characters in the answer.

    If the answer entered by the user contains repeated characters more than the configured value, the validation fails and the user gets a configured error message.

    Example: 3

    Repeated Answers

    Enter Number of Repeating Answers

    Allowed number of repeated answers.

    For example parameter value can be '1' for unique answer validation.

    If the answer entered by the user is repeated more than configured number of times, the validation fails and the user gets a configured error message.

    Example: 1

    Character

    Enter Disallowed Characters

    Characters that are not allowed.

    Example: *


  6. Click Add.

    OAAM Admin adds this validation instance to the list of validations in the System.

7.6.3 Editing an Existing Validation

To edit an existing validation

  1. Navigate to the Validations page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. From the Validations page, select the hyperlinked configured validation you want to edit.

  3. In the Validation Parameter Details section, make the necessary changes. See Table 7-5, "Validation Parameters".

    You can edit strings, numbers, and characters in the validation parameters field.

  4. Click Save

    OAAM Admin updates this validation instance in the system.

7.6.4 Importing Validations

You can add a global validation to the global validation list on the Registration Logic page by importing a global validation into the system. It is added automatically to the global validation list without any notification.

7.6.5 Exporting Validations

To export validations:

  1. Navigate to the Validations page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Validations page, search for the validations you are interested in.

  3. Select the rows corresponding to the validations you want to export.

  4. Select Export Selected from the Actions menu.

  5. When the Export dialog appears, select Save File, and then Save.

    The file is exported and saved as a ZIP file.

7.6.6 Deleting Validations

To delete validations:

  1. Navigate to the Validations page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Validations page, search for the validations you want to delete.

  3. Select the rows corresponding to the validations of interest and click Delete.

    A dialog appears asking you if you want to delete the validation.

  4. Click Delete to confirm.

    A dialog appears with the message that the validation was deleted successfully.

  5. Click OK to dismiss the dialog.

7.7 Managing Categories

You can perform the following task for categories:

7.7.1 Searching for a Category

On the Categories Search page you can view a list of all categories and search for a category based on various criteria. The Categories Search page provides access to the Category Details page for any category.

When the Categories Search page first appears, the Search Results table displays results from the default search values.

To search for a category:

  1. Navigate to the Categories Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

    The Categories Search page displays a Search section and a Search Results table that shows a summary of the categories that match your search criteria.

  2. Specify criteria in the Search Filter to locate the specific question category and click Search.

    The search filter criteria are described in Table 7-2.

    If you want to reset the search parameters to the default setting, use the Reset button.

    Table 7-6 Question Search Criteria

    Field Description

    Category

    The category name. For example: education, pets, sports and so on.

    Status

    The status of the category.

    Created Date

    A timeframe within which the category was created or modified.

    Update Time

    A timeframe within which the category was updated


The Search Results table displays a summary of categories that match the criteria specified.

In the Search Results table, click the hyperlinked category you interested in to view more details. The Category Details page appears.

7.7.2 Creating a New Category

If the out-of-the-box categories do not meet your needs, create categories that can hold relevant questions you plan to create.

To create a new category

  1. Navigate to the Categories Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. From the Categories Search page, click the New Category button or the New icon.

    Alternative methods to open create pages are listed in Section 3.9, "Search, Create, and Import."

    The New Category page appears where you can enter details to create a new category.

  3. Type the new category in the Category field.

  4. Enter a description.

  5. Click Apply.

    The Category Details page appears for the newly created category.

7.7.3 Editing a Category

The Category Details page enables you to changed the status, name, and description for an existing category.

To edit a category

  1. Navigate to the Categories Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Categories Search page, search for the category you are interested in.

  3. Click the hyperlinked category you want to edit.

    The Category Details page appears.

  4. Make the changes you want.

    Category name edits do not affect the questions already registered or new registrations.

  5. Click Apply to save the changes or Revert to discard them.

    If you click Revert, the edited details revert to the initial state.

    If questions that belonged to a category are moved to the new category, the user would be presented with the same questions.

7.7.4 Deleting Categories

To delete a category, follow these instructions.

  1. Navigate to the Categories Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Categories Search page, search for the categories you want to delete.

  3. Select the rows corresponding to the categories you want and click Delete.

    A dialog is displayed asking if you want to delete the categories.

  4. Click Delete to confirm.

    A dialog is displayed with a message that the categories were deleted successfully.

  5. Click OK to dismiss the dialog.

You can delete a category if it is not referenced by questions. If the category is referenced by a question, an error message appears.

