Keyless can be integrated into any IAM solution to enable biometric authentication. Most implementations consist of three components:

• Keyless Middleware

• Keyless Authenticator App

• Keyless OIDC/SAML2 Connectors

In some cases, a direct integration can also be carried out using the middleware REST API.

The Keyless Middleware

The Keyless middleware binds Keyless identities to your IAM users, and is responsible for sending push notifications to the authenticator app.

Enrollment Flow

To authenticate with Keyless, a user must first enroll their biometric template. To do so, Keyless provides an enrollment service, which must be protected by the customer IAM for security purposes.

Authentication Flow

Once a user has enrolled successfully, Keyless can be used as an Identity Provider for the customer IAM and therefore as a means of authentication.

Identity Providers

To start an OIDC/SAML integration, select your identity provider from the list below

This guide provides a step-by-step process to configuring Keyless as both an OpenID Connect service provider, and a OpenID Connect identity provider for Okta.

The OpenID Connect allows users to authenticate with Okta into the Account Linking page.

The OpenID Connect allows enrolled users to authenticate with Keyless to get access to their Okta portal and Okta enabled apps.

1. Log into your Okta administration portal.
2. Go to "Applications" on the top menu and click "Applications"
3. Click "Add Application"
4. Click "Create New App"
5. Select 'Web' as the platform and "OpenID Connect" as the Sign on method then click the "Create" button.
6. Name the app "Keyless Account Linking". You can also optionally provide an App logo here, which will display as an icon in the user's portal.

7. Add the login and logout redirect URI that were provided to you by Keyless.
8. On the new application page, click on the "Edit" button and change the allowed grant types by selecting Implicit (Hybrid) -> Allow ID Token with implicit grant type and Allow Access Token with implicit grant type.

9. On the Assignments tab in that same page, click on the Assign button -> Assign to Group. Here you can choose which group of users will access the application. In this case we will choose “Everyone”, which will let every user of the org use the Keyless account linking application.

10. Back on the General tab, on the bottom of the page, take note of the Client Id and of the Client Secret that Okta provided to you, and send them to Keyless through a secure channel.

OIDC Integration

SAML Integration

• Mobile device for each employee

  Whether it’s company’s property or employee-owned, a mobile device per person with internet connection is needed for the optimal password-less MFA experience. Currently iOS 13.4 or higher, on iPhone 6 or newer, and Android 7.0 or higher are supported.

• Keyless app installed for each employee

  Employees will use the Keyless mobile app for authenticating. It’s available in the App Store and Google Play Store.

This integration provides a Keyless multi-factor authentication prompt to web-based logins through an AD FS Identity Provider and/or Web Application Proxy. After completing primary authentication to the AD FS server , your users will be required to complete a Keyless challenge before getting redirected back to the relying party.

1. In your Admin dashboard, go to "Security" on the top menu and click "Identity Providers":
2. Click "Add Identity Provider" and select "Add OpenID Connect IdP"
3. Configure the following settings:

   • General Settings

     Field

     Value

     Name

     "Keyless"

     Client ID

     an ID of your choice, which will need to be provided to Keyless

     Client Secret

     an ID of your choice, which will need to be provided to Keyless

     Scopes

     email, openid, profile

   • Endpoints, supplied to you by Keyless.

     Field

     Value

     Issuer

     issuer

     Authentication Endpoint

     authorization_endpoint

     Token Endpoint

     token_endpoint

     JWKS Endpoint

     jwks-uri

     User Info Endpoint

     userinfo_endpoint

   • Advanced Settings

     Field

     Value

     IdP Username

     idpuser.externalId

     Match Against

     Okta Username

     Account Link Policy

     Automatic

     Auto-Link Restrictions

     None

     If no match is found

     Create New User (JIT)

     Profile Source

     check

     Group Assignments

     None

   If you don’t want to assign through JIT (Just in Time) provisioning to a specific group, select the option “Redirect to sign-in page” under If no match found. This will block the use of the Keyless authentication as a profile master, letting Okta account system manage user’s subscription to the org.

4. Click Update Identity Provider. On the Identity providers page, expand its information view,and take note of the IdP ID and Redirect URI.

5. Provide Keyless with the following through a secure channel:

   • Client ID and Secret of Account Linking App.

   • Client ID and Secret of Identity Provider.

   • IdP number and redirect URI of the Identity Provider.

6. Under "Identity Providers" go to "Routing Rules" to configure which users and groups will have access to the Keyless Identity Provider and will use Keyless as their authentication method.

