Securing Realms

Module-based authentication lets users authenticate using the module=module-name login parameter, therefore bypassing multi-factor authentication if multiple modules are configured in a chain with the same authLevel.

To disable module based authentication, navigate to Realms > Realm Name > Authentication > Settings > Security, and clear the Module Based Authentication check box.

The anonymous user is enabled by default. To harden security, deactivate the anonymous user, unless anonymous access is specifically required in your deployment. See How do I deactivate the default anonymous user in AM.

Ensure your users log in to AM using sensible authentication trees, such as trees that enforce multi-factor authentication.

By default, users that log in to the console make use of the chain or tree configured in the Organization Authentication Configuration property for the realm. To locate this property, navigate to Realms > Realm Name > Authentication > Settings > Core.

Be extra careful when setting your default authentication tree or chain.

If you leave the default authentication as the ldapService chain, users can still post their username and password to the authentication endpoint to retrieve a session, regardless of the services configured for authentication.

For example, consider a deployment where you disable module-based authentication but retain the default authentication chain, ldapService. If you set up two-factor authentication, your users can still access their accounts without performing the correct two-factor authentication chain login sequence by using the default chain.

When you are ready to go to production, set the default authentication tree or chain, to your most secure tree or chain. Don't leave it set to ldapService chain.

Ensure that you change the default for all realms, including the Top Level Realm.

If most of your privileged accounts reside in the Top Level Realm, consider blocking authentication endpoints that allow access to the Top Level Realm.

For more information, refer to Best practice for blocking the top level realm in a proxy for AM? in the ForgeRock Knowledge Base.