7.7.5 Activating Categories

To activate categories:

  1. Navigate to the Categories Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Categories Search page, search for the categories you want to activate.

  3. Select the row for each category you want to activate.

  4. Press the Activate button.

    A dialog is displayed with a message that the category was activated successfully.

  5. Click OK to dismiss the dialog.

7.7.6 Deactivating Categories

The deactivated category is not used to generate a new question set. All questions in the deactivated category are replaced with questions from a new category that has not been used to generate a current question set at re-registration or the changing of user preferences for users with the question in their question set.

For users with the questions registered, the questions from the deactivated category continue to be active. If the user is re-registering or changing user preferences, all questions in the deactivated category are replaced with questions from a new category that has not been used to generate current question set.

To deactivate categories:

  1. Navigate to the Categories Search page, as described in Section 7.4, "Accessing Configurations in KBA Administration."

  2. In the Categories Search page, search for the categories you are interested in.

  3. Select the row for each category you want to deactivate.

  4. Press the Deactivate button.

    A dialog is displayed with a message that the category was deactivated successfully.

  5. Click OK to dismiss the dialog.

7.8 Configuring the Registration Logic

You can use Registration Logic to set up the configuration for:

Configure Registration for Questions and Answers

To configure the registration for challenge questions and answers:

  1. In the Navigation tree, double-click Registration Logic under KBA. The Registration Logic page is displayed.

  2. To enter or change the values for the question set generation, you can specify the following settings.

    • Number of questions that a customer must register

    • Number of questions that appear on each menu

    • Number of categories per menu

      The categories per menu cannot be more than the number of categories available in the system.

    Note:

    Enter realistic numbers. For example, the number of questions that a user must register should be 3 to 7 questions
  3. Click Apply.

    A confirmation dialog is displayed with the message, "Registration Logic details updated successfully."

  4. Click OK.

Add Global Validation

To add global validations (validations you want to apply to all questions):

  1. In the Navigation tree, double-click Registration Logic under KBA. The Registration Logic page is displayed.

  2. Click the Add button on the results header.

    The Add Global Validation dialog appears.

    Figure 7-5 Add Global Validation

    The global validation page is shown.
  3. In the Add Global Validation dialog, search for the global validations you want to add.

  4. Select the row corresponding to the validation you want to add.

    You cannot select more than one validation to add at a time.

  5. Click Add.

    The selected validation is added.

Delete Global Validation

To delete global validations (validations you do not want to apply to all questions):

  1. In the Navigation tree, double-click Registration Logic under KBA. The Registration Logic page is displayed.

  2. Select the rows corresponding to the validations you want to delete and then click the Delete button on the results header

    A dialog appears asking if you want to delete the validation.

  3. Click Delete to dismiss the dialog.

    A confirmation dialog appears.

  4. Click OK to dismiss the dialog.

7.9 Adjusting Answer Logic

Answer Logic, a feature of KBA, increases the usability of security questions.

7.9.1 About Answer Logic

Administrators can adjust how exact the challenge answers given by end users must match the answers they gave at the time of registration. If the answer given by a user is fundamentally correct but there are minor variations such as typos, misspellings and abbreviations they should pass. The increased usability of KBA reduces or eliminates the need for unnecessary call center involvement in moderate risk situations and self service flows.

Answer Logic (fuzzy logic) algorithms can be configured on the Answer Logic page. The algorithms are divided into three categories: Common Abbreviations, Fat Fingering (accidentally pressing the nearest neighbor on the keyboard), and Phonetics. The algorithms are available for both the online challenge and phone challenge processes.

Out-of-the-box Answer Logic is only functional for English. Abbreviations can be globalized but creation of locale specific text equivalency files is required. For information, refer to Section 7.11, "Customizing Abbreviations and Equivalences for Locales."

Example of How It Works

Question: Who was your favorite teacher in high school?

Registered answer: Mrs. Smith

Given answer: Misses Smuth

Logic level: If set to High, the answer is accepted.

Table 7-7 Answer Logic Algorithm Example

Algorithm Description Reason

Abbreviations

This algorithm handles common abbreviations, common nicknames, common acronyms, and date format. Looks at file for allowed matches.

If the file contains Mrs=Misses, the match can be made in either direction.

Phonetics

This algorithm handles Answers that "sound like" the registered answer, regional spelling differences, and common misspellings

Smiith sounds like Smith

Keyboard fat fingering

This algorithm handles Answers with typos due to the proximity of keys on a standard keyboard.