I am unable to add the Relying Party Trust to my AD FS

Please confirm that you are able to reach https://<customer>-registration.keyless.technology/metadata/ from your network, where <customer> is the domain given to you by Keyless.

I want to restrict access to Keyless only to a specific group in Active Directory

1. Select the customer>-registration.keyless.technology ‘Relying Party Trust’ in AD FS

2. Click on 'Edit Access Control Policy'

3. Select ‘Permit specific group'

Ensure that ‘Active Directory’ is the only option available to users in AD FS for Keyless Account Linking

Oopen PowerShell as administrator on your AD FS and enter this command:

Set-AdfsRelyingPartyTrust -TargetName <customer>-registration.keyless.technology -ClaimsProviderName @("Active Directory”)

On the AD FS ‘Home Realm Discovery’ screen, the browser on users’ devices may cache the list of login options. Clearing the cookies in the browser solves the problem.

As part of your onboarding with Keyless, you should have performed the steps below. If you're missing one or more of these prerequisites, please reach out directly to support@keyless.io.

• Provide the Keyless IT department with the domain name of your AD FS service.

• Update the AD FS configuration to trust the domain names of the Keyless SAML connectors (SP & IdP) that Keyless provided you with.

• Ensure that the firewall policy of your local network allow the following:

  • The AD FS service must be reachable by our SP and IdP.

  • For account linking, the user browser must be able to communicate with the SP and the AD FS instance.

  • For authentication, the user browser must be able to communicate with the IdP and the AD FS instance.

  • The EUD must be able to communicate with the Keyless Infrastructure.

Keyless is committed to providing you with the best experience possible. We want to be sure you have what you need, whether that be guidance on how to use our product, or where to go for help. By deploying Keyless, you will take a big step toward safeguarding yourself and your organization from data theft and account takeover, while improving the user experience across the organization.

User Experience is at the forefront of Keyless products, and we understand that the experience of using Keyless can be new and confusing in certain environments, especially if people have grown accustomed to insecure passwords such as qwerty, password, and 123456.

Rolling out passwordless MFA to your company can produce questions from your end-users. This document is designed to provide you with quick answers to issues experienced by users and a structure for diagnosing and supporting their passwordless journey.

Help desk and IT staff are an important component of any Keyless deployment. Education and awareness are key factors in ensuring their success and ultimately your success in deploying Keyless. Use these resources to train your team in supporting Keyless users throughout the deployment.

• Mobile device for each employee

  Whether it’s company’s property or employee-owned, a mobile device per person with internet connection is needed for the optimal password-less MFA experience. Currently iOS 13.4 or higher, on iPhone 6 or newer, and Android 7.0 or higher are supported.

• Keyless app installed for each employee

  Employees will use the Keyless mobile app for authenticating. It’s available in the App Store and Google Play Store.

Keyless and Auth0 have partnered to deliver true passwordless authentication for the workforce and for consumers.

This document provides a step-by-step introduction for configuring Auth0 to work with Keyless. In this guide Keyless will be set up as both an OpenID Connect service provider and a OpenID Connect identity provider for Auth0.

Configure Authentication Identity Provider

To use Auth0 to authenticate, configure Keyless as a trusted IdP on Auth0.

Before proceeding, make sure you have the following information from Keyless:

The steps are as follows

1. Create a new Enterprise Connection (IdP): Go to Authentication →Enterprise → OpenID Connect Click on (+) Icon

2. Provide a name for the Connection

3. Fill in OIDC Discovery URL in Issuer Field

4. Fill in ClientID provided by Keyless

5. Make a note of the callback URL that need to be sent to Keyless

6. Click Save

7. Once Saved go to Settings and General tab do the following

   1. Select Back Channel as Type

   2. Fill in client Secret field

8. Click Save Changes

9. Click on the ellipses (...) icon on the Connection just saved, Click Try Now. This will initiate a Keyless authentication

On successful authentication you’ll see the connection data

Configure Enrollment Service Provider

To enrol users you need to configure a client application on Auth0.

