Click OK to dismiss the confirmation dialog. In the Search Results table, select the Location: In Country group condition

10-48 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

12. Click Apply. A confirmation dialog is displayed, saying that the policy details

were updated successfully.

13. Click OK to dismiss the dialog.

10.34.8 Use Case: Trigger Combination and Rule Evaluation

Jeff, a Security Administrator, must configure two levels of authentication to challenge the user using KBA for any single rule trigger and OTP for specific combinations of rules triggering. The tasks he must perform are the following: ■ Create a pattern to profile user login times into 4 hour time range buckets. ■ Create a second pattern to profile states users log in from. ■ Create the rules to use these patterns in the KBA challenge policy so these evaluations only run if the user has KBA active. ■ Create a rule to challenge using KBA if the user falls into a login time bucket he has fallen into less than 10 of the time in the last month. ■ Next, create a rule to challenge using KBA if the user logs in from a state he has used less than 20 of the time in the last two weeks. ■ Then, create a rule that checks to see if a user has an OTP delivery channel active. ■ Finally, configures a trigger combination to OTP challenge the user if all three of these rules returns true. The steps to accomplish these tasks are: 1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, select Patterns. The Patterns Search page is displayed.

3. Click the New Pattern button.

Create a pattern, Pattern 1, where: ■ Member Type: User ■ Creation Method: Multi-bucket 4. Click the Attribute tab. 5. Click the Add icon. 6. Select Time Time when the user is logged in as the attribute. 7. Click Next. 8. Select For Each as the Compare Operator and 4 as the compare value. 9. Press Add. 10. Click the Patterns tab. 11. Create a pattern, Pattern 2, where: ■ Member Type: User ■ Creation Method: Multi-bucket 12. Click the Attribute tab. 13. Click the Add icon. 14. Select State as the attribute. Managing Policies, Rules, and Conditions 10-49 15. Select compare operator as for each state.

16. Click Next.

17. Create Rule1: Add pattern condition, Entity is member of bucket less than some

percentage of times . Select Pattern 1 and percentage = 10 and select 1 month as time period.

18. Add condition to rule, User: Question status to check if he has registered

questions.

19. Add action, KBA Challenge to Rule 1. This rule triggers if the user has

registered questions and he has logged in from time bucket less than 10 of time. The Result, he is challenged with KBA.

20. Create Rule 2: Add pattern condition, Entity is member of bucket less than some

percentage of times . Select Pattern 2, percentage =20 and select 15 days as time period

21. Create Rule 3: Add pattern condition, User: Is OTP enabled. Using condition

Challenge Channel Status 22. Create a policy and add all three rules. 23. Add trigger combination to policy such that if all rules are triggering true then action is Challenge OTP. For more information on patterns, see Chapter 17, Managing Autolearning.

10.34.9 Use Case: Configuring User Flow

Jeff a Security Administrator has a brand new installation and must import the base security policies into the development environment of the Oracle Adaptive Access Manager Server. To support the base policies he also configures a black-listed country group. As well he links user groups to the proper roll-out phase policies to test phase two for a group of test users. To import a policy: 1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, double-click Policies. The Policies Search page is

displayed.

3. Click Import Policy in the Policies Search page. The Import Policy screen is

displayed.

4. Click Browse and search for oaam_sample_policies_for_uio_integration.zip.

5. Click OK to upload oaam_sample_policies_for_uio_integration.zip.

A confirmation dialog displays the status of the operation. The imported policies are listed in the Imported List section. An error is displayed if you try to import files in an invalid forma or an empty ZIP file.

6. Click OK to dismiss the confirmation dialog.

7. In the Policy Search page, verify that the policy appears in the Search Results

table.

8. In the Navigation tree, double-click Groups. The Groups Search page is

displayed.