"u" is directly to the left of "i" so it is allowed


7.9.2 Common Response Errors

This section highlights the most common response errors and shows how Answer Logic algorithms are used for the system to intelligently detect the correct answers in the challenge response process. Examples of abbreviations, phonetics, and keyboard fat fingering are also provided.

7.9.2.1 Abbreviations

Common abbreviations, common nicknames, common acronyms, and date format are handled by this algorithm.

Common Abbreviations

This algorithm matches the words in the following pairs as equivalent. OAAM Admin has predefined list of word-pairs that cover common abbreviations, common nicknames and common acronyms.

  • Street - St.

  • Drive - Dr.

  • California - CA

The list can be customized by creating a new abbreviation file, custom_auth_abbreviation_config.properties. For information, refer to Section 7.10, "Customizing English Abbreviations and Equivalences."

Common Nicknames

Oracle has a predefined list of the most common nicknames that is used in the challenge response process.

  • Timothy - Tim

  • Matthew - Matt

Date Format

The questions that require date as the answer specify the format in which the user should enter the answer. The format is either YYYY or MMDD, but not both. However, from experience, users still use other formats during the challenge response process. The abbreviation logic for date format sees the following as the same:

  • 0713

  • 713

  • July 13th

  • July 13

  • July 13, 1970

7.9.2.2 Phonetics

Answers that "sound like" the registered answer, regional spelling differences, and common misspellings are handled by this algorithm. The phonetics algorithm is only supported in English.

Common Misspellings

Oracle's Phonetic Answer Logic algorithm accounts for misspellings.

  • ph - f

  • Correct word: elephant - Spelling mistake: elefant

7.9.2.3 Keyboard Fat Fingering

Oracle's Fat Fingering algorithm accounts for typos due to the proximity of keys on a standard keyboard and transposed letters. Answers with typos due to the proximity of keys on a standard keyboard are handled by this algorithm.

The number of fat fingering characters allowed depends on the length of the original word and the level set. The algorithm returns a percentage score associated with the characters that have an exact match. The intensity determines the minimum score required to match the answer with the registered answer.

Note:

The fat fingering algorithm is only supported in English.

Common Typos

  • Switching "w" and "e"

  • Switching "u" and "i"

  • Switching "t" and "r"

Examples of Fat Fingering

  • Correct word: signature - Fat finger: signatire

7.9.3 Level of Answer Logic

The level of Answer Logic, the intensity or strength of algorithms, used to evaluate answers given for challenge questions is adjustable. You can enable or disable each algorithm and you can also specify the following levels for the algorithms used:

  • Off – No Answer Logic is used; answers must exactly match those previously registered by the user.

  • Low – Less Answer Logic; answers provided by the user must be a match or near-match to the answers that were provided at the time of registration

  • Medium – More Answer Logic; the user is given some leeway for the answers that are provided. For example, St. might be accepted for Street.

  • High – Highest level of Answer Logic. The constraints are not strict for matching.

Each algorithm generates a score that represents how close the given answer is to the registered answer. OAAM Admin can be configured to accept different threshold score ranges for each algorithm individually. Separate threshold values for each algorithm (low/medium/high) are set in a properties file. The default thresholds are described as follows.

7.9.3.1 Abbreviation

For abbreviation:

  • Return values: 0 or 100 (no-match OR match)

  • Levels: ON or OFF

  • Logic

    • If an abbreviation entry exists linking the given strings, score is 100

    • Else score is 0

7.9.3.2 Fat Fingering

For fat fingering:

  • Return values: range 0 to 100

  • Levels: OFF, LOW (90+), MEDIUM (75+), HIGH (60+)

  • Logic

    • If the string lengths do not match, score is 0

    • If a position does not have the expected character or its neighbor, score is 0

    • Else compute the number of positions that have the neighboring characters.

    • Score = (StringLength – NeighborPositionCount) * 100 /StringLength

7.9.3.3 Phonetics

For phonetics:

  • Return values: 0, 60, 75, 90

  • Levels: OFF, LOW (90), MEDIUM (75), HIGH (60)

  • Logic

    • Compute primary and alternative phonetic keys for the given strings, using DoubleMetaphone algorithm

    • If primary keys of both strings match, score is HIGH

    • Else if a primary key of one of the strings and alternate key of the other string match, score is MEDIUM

    • Else if the alternate keys of both string match, score is LOW

    • Else the score is 0

7.9.3.4 Multiple Word Answers

Answers that contain multiple words are treated in a specific way by the Answer Logic. If the final score from a complete string match does not meet the "success" criteria, individual words in the answer are evaluated. If each individual word in an answer is accepted by any of the algorithms the whole answer is accepted.