Before proceeding, make sure you have the following information from Keyless:

1. Create Application: Applications --> Create Application --> Regular Web Applications

2. On Settings tab of the Application you just created

   1. Make note of the following items that need to be sent back to Keyless

      • Domain

      • Client ID

      • Client Secret

   2. Fill in the following information provided by Keyless

      • Allowed Callback URL which is the Login URL (in the table above)

      • Allowed Logout URL which is the Logout URL provided

      • Allowed web origins which is the Redirect URI provided

Make sure to send the following information back to Keyless to complete the configuration:

• Domain

• Client ID

• Client Secret

Set up Authentication Identity Provider

To enable Keyless authentication, log in to your AWS Cognito dashboard and follow these steps:

1. Click on Federation > Identity Providers

2. Click on OpenID Connect

3. Insert ClientID, Client Secret and Issuer provided to you by Keyless, and configure the rest as shown in the following picture:
4. Click on Run discovery to make sure the IdP can be reached successfully

Set up Enrollment Service Provider

To let your users enroll on Keyless through AWS Cognito, follow these steps:

1. Click on General Settings > App Clients

2. Click on Add another app client

3. Choose an app name (typically keyless_registration) and make sure Generate client secret is checked. Leave the default values for the rest.

4. Send Client ID and Client Secret to Keyless

5. Your configuration should look like the following image:
6. Click on App integration > App client settings

7. Insert Callback URL(s) and Sign out URL(s) provided to you by Keyless

8. Configure the rest as shown in the following image:

Done

This guide details the steps required to configure Keyless to be used as the authentications method for your AD FS instance.

Make sure you have completed Integrating Keyless with Active Directory Federation Services before moving on to this guide.

This guide assumes that you have experience installing and configuring Windows Server 2016 or 2019, Active Directory, and Active Directory Federation Services (AD FS) 2016 or 2019.

For more information on installing AD FS, please see the AD FS 2016 Deployment Guide.

Step 1: Create Claims Provider Trust

1. Log in to your AD FS Management portal from your Server Manager by clicking "Tools" from the top navigation bar and selecting "AD FS Management

2. Once you are in the AD FS Management Portal, right click on “Relying Party Trust” and select “Add Relying Party Trust…” from the right-pane menu, as shown in the image below.
3. This will open a 4-step wizard. In the first step of the wizard, select the default value of “Claims Aware” and click “Start”.
4. In the following screen, import data about the claims provider published online. Enter your metadata URL which was provided during the provisioning of your account. For this example we are using https://<acme-idp>.keyless.technology/metadata/ where <acme-idp> represents the handle used to identify your instance.
5. Optionally, change the Display name for the claims provider, and add a note. This is a friendly name that will be displayed to administrators in the AD FS console and to end users. Click “Next” once done.
6. Review the parameters configured

Step 2: Configure Claim Rules

After completing Step 1 above, you should be able to see the new Claims Provider Trust you’ve just created under the “Claims Provider Trust” folder in your AD FS Management Portal.

1. Right-click on the Claims Provider Trust you’ve just added, and select “Edit Claim Rules” from the menu.
2. In this step you will define the rules that will transform the claims sent to the AD FS from Keyless.

3. Define three rules by clicking “Add Rule” in the bottom part of the dialog:

   • Rule 1: Pass through Name ID as Windows account name

     • Rule Template: Transform an incoming claim

     • Claim rule name: “Pass through Name ID as Windows account name"

     • Incoming claim type: Name ID

     • Incoming name ID format: Unspecified

     • Outgoing claim type: Windows account name

     • Select the "Pass through all claim values" bullet button.
   • Rule 2: Pass through Name ID as UPN

     • Rule Template: Transform an incoming claim

     • Claim rule name: “Pass through Name ID as UPN"

     • Incoming claim type: Name ID

     • Incoming name ID format: Unspecified

     • Outgoing claim type: UPN

     • Select the "Pass through all claim values" bullet button.
   • Rule 3: Set Group Keyless

     • Rule Template: Send Claims Using a Custom Rule

     • Claim rule name: “Set Group Keyless"

     • Custom rule: c:[] => issue(Type = "http://schemas.xmlsoap.org/claims/Group", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = "keyless", ValueType = c.ValueType);
4. Click "Apply" and "OK" to save your changes.

5. open PowerShell as administrator on your AD FS and enter this command (after replacing <keyless-registration-domain> with the domain provided to you by Keyless):

   Copy

   Set-AdfsRelyingPartyTrust -TargetName <keyless-registration-domain> -ClaimsProviderName @("Active Directory")

Congratulations, you can now use Keyless to authenticate to your AD FS connected applications!** 😎

Verifying that AD FS and Keyless IdP are configured

This verification requires that there is at least one user already enrolled with Keyless and that can be used for this test.

