IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Register Device missing Fingerprint

    Posted 07/02/19 11:54 AM
    We have a checkbox to register devices so OTP only needs to be entered once rather than every time the user authenticates.  It works for some browsers but looks like browsers are starting to provide options to withhold access used to gather fingerprint data.  The business is testing and they are now issuing a bug that this feature is not working.  I found the following article about this issue:

    IBM AAC attribute collection service (info.js) collects null value for browserPlugins and Firefox browser
    Ibm remove preview
    IBM AAC attribute collection service (info.js) collects null value for browserPlugins and Firefox browser
    The info attribute collection service is not able to collect a value for browserPlugins for the Firefox browser. Depending on the configuration, this can cause the device fingerprint to fail.
    View this on Ibm >

    As I mentioned, the result is the user has to supply OTP everytime they login.  Our business wants this feature to work.  Has anyone run into this problem and come up with a solution?

    Thanks


    ------------------------------
    Troy
    ------------------------------


  • 2.  RE: Register Device missing Fingerprint

    Posted 07/02/19 12:56 PM
    Hi Troy,

    Many have found that it's simpler, and more deterministic, to use a random-value persistent cookie set on the browser to identify it as a registered device.  Shane Weeden dedicated a blog post to this subject which I'm sure will prove valuable:
    https://www.ibm.com/blogs/sweeden/risked-based-access-with-persistent-cookie-device-fingerprint/

    Jon.

    ------------------------------
    Jon Harry
    Consulting IT Security Specialist
    IBM
    ------------------------------



  • 3.  RE: Register Device missing Fingerprint

    Posted 07/03/19 02:24 AM
    I would open a Support Case in any event to ensure the issue is tracked and if there are updates needed to info.js for newer, cross browser support that it can be tracked.

    Have you looked at the Advanced Tuning Parameter of AAC -deviceRegistration.allowIncompleteFingerprints?  refer to https://www.ibm.com/support/knowledgecenter/SSPREK_9.0.7/com.ibm.isam.doc/config/reference/ref_aac_advcfgprop.html#aac_advcfgprop__d178e964

    ------------------------------
    Scott Andrews
    ------------------------------

    Original Message


  • 4.  RE: Register Device missing Fingerprint

    Posted 07/08/19 09:35 AM
    Thanks for the responses.  Before I went on holiday, we found a missing ACL for /mga/sps/ac preventing the AJAX call from working.   We see devices now in the runtime and looks pretty good.

    I will review Shane's blog so we aware of this for future solution.

    ------------------------------
    Troy Burkle
    ------------------------------

    Original Message


Related Content