Multiple word answers with missing/extra words must be an exact match to the registered answer. Answers must have the same number of words as the registered answer to be evaluated with Answer Logic. For example: If the registered answer is "Mead Elementary School" and the answer given at the time of challenge is "Mesd Elem Sch":

Abbreviation: Mead–Mesd=0; Elementary-Elem=100; School-Sch=100
Fat-finger: Mead-Mesd=75; Elementary-Elem=0; School-Sch=0
Phonetics: Mead-Mesd=0; Elementary-Elem=0; School-Sch=0

Assuming that abbreviation was set to anything besides off and fat fingering was set to medium or high, since all three words would be accepted individually, the whole answer would be accepted.

7.9.4 Configuring Answer Logic

The KBA Answer Logic tab includes controls for the level of each Answer Logic algorithm used for answer validation. The higher the level the less exact answers need to be for acceptance.

To configure Answer Logic:

  1. In the Navigation tree, double-click Answer Logic under KBA.

    You can specify different settings for Online Challenge and CSR Phone Challenge.

    Figure 7-6 Answer Logic

    The answer logic page is shown.
  2. To change the level of Answer Logic used for keyboard fat fingering and phonetics, select Off, Low, Medium, or High: the lower the setting the higher degree of exactness required.

    For information on logic levels, see Section 7.9.3, "Level of Answer Logic."

  3. Click OK.

7.10 Customizing English Abbreviations and Equivalences

Answer Logic checks if the answer provided by the user matches closely to the ones provided during registration. Answer Logic, in part, relies on pre-configured sets of word equivalents, commonly known as abbreviations.

Although there are several thousand English abbreviations and equivalences in the English version of Oracle Adaptive Access Manager, customers can perform customizations per their business requirements. For example, the customer might want the following to be considered a match.

Registered Answer Given Answer
nineteen hundred ninety nine 1999

The out-of-the-box English abbreviations and equivalences are in a file named, bharosa_auth_abbreviation_config.properties. Changes cannot be made to this file.

To customize abbreviations, a new file must be created with a new set of abbreviations. This file takes precedence over the original file and all abbreviations in the original file are ignored.

To customize abbreviations:

  1. Create a new abbreviation file, custom_auth_abbreviation_config.properties, and save it in the IDM_ORACLE_HOME/oaam/conf directory.

    If the conf folder does not exist, create one.

  2. Add abbreviations and equivalences to custom_auth_abbreviation_config.properties.

    There are two different formats to use:

    Word=equivalent1
    Word=equivalent2
    

    or

    Word=equivalent1,equivalent2, equivalent3
    

    For example, in English, some equivalence for James are:

    Jim=James,\Jamie,\Jimmy
    

    With the addition of the equivalences, if a user were to enter a response as Jim, but had originally entered James, Jim would be accepted. Another example is that St may be equivalent to Street.

    Note:

    Retrieval of abbreviation values is not based on the browser language; values are retrieved from the properties files.
  3. Add the file to the OAAM Extensions Shared Library (WEB-INF/classes).

  4. Using the Properties Editor, change the property, bharosa.authenticator.AbbreviationFileName, to point to the complete path to the file, WEB-INF/classes/custom_auth_abbreviation_config.properties in the extensions folder.

    The default value for the property bharosa.authenticator.AbbreviationFileName is bharosa_auth_abbreviation_config.properties. Create the bharosa.authenticator.AbbreviationFileName property if it does not already exist.

    Restarting the system is not necessary for the change to take effect.

    For information on using the Properties Editor, refer to Chapter 28, "Using the Properties Editor.".

  5. Configure the Answer Logic by following the instructions in Section 7.9, "Adjusting Answer Logic."

If you want to revert to the original out-of-the-box abbreviations, set bharosa.authenticator.AbbreviationFileName back to bharosa_auth_abbreviation_config.properties.

7.11 Customizing Abbreviations and Equivalences for Locales

Locale-specific abbreviation files are shipped with OAAM. These files are named bharosa_auth_abbreviation_config_<locale>.properties where <locale> is the locale string. For example, the Spanish version of the file is bharosa_auth_abbreviation_config_es.properties.

