Configuring Knowledge-Based Security Questions
Knowledge-based authentication (KBA) is an authentication mechanism in which the user must correctly answer a number of pre-configured security questions that are set during the initial registration setup. If successful, the user is granted the privilege to carry out an action, such as registering an account, resetting a password, or retrieving a username. The security questions are presented in a random order to the user during the User Self-Registration, forgotten password reset, and forgotten username processes.
AM provides a default set of security questions and easily allows AM administrators and users to add their own custom questions.
Security questions must be set in order for users to reset their password.
If the user enters an invalid username, email, or first name/surname pair as part of a recovery flow, AM presents them with a random KBA question before failing the flow. This is to protect the service against account enumeration attacks. If both the security questions and the confirmation emails are enabled for a given flow, AM presents the user with a message similar to An email has been sent to the address you entered. Click the link in that email to proceed, but does not actually send an email.
Log in to the AM console as the administrator.
Navigate to Realms > Realm Name > Services and select the User Self-Service service.
Select the General Configuration tab.
In the Security Questions field, several questions are available by default. Enter your own questions as required. The syntax is
OrderNum|ISO-3166-2 Country Code|Security Question. For example,5|en|What is your dog's name?. Make sure that order numbers are unique.Warning
You should never remove any security questions as a user may have reference to a given question.
In the Minimum Answers to Define field, enter the number of security questions that will be presented to the user during the registration process.
In the Minimum Answers to Verify field, enter the number of security questions that must be answered during the Forgotten Password and Forgotten Username services.
Save your changes.
Ensure that the
kbainfoattribute is set in the profile attribute whitelist.The profile attribute whitelist controls the information returned to non-administrative users when accessing
json/userendpoints. For example, the whitelist controls the attributes shown in the user profile page.Common profile attributes are whitelisted by default, but you need to add any custom attribute you want your non-administrative users to see.
The whitelist can be set by realm, in the user self-service service, or globally. To modify it:
Globally: Navigate to Configure > Global Services > User Self-Service > Profile Management, and edit the Self readable attributes field.
By realm: Navigate to Realms > Realm Name > Services > User Self-Service > Profile Management, and edit the Self readable attributes field.
Note that you need to add the user self-service service to the realm if you have not done so already, but you do not need to configure anything other than the whitelist.