In the Navigation tree, double-click Policies. The Policies Search page is

Managing Policies, Rules, and Conditions 10-47 To configure this behavior you must nest your new security policy, which contains rules that can result in a KBA challenge, under the policy, which contains KBA business rules to check for registration status. Directions: Nest the KBA Challenge policy under the System - Questions check policy using policy trigger combinations. The KBA Challenge policy was created in Section 10.34.3, Use Case: Create a Policy. To create a trigger combination: 1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, double-click Policies. The Policies Search page is

displayed.

3. Search for the System - Questions check policy.

4. In the Search Results table, click System - Questions check. The Policy Details

page for the System - Questions check policy is displayed. 5. In the Policy Details page, click the Trigger Combinations tab. 6. In the Trigger Combinations tab, click Add. The column added to the table corresponds to a trigger combination. By default, trigger combinations are created with all the rules in the policy. The rules used in the policy are represented by a row name. For example, the rules to check for registration status would appear as rows: ■ Registered User with condition User: Account Status ■ Question Registered ■ Unregistered User

7. In the trigger combination, enter a description in the Description field.

8. For each rule specify the rule result based on which trigger combination must be executed performed ■ True : The rule is triggered ■ False : the rule is not triggered ■ Any : Ignore the rule whether or not it triggers By default, a trigger combination is executed for a rule result of Any. 9. For a trigger combination, specify that if the trigger combination triggers, the result returns a nested policy. Select Policy, and in the field directly below, specify KBA Challenge as the policy you want to run to further evaluate the risk. A nested policy is a secondary policy used to further quantify the risk score in instances where the original result output by the system is inconclusive. Nested policies can be assigned to ensure a higher degree of accuracy for the risk score.

10. Select the Action Group.

The action is an event generated when the combination is triggered.

11. Select the Alert Group.

The alert is a message generated when the combination is triggered. 10-48 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

12. Click Apply. A confirmation dialog is displayed, saying that the policy details

were updated successfully.

13. Click OK to dismiss the dialog.

10.34.8 Use Case: Trigger Combination and Rule Evaluation

Jeff, a Security Administrator, must configure two levels of authentication to challenge the user using KBA for any single rule trigger and OTP for specific combinations of rules triggering. The tasks he must perform are the following: ■ Create a pattern to profile user login times into 4 hour time range buckets. ■ Create a second pattern to profile states users log in from. ■ Create the rules to use these patterns in the KBA challenge policy so these evaluations only run if the user has KBA active. ■ Create a rule to challenge using KBA if the user falls into a login time bucket he has fallen into less than 10 of the time in the last month. ■ Next, create a rule to challenge using KBA if the user logs in from a state he has used less than 20 of the time in the last two weeks. ■ Then, create a rule that checks to see if a user has an OTP delivery channel active. ■ Finally, configures a trigger combination to OTP challenge the user if all three of these rules returns true. The steps to accomplish these tasks are: 1. Log in to OAAM Admin as an administrator.

2. In the Navigation tree, select Patterns. The Patterns Search page is displayed.

3. Click the New Pattern button.

Create a pattern, Pattern 1, where: ■ Member Type: User ■ Creation Method: Multi-bucket 4. Click the Attribute tab. 5. Click the Add icon. 6. Select Time Time when the user is logged in as the attribute. 7. Click Next. 8. Select For Each as the Compare Operator and 4 as the compare value. 9. Press Add. 10. Click the Patterns tab. 11. Create a pattern, Pattern 2, where: ■ Member Type: User ■ Creation Method: Multi-bucket 12. Click the Attribute tab. 13. Click the Add icon. 14. Select State as the attribute.