How To: Enable and Configure Device Recognition (DFP)

Version Affected: All

 

Overview

Device Recognition, also called Digital Fingerprinting (DFP), lets a realm skip MFA for a device it already recognizes. This article covers enabling Device Recognition on a realm, controlling how long a device is remembered before it must be re-fingerprinted, and adjusting how much weight each collected signal has on the resulting score.

In this article

• Method 1: Enable Device Recognition (DFP) on a Realm
• Method 2: Set How Long a Device Is Remembered
• Method 3: Adjust Component Weightings to Change How the Score Is Calculated

Method 1: Enable Device Recognition (DFP) on a Realm

All of the following must be true for Device Recognition to work:

1. On the realm's Data tab, set the Fingerprint property field to an attribute that is marked as writable. In an Active Directory datastore, the audio attribute is commonly used to store the fingerprint.
   
2. The datastore service account has permission to write to that property field.
3. On the realm's Workflow tab, Client Side Control is set to Device/Browser Fingerprinting.
4. The realm is using Private Mode, since fingerprinting only occurs in Private Mode.

Method 2: Set How Long a Device Is Remembered

By default, Device Recognition never expires a recognized device. To have the realm forget a device after a set number of days, on the realm's Workflow tab set:

• FP expiration length: how many days a fingerprint is valid for, counting from when it was created.
• FP expiration since last access: how many days a fingerprint is valid for, counting from its last use.

A value of 0 (or any negative number) in either field means no expiration.

Method 3: Adjust Component Weightings to Change How the Score Is Calculated

Each profile component collected for a DFP can be weighted High, Low, or Off from the realm's Data tab:

• High has a value of 100.
• Low has a value of 25.
• Off has a value of 0.

All the components' values are summed, and each individual component's score is calculated as a percentage of that total. For example: if the total is 550, divide each component's value by 5.5; if the total is 475, divide each by 4.75.

When a user authenticates, the newly-calculated score is compared against their existing fingerprint (if one exists). Depending on how close the two scores are, SecureAuth either updates the existing fingerprint or creates a new one and prompts the user for MFA.

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.