Changes cannot be made to this file. To customize abbreviations, a new file must be created with a new set of abbreviations. This file takes precedence over the original file and all abbreviations in the original file are ignored.

If you want to localize for one locale (for example, for Japanese only), perform the following steps:

  1. Create one file specific to the locale with the same prefix as the original locale-specific abbreviation file. For example, Abbreviations_ja.properties for Japanese.

  2. Add the file to the OAAM Extensions Shared Library (WEB-INF/classes).

  3. Using OAAM, set the value of property bharosa.authenticator.AbbreviationFileName to that file's absolute path, WEB-INF/classes/Abbreviations_ja.properties in the extensions folder.

If you want customize for multiple locales, perform the following steps:

  1. Create the files specific to those locales with the same prefix as the original locale-specific abbreviation file.

    For example,

    /mydrive/IDM_ORACLE_HOME/oaam/conf/Abbreviations_es.properties for Spanish

    /mydrive/IDM_ORACLE_HOME/oaam/conf/Abbreviations_ja.properties for Japanese

  2. Add the file to the OAAM Extensions Shared Library (WEB-INF/classes).

  3. Using OAAM, set the value of property bharosa.authenticator.AbbreviationFileName to that file's absolute path, WEB-INF/classes/Abbreviations.properties in the extensions folder.

    The locale prefix is absent in the value of the property because the locale settings of the end user's browser determine the runtime locale.

7.12 Use Cases

This section describes example use cases for KBA.

7.12.1 Use Case: Create Challenge Question

You have been asked to develop some new challenge questions to augment the existing out-of-the-box questions. Come up with a new question. Directions: Part A: Export the existing challenge questions as a backup. Part B: Create the new question in any category you like in English.

  1. Log in to OAAM Admin as an administrator.

  2. In the Navigation tree, double-click Questions under KBA. The Questions Search page is displayed.

  3. In the Questions Search page, click the column header on the Search Results table to select all the rows.

  4. Select Export Selected from the Actions menu.

  5. In the Export dialog, select Save File and click OK.

  6. Browse for the location to save the ZIP file and click Save.

  7. After backing up the questions, search for the question that you are interested in.

  8. If the question does not exist, click New Question. The New Question page is displayed.

    Question, Category, Status, and Locale are required fields.

    When the New Question page first appears, the default value for the question status is Active.

  9. In the Question field, type in the question.

  10. In the Category field, select a category.

  11. Select English as the locale.

  12. Select the registration validation.

  13. Select Answer Logic hints.

  14. Click Apply. A confirmation dialog appears telling you that the question was created successfully.

  15. Click OK to dismiss the dialog.

    The Question Details page appears with information about the question and the question statistics.

  16. After the question has been created, you can edit details.

7.12.2 Use Case: KBA Registration Logic

The security team has determined that it only wants to have challenge questions about sports and pets. Part A: You must log in to OAAM Admin and delete all the questions for all categories except Sports and Pets. Before doing this you should export all the challenge questions as a backup in case you want to revert. Part B: The security team has also decided that each user should register four questions and that each registration menu should contain questions from at least four categories. Configure this in OAAM Admin.

To configure KBA Registration Logic:

  1. Log in to OAAM Admin as an administrator.

  2. In the Navigation tree, double-click Questions under KBA. The Questions Search page is displayed.

  3. Select all the questions in the Search Results table to export all the challenge questions as a backup in case she wants to revert.

    Clicking the # in the column header selects all rows in the Search Results table.

  4. Select Export Selected from the Actions menu.

  5. In the Export dialog, select Save File and click OK.

  6. Browse for the location to save the ZIP file and click Save.

  7. After the export, in the Search Results table of the Questions Search page, sort questions by Category.

  8. Select questions that are not in the category of Sports and Pets, and click the Delete.

  9. In the Navigation tree, double-click Registration Logic under KBA. The Registration Logic page is displayed.

  10. In Categories per Menu, enter 4.

  11. In Questions per Menu, enter 4.

  12. In Questions User will Register, enter 4.

  13. Click Apply.

7.12.3 Use Case: KBA Phone Challenge

CSRs can authenticate a user by asking challenge questions over the phone. KBA Phone Challenge can be used for any registered user.

  1. CSR sees the user's status (i.e. Block, Locked, and so on) and the date/time of the last login attempt when a user calls.

