One or more authentication modules instances can be configured so a user must pass authentication credentials to all of them. This is referred to as authentication chaining. When an authentication chain is configured, a user interacts with each of the authentication module instances in the chain, from the top down, in order to pass the authentication process. A criteria flag is assigned to each instance in the chain that defines how to continue processing the ordered group of modules if, for example, authentication to one of the modules fails. Once authentication to all modules in the chain has been successfully achieved, the Authentication Service validates that all user identifiers used map to the same user. (These identifiers must be configured in the User Alias List attribute in the user's profile.) If this validation is successful, a session token is issued for the user and the policy evaluation process begins. Authentication chains can be assigned to a realm, a user, a role, or a service.

Note - Authentication chaining is achieved using the Java Authentication and Authorization Service (JAAS) framework integrated into the Authentication Service.

To Create an Authentication Chain

1. Click the name of the realm to which you will add the new authentication chain.
2. Select the Authentication tab.
3. Click New under Authentication Chaining.
4. Enter a name for the authentication chain and click OK.

   The authentication chain's Properties page will be displayed.

5. Click Add to define one or more authentication module instances for the chain.
6. Chose one or more of the displayed module instances for the chain.

   The instances displayed are picked up from the realm's configured Module Instances.

7. Select the criteria for the particular instance in the authentication chain.

   These flags establish enforcement criteria for the specified authentication module. There is a hierarchy for this enforcement; Required being the highest and Optional the lowest.

   Required

   Authentication to this module is required to succeed. If any of the required modules in the chain fail, authentication will ultimately fail. However, whether a required module succeeds or not, the authentication process will continue with the next module in the chain.

   Requisite

   Authentication to this module is required to succeed. If it succeeds, the authentication process continues with the next module in the chain. If it fails, control immediately returns back to the requesting application.

   Sufficient

   The module instance is not required to succeed. If it does succeed, control immediately returns back to the requesting application. If it fails, the authentication process continues with the next module in the chain.

   Optional

   The module instance is not required to succeed. Whether it succeeds or fails, the authentication process continues with the next module in the chain.

   Overall authentication succeeds only if all Required and Requisite modules succeed. If a Sufficient module is configured and succeeds, then only Required and Requisite modules prior to the Sufficient module need to have succeeded for overall authentication to succeed. If no Required or Requisite modules are configured for an application, then at least one Sufficient or Optional module must succeed.

8. Enter options for the chain.

   This allows you to define additional options for the module as key=value pairs as in debug="true". Multiple options are separated by a space. There is no limit to the number of options.

9. Define the remaining attributes.

   Successful Login URL

   This attribute specifies the URL that the user will be redirected to upon a successful authentication. The format is clientType/URL.

   Failed Login URL

   Specifies the URL that the user will be redirected to upon a failed authentication

   Authentication Post Processing Class

   Defines the name of the Java class used to customize the post authentication process after a login success or failure

10. Click Save.