1. Go to https://<your-adsf-domain>/adfs/ls/idpinitiatedsignon.htm and select the "Sign in to this site" option.
2. Click on the identity provider associated with Keyless IdP:
3. Provide the username (UPN format) of the test user and click the 'Continue' button.

At this point, the user should receive a push notification to the Keyless Authenticator app on their mobile phone. Once authenticated on the phone, the user should be logged in.

Keyless is building a privacy-first biometric authentication platform that eliminates the need for businesses to centrally store and manage passwords, sensitive cryptographic keys, and other authentication data, without compromising on convenience or privacy for their users.

Keyless integrates with a wide variety of systems, and leverages standard protocols like SAML and OpenID Connect to add security-enhancing and privacy-preserving passwordless authentication to your existing systems.

Getting Started

To integrate biometric authentication into your systems, follow the steps below:

This guide details the steps required to configure Keyless for your AD FS instance.

This guide assumes that you have experience installing and configuring Windows Server 2016 or 2019, Active Directory, and Active Directory Federation Services (AD FS) 2016 or 2019. For more information on installing AD FS, please see the AD FS 2016 Deployment Guide

Step 1: Create Relying Party Trust

1. Log in to your AD FS Management portal from your Server Manager by clicking "Tools" from the top navigation bar and selecting "AD FS Management

2. Once you are in the AD FS Management Portal, right click on “Relying Party Trust” and select “Add Relying Party Trust…” from the right-pane menu, as shown in the image below.

   This will open a 5-step wizard. In the first step of the wizard, select the default value of “Claims Aware” and click “Start”.

3. In the following screen, import data about the relying party published online. Enter your metadata URL which was provided during the provisioning of your account. For this example we are using https://contoso-poc-registration.keyless.technology/metadata/ where <contoso-poc> represents the handle used to identify your instance.

4. After inserting the URL, click “Next”.
5. You may now optionally change the Display name for the relying party, and add an optional note. This is a friendly name that will be displayed to administrators in the AD FS console and to end users. Click “Next” once done.

   In the next step, you will be required to define the access control policy, this will configure which user and groups will be able to register and use Keyless. After selecting the proper users and groups, click “Next”.

6. Define the Keyless access policy for your organization.

7. Review the parameters configured and click "Next" when ready.
8. In the last step, leave the checkbox checked. When done, click “Close” and finish the process of adding the Relying Party Trust.

Step 2: Configure Claim Issuance Policy

After completing Step 1 above, you should be able to see the new relying party trust you’ve just created under the “Relying Party Trusts” folder in your AD FS Management Portal.

1. Right-click on the relying party trust you’ve just added, and select “Edit Claim Issuance Policy” from the menu.

   In this step you will define the rules that will transform the claims sent to the Keyless relying party.

2. Add Rule 1: Send UPN as Email Address, in the bottom part of the dialog:

   • Rule Type: “Send LDAP Attributes as Claims”

   • Rule Name: “Send UPN as email address”

   • LDAP Attribute: User-Principal-Name

   • Outgoing Attribute: E-mail Address

   • After clicking "Finish" you should see the following rule:
3. Add Rule 2: Send UPN as NameID, in the bottom part of the dialog:

   • Rule Type: “Send LDAP Attributes as Claims”

   • Rule Name: “Send UPN as NameID”

   • LDAP Attribute: User-Principal-Name

   • Outgoing Attribute: Name ID

   • Define the mapping between the UPN and the Name ID
4. After adding these two rules, you should see the following list of rules in the “Issuance Transform Rules” dialog.
5. Click "Apply" and "OK" to save your changes.

Congratulations, you have successfully integrated Keyless with your AD FS instance! 😎

Optionally, configure Keyless as an MFA method for your AD FS connected applications.

Keyless and Forgerock have partnered to deliver true passwordless authentication for the workforce and for consumers.

This document provides a step-by-step introduction for configuring Forgerock to work with Keyless. In this guide Keyless will be set up as both an OpenID Connect service provider and a OpenID Connect identity provider (Social Identity Provider) for Forgerock Identity Cloud.

Authentication: Configure Social Identity Provider

All configuration will be performed on Forgerock Identity Cloud Platform Admin Console.