  2. CSR requests a question with the Ask Question action and is presented with a challenge question and the field to enter the user's response.

  3. The challenge question presented is not the same question the user has failed online if the user is currently locked out.

  4. The next question in the user's registered questions is presented to the CSR.

  5. The user has a limited number of over the phone attempts at each question. See Section 7.1.10, "Failure Counters" for details and examples.

  6. Error messages are displayed to notify the CSR.

  7. This process continues until the user runs out of questions and attempts or the user has answered a question correctly.

7.12.4 KBA Question Edits

Jeff is a Security Admin and needs to import and edit KBA questions in English and Spanish and add a new English question.

To do so:

  1. Import KBA questions in multiple languages.

    See Section 2.6, "Importing the OAAM Snapshot."

  2. Edit the questions.

    See Section 7.5.5, "Editing a Question."

  3. Add a new question.

    See Section 7.5.3, "Creating a New Question."

7.12.5 KBA Answer Logic Edits

Jeff, a Security Admin, needs to set the KBA answer logic so sloppy users are impacted by typing errors less often.

  1. Set fatfingering answer logic to high.

    See Section 7.9.3, "Level of Answer Logic."

  2. Test against specifications.

7.13 KBA Guidelines and Recommended Requirements

These recommendations provide guidelines for implementing KBA authentication. They provide guidance to institutions for configuring and implementing custom enrollment and challenge procedures within the guidelines of best practices.

7.13.1 Best Practices for Managing Questions

Applying Validations

Many validations may be applied locally or globally. You must be careful not to apply any validations globally that you do not want to influence all answer registration. For example, if the "Four-digit year (YYYY)" validation is applied globally then only numeral answers are accepted during KBA registration. This is a problem if there are questions available to users that normally have alphanumeric answers.

Deleting Questions and Categories

You can create, edit, and delete questions and categories. You should take care when deleting categories and questions. Insufficient numbers of questions and categories can impact the security of the solution and cause usability issues. For example, if the Categories per menu Registration Logic is set to a number that is more than the total number of categories in the system then there may be duplicate questions listed. This can be confusing to users so it should be avoided.

Questions per Menu Setting

The Questions per menu setting should be between 4 and 7. This range provides a good mix of questions in a question set but does not expose too many questions to any single user.

Question User will Register Setting

The Questions user will register setting should be between 3 and 7. This provides enough questions to offer good security but does not over burden a user's memory. The basic industry standard for KBA is 3 registered questions.

The max and min limits are configurable through the following properties.

bharosa.config.type.kba_config.enum.regQuestionsCount.validation.minValue=3 
bharosa.config.type.kba_config.enum.regQuestionsCount.validation.maxValue=7

Challenge Questions Configuration

It is recommended that you completely configure all of the challenge questions, including locale, before making the question available to users.

Challenge Question Disabling

If you disable a challenge question, users who previously had that question continue to have the question even after it is disabled. However, users that are registering for the first time or re-registering are not presented with the disabled question.

7.13.2 Guidelines for Designing Challenge Questions

Guidelines for designing challenge questions are listed below:

  • Question should not require answers that are personally identifiable information. For example, do not ask for Social Security Number, and other identifiers.

  • Questions should not require answers that can easily be discovered via public sources such as the internet. For example, what college did you graduate from?

  • Questions should not have answers that change over time. For example, what is your girlfriends name?

  • Questions should not have answers that are easy to guess. For example, what is your favorite weekday?

  • Questions should not be specific to any one religion, culture or sub-culture. For example, who is your favorite apostle? Which Smurf do you most closely identify with? What race would you prefer to be in the Star Wars Galaxy?

7.13.3 Guidelines for Answer Input

Recommended requirements for answers are listed below:

  • Answers must be at least 4 characters.

  • No more than 2 answers can be the same during registration.

  • Answers cannot have more than 2 repeating characters.

  • Special characters are not allowed.

  • Answers are not case-sensitive.

  • Extra white spaces are removed.

  • Fuzzy logic implemented - degree configurable by client.

7.13.4 Other Recommended Requirements

Other tips for challenge questions are:

  • A unique question set should be generated for each user.

  • The user should register 3-5 questions. i.e. 15 total questions to select from, 3 drop-down menus of 5 questions each.

  • There should be a maximum of 2 questions from the same category.

  • There should be a maximum opt-out - i.e. 3 opt-out attempts before forcing registration.

  • When challenged, the same question is to be presented until the user responds correctly or question is reset by customer service agent.