Self-provisioning rules for groups

No users can self-provision an authenticator until you configure which groups can self-provision and which authenticator types are available. Users who are not allowed to self-provision continue to use the email workflow.

This feature allows you to accommodate the differing security requirements of multiple groups as well as test the use of an authenticator-type within a small group before wide-scale deployment. For example, you can enable factory floor workers to self-provision GrIDsure tokens, and office workers to self-provision either FIDO or MobilePASS+ tokens.

You match specific groups with specific authentication types using rules. As rules are added they are placed at the top of the list. The highest ranking rule, top-most in the list, that matches a group is the only one applied to the group. You can move rules up and down the list to ensure that the highest-ranking rule is applied to a group that is included in multiple rules.

The availability of authenticators for self-provisioning is based upon the rules. Activation switches for authenticators are no longer supported.

Example configurations

The following examples show various ways that self-provisioning can be applied. See Configure self-provisioning for details.

Allow all users to self-provision

1. The default rule (bottom-most) applies to All users.

2. Select the authenticator types that the users are allowed to self-provision.

   If other rules exist in this list, they are higher-ranking and will be applied before the default rule. Review their settings to ensure that they do not restrict users from self-provisioning. Alternately, delete all other rules in this list to ensure that only the default rule is applied.

Allow specific groups to self-provision

1. Select Members of these groups only.

2. Enter the relevant group names.

3. Select the authenticator types that the users are allowed to self-provision.

4. Place this rule top-most in the list of rules.

Restrict specific groups from self-provisioning

1. Create a rule that allows all groups to self-provision.

   1. Select All users.

   2. Select the authenticator types that the users are allowed to self-provision.

2. Add a rule that disallows specific groups to self-provision.

   1. Select Members of these groups only.

   2. Enter the group names that are not allowed to self-provision.

   3. Do not select any authenticator types for use by these groups.

   4. Place this rule top-most in the list of rules.

Restrict all users from self-provisioning

This is the default rule and cannot be moved higher in rank in cases where there are additional rules.

1. Select All users.

2. Select Cannot self-provision.

If there are additional rules, they will be higher in rank than this default rule. Therefore, groups that are listed in the higher-ranking rules will not be affected by this rule. Whereas groups that are not listed in higher-ranking rules will be restricted from self-provisioning.

If your intent is to ensure that all users are restricted from self-provisioning, delete any conflicting rules.

Configure self-provisioning

To configure self-provisioning:

1. On the STA Access Management console, select Settings > Self-Provisioning > Edit.

   

   The default self-provisioning rule for new accounts is Cannot self-provision.

2. Create self-provisioning rules with Members of these groups only for exception groups.

   For example, you could allow administrators to self-provision both FIDO and MobilePASS+ authenticators, and front-line workers to self-provision GrIDsure tokens only.

   1. Select Add Self-Provisioning Rule.

   2. Enter the name of one or more groups in the field provided (for example, Administrators).

   3. Select the authenticator types that the group are allowed to use for self-provisioning. For details about the authenticator types, see:

      • FIDO

      • GrIDsure

      • SafeNet MobilePASS+
        
        

        1. Repeat these steps to add rules for other groups (for example, Front-line Workers).

      As you add rules, they are placed at the top of the list. If the same group is assigned to multiple rules then the top-most rule for that group is applied and all subsequent rules are ignored.

      

   4. To delete or change the rank of a rule, use the self-provisioning rule menu .

      

3. Select Save to apply your changes.

   The self-provisioning rules display.

   

4. For additional options, select More Provisioning Options.

   

   The STA Token Management console Policy > Token Policies module displays.