1. Log on to Forgerock Identity Cloud Platform Admin console for your tenant:

2. From Platform Admin Console Dashboard select the realm we will be doing this configuration for, and navigate to Native Consoles -> Access Management

3. From Dashboard click on Services tile and click on Social Identity Provider Service Link
4. Click on Secondary Configurations tab and click on Add a Secondary Configuration dropdown select OIDC Provider
5. Select a name for out IdP client configuration: the table below provides a list on configuration items that need to be filled in

1. ensure that we click the Save button to save our IdP configuration and click enabled toggle button on top to have our IdP configuration active/enabled

2. Following is a sample normalization script (groovy) for our Keyless Social IdP

   Copy

   // Normalization script for Keyless Social IdP
   import static org.forgerock.json.JsonValue.field
   import static org.forgerock.json.JsonValue.json
   import static org.forgerock.json.JsonValue.object
   
   return json(object(
   field("mail", rawProfile.preferred_username),
   field("alias",selectedIdp + '-' +
       rawProfile.preferred_username.asString() ),
   ))

3. Next we'll need to configure an authentication Tree to enable our Social authentication: from realm dashboard select Authentication --> Trees --> Create Tree and provide a name: e.g. KeylessAuth
4. At this point you can access Forgerock Identity Cloud end user dashboard: you'll be prompted to authenticate with Keyless (as Keyless is the only authentication mechanism configured in this specific Auth tree as shown above)

   Copy

   https://<my-forgerock-tenant>/am/XUI/?realm=/<my-realm-name>\&authIndexType=service\&authIndexValue=<my-Auth-Tree-Name>#/
5. Here's an alternative sample auth tree that provides options for both password based & Keyless (passwordless) authentication

Keyless Enrollment: OIDC SP/RP Configuration

For enrollment with Keyless we'll need to create a new Application on Forgerock Identity Cloud for Keyless OIDC Service provider.

1. From our realm dashboard select Applications --> OAuth 2.0 --> Clients --> Add Client
2. Fill in the information required as described below:

   • Client ID: Provide a client ID: e.g. KeylessEnrollmentClient,

   • Client Secret: generate a client secret

     • If ClientID & Secret is provided by Keyless (that is enrollment service has already been created for you by Keyless) we'll be using those to populate the parameters above.

     • If we are creating our own ClientID & Client Secret then, both ClientID & Secret need to be sent back to Keyless for configuration on the Keyless Enrollment service.

   • Redirection URIs: A list of redirection URIs for your Keyless tenant has been provided by Keyless

   • Scope & Default Scope enter the following: openid profile cn mail

3. Click Create button and continue
4. Click on Advanced tab and configure the following:

   • Grant Types select : Authorization_Code & Implicit

   • Token Endpoint AUthentication Method select: client_s__s_ecret_post_

   • Custom Properties type in the following: preferred_username=mail
5. Click on OIDC tab and configure the following

   • Client Session URI: this is provided by Keyless

   • Post Logout Redirect URI: this is provided by Keyless

   • Backchannel Logout URI: this is provided by Keyless

   • Post Logout Redirect URI: this is configured based on our realm name e.g. https://<\<forgerock-tenant>>/enduser/?realm=<\<realm-name>>#/dashboard

6. Click Save and that completes OIDC client configuration.

If we are creating our own ClientID & Client Secret then, both ClientID & Secret need to be sent back to Keyless for configuration on the Keyless Enrollment service

Keyless Enrollment

After completing the configuration steps above to configure Keyless OIDC SP/RP for enrollment we can now enrol for Keyless authentication

1. From a browser navigate to Keyless enrollment URL provided by Keyless

2. Authenticate using your credentials for Forgerock Identity Cloud

3. Browser will get redirected to Keyless enrollment page

4. Download Keyless authenticator app on your mobile device from AppStore or Google play

5. Scan the QR code displayed on Keyless enrolement page with your mobile device to complete Keyless enrollment

Keyless Authentication

From a browser navigate to an application secured via Forgerock Identity Cloud SSO solution. For example Forgerock Identity Cloud end user dashboard: https://>/am/XUI/?realm=/<>\&authIndexType=service\&authIndexValue=<>#/

1. Click on Continue with Keyless button

2. Provide your email enrolled with Keyless already
3. You'll receive a notification on you mobile device to complete biometic authentication using Keyless

Keyless passwordless biometric authentication can address any MFA requirement to authenticate to Salesforce Portal.

This guide provides a step-by-step introduction to configure Salesforce Portal to authenticate using Keyless passwordless biometric authentication. In this guide Keyless will be set up as an authentication provider to Salesforce at a high assurance level to address any MFA requirements. Also we'll configure Keyless enrollment features to provide the ability for Salesforce users to register and or enrol for Keyless authentication.

