IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

Device Registration Cookbook

  • 1.  Device Registration Cookbook

    Posted 01/11/21 07:40 AM
    Edited by Joao Goncalves 01/11/21 01:47 PM
    I need to implement Device Registration.
    I understand that this must be enabled before hand. The Device Registration is provided through REST API.
    I believe these APIs, must be accessible through a junction. (/scim, for example)

    There is the Verify_Access_MMFA cookbook that explains how to implement Device Registration, in section 10.2.5 but included in IBM Verify. Here they identify the PATCH method to /scim/Me endpoint and the message.

    This is the content of the PATCH message:
    {"schemas":["urn:ietf:params:scim:api:messages:2.0:PatchOp"],"Operations":[{"op":"add","path":"urn:ietf:params:scim:schemas:extension:isam:1.0:MMFA:Authenticator:fingerprintMethods","value":[{"keyHandle":"F6A0FAF0-F862-4593-A072-F506D301FF12","publicKey":"MIIB... … … … … … … … … …","enabled":true,"algorithm":"SHA512withRSA"}]}]}

    In this case, there must be an APP that can access the private key of the mobile device and generate the complete JSON request.
    From the internet I found a JavaScript library that can generate the fingerprint. Is this a standard? Is this a proprietary IBM format?

    Is this the way to register fingerprint method?

    Thanks

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: Device Registration Cookbook

    Posted 01/12/21 04:27 AM
    Hi Joao,

    Just to be clear... when you talk about "device registration", I think you mean registration of "Mobile authenticator app" against user's account? I'll assume that for this answer.

    The registration of signatures by a mobile authenticator app is done by the app itself - it is not something that you need to do out-of-band.  The flow shown in the MMFA cookbook is not a flow that you need to perform yourself - The cookbook is just providing information on the process that the authenticator app follows to help with understanding the full flow.

    The only time you would need to implement this signature registration flow yourself is if you were writing your own mobile application to act as an MMFA authenticator app.  In that case you would probably use the iOS or Android "Verify SDK" for this purpose.  I don't think that's what you're trying to do though?

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Device Registration Cookbook

    Posted 01/12/21 05:02 AM
    In fact, when I refer Device Registration, I did not mean registration of "Mobile authenticator app".
    What I meant was about device fingerprint, as stated in https://www.ibm.com/support/knowledgecenter/SSPREK_10.0.0/com.ibm.isva.doc/admin/cpt/rbaAdminDeviceRegistration.html

    Here it states that Device registration is the process that stores the device fingerprint of the user in the context-based access database.

    The manual does not show a way to register the device. How to do it? I understand the Mobile App must generate the fingerprint JSON and apparently use the Verify Access Rest API to do this. The Rest API is exposed through SCIM. This way, the device can authenticate the user (e.g. biometrics) validating its owner, and then we can authenticate the App user, or depending on the context, we can in fact require additional authentication methods, including SMS, email, and so on.

    Regarding IBM Verify, I believe it works similarly. IBM Verify will need to register the Mobile within the user account, exchange the Key through the QR Code. By doing this the Keys will be the same in both ISAM and Mobile. This way, the time-based generated Access Codes can be synchronized between IBM Verify and ISAM.

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: Device Registration Cookbook

    Posted 01/12/21 10:10 PM
    It sounds to me that you're mixing up "RBA fingerprint" - which refers to specific characteristics of a device - with "MMFA fingerprint" - which refers to use the fingerprint sensor of the phone for authentication. The MMFA cookbook is about the latter. This article IBM Security Access Manager: Protect websites with context-based access might help you with the configuration.

    ------------------------------
    Carsten Hagemann
    ------------------------------

    Original Message


  • 5.  RE: Device Registration Cookbook

    Posted 01/12/21 05:01 AM
    Hi Joao,

    in addition to Jon's reply, here is blog post with an example of how to use the IBM Verify SDK for device registration and enrollment: https://www.ibm.com/blogs/security-identity-access/create-your-own-authenticator/

    The demo server mentioned in that article is unfortunately not available anymore. You will need to setup your environment as described in the cookbook.

    Here are the links to the Verify SDK for Android and iOS.

    ------------------------------
    Carsten Hagemann
    ------------------------------



  • 6.  RE: Device Registration Cookbook

    Posted 07/28/25 12:48 PM

    Hi, this article is no longer available. Has it been moved? We are also trying to do device registration using IBM SV mobile SDK and am struggling to work out how to get started,



    ------------------------------
    Clive Jefferies
    ------------------------------

    Original Message


  • 7.  RE: Device Registration Cookbook

    Posted 07/29/25 09:38 PM
    Edited by Carsten Hagemann 07/29/25 09:38 PM

    Hi Clive,

    that documentation was for the v2 of the mobile SDKs. We have released v3 for Android and iOS meanwhile and you can access it here: https://github.com/ibm-security-verify

    The repositories also contain demo apps to get you started (in the examples folder).

    If you still want to have a look at that article: I'm keeping a copy here: https://www.toomanyrequests.com/create-your-own-authenticator/

    Please reach out if you have further questions.



    ------------------------------
    Carsten Hagemann
    ------------------------------

    Original Message


  • 8.  RE: Device Registration Cookbook

    Posted 07/30/25 09:05 AM

    Hi Carsten,

                      Thanks, looking at that post the thing we are trying to do is, before (part of) device registration. We want to verify the user via an ReST API call to our own system, before doing an OTP. Is there any way, we can use the SDK/SV, as a proxy for the ReST API call and OTP call? I have looked through the docs, but nothing jumps out to me as to how we would achieve that.

    Thanks,

    Clive  



    ------------------------------
    Clive Jefferies
    ------------------------------

    Original Message


  • 9.  RE: Device Registration Cookbook

    Posted 07/30/25 08:54 PM

    I (hopefully) answered your question here: https://github.com/ibm-security-verify/verify-sdk-android/issues/43

    If that doesn't quite align with what you're trying to achieve, I'd be happy to find a time for a short online meeting to walk through your use case together. Just let me know what works best.



    ------------------------------
    Carsten Hagemann
    ------------------------------

    Original Message


  • 10.  RE: Device Registration Cookbook

    Posted 08/01/25 06:59 AM

    Thanks Carsten, it would be great to be able to have a meeting, to understand how we would get started with our use case.

        



    ------------------------------
    Clive Jefferies
    ------------------------------

    Original Message


  • 11.  RE: Device Registration Cookbook

    Posted 01/13/21 10:19 AM
    Hi Joao,

    For the device registration in the runtime database, which I believe is what you're trying to do, you do this by configuring the Risk profile and an RBA policy with a Register Device obligation.  Hopefully the article in the link below will point you in the right direction:

    https://community.ibm.com/community/user/security/blogs/enio-padilla1/2020/05/20/isam-rest-device-registration

    Enio

    ------------------------------
    Enio Padilla
    ------------------------------



Related Content