Authentication: Configure Keyless as an Authentication Provider

To enable authentication into Salesforce via Keyless, you need to add Keyless as an authentication provider in Salesforce.

As part of the onboarding process you’ll receive the following pieces of information from Keyless to complete an authentication provider configuration in Salesforce:

All configuration steps outlined below need to be performed on Salesforce portal with administrative privileges.

1. Create an OIDC Auth Provider

   • Identity → Auth Providers → New

   • Select Open Id Connect as provider type
2. Populate the configuration parameters from the information provided by Keyless team to complete Auth provider configuration as shown below
3. Make a note of the URLs under Salesforce Configuration section

   • Callback URL: Need to be provided to Keyless team to complete authentication provider configuration on Keyless end

   • Existing User Linking URL: Use this URL to link existing Salesforce users to their respective Keyless account

• Following is a sample Registration handler code

  Copy

  // Example Registration Handler
  global class KLRegHandler101 implements Auth.RegistrationHandler{
  
  
  global User createUser(Id portalId, Auth.UserData data){
  
      //The user is authorized, so create their Salesforce user
      User u = new User();
      Profile p = [SELECT Id FROM profile WHERE name='Standard User'];
      //TODO: Customize the username. Also check that the username doesn't already exist and
      //possibly ensure there are enough org licenses to create a user. Must be 80 characters
      //or less.
      for(string key : data.attributeMap.keySet())
          {
              system.debug('Create Incoming Attr Map key: [' + key + '] value: [' + data.attributeMap.get(key)+ ']');
          }
      u.username = data.username;
      u.email = data.email;
      u.lastName = data.lastName;
      u.firstName = data.firstName;
      String alias = data.username;
  
      if(alias.length() > 8) {
          alias = alias.substring(0, 8);
      }
      u.alias = alias;
      u.languagelocalekey = UserInfo.getLocale();
      u.localesidkey = UserInfo.getLocale();
      u.emailEncodingKey = 'UTF-8';
      // u.timeZoneSidKey =  UserInfo.getTimeZone();
      u.profileId = p.Id;
      return u;
  }
  
  global void updateUser(Id userId, Id portalId, Auth.UserData data){
      User u = new User(id=userId);
      //TODO: Customize the username. Must be 80 characters or less.
      //u.username = data.username + '@myorg.com';
      for(string key : data.attributeMap.keySet())
          {
              system.debug('Updt Incoming Attr Map key: [' + key + '] value: [' + data.attributeMap.get(key)+ ']');
          }
  
      system.debug('Updt Pre Username: ' + u.username );
      system.debug('Updt Pre Email: ' + u.email);
      system.debug('Updt Pre SN: ' + u.lastName);
      system.debug('Updt Pre Email: ' + u.alias);
      system.debug('Updt Pre Profile: ' + u.profileId);
      system.debug('Updt Pre First Name: ' + u.firstName);
      system.debug('Updt Pre Email Enc: ' + u.emailEncodingKey );
  
      update(u);
  }
  }

1. Update Domain Configuration to Enable Keyless Authentication Option on Logon Page

   • Company Settings → My Domain

   • Edit Authentication Configuration

   • Enable Keyless
2. Configure Keyless as High Assurance authentication mechanism
3. Send the Callback URL to the Keyless team to complete authentication.

Keyless authentication is now enabled.

enrollment: Salesforce Configuration

To enable enrollment of Salesforce users with Keyless we’ll need to configure Salesforce as an OIDC Identity Provider and Keyless as OIDC Relying Party/ Service Provider.

Make sure you have the following information from Keyless before proceeding with the configuration:

We’ll configure SFDC as a OIDC IdP and Keyless as OIDC RP

1. On Salesforce go to Settings → Identity → Identity Provider and enable Identity Provider and save. Make a note of the Issuer URL, you'll need to send it to Keyless to configure the Keyless enrollment server.

   • Click on Service Provider link at the bottom to create a Connected App/ Service Provider

   • Check Enable OAuth Settings to configure OAuth/OIDC parameters

   • Enter the callback URLs of Keyless Enrollment Server (these are Login/Redirect URL, Post Logout Redirect URL & Keyless Enrollment URL as described in the table at the beginning of this section)
2. Click Save. Make a note of the Client ID & Client Secret for Keyless OIDC RP, you'll need to send it to Keyless to configure the Keyless enrollment server.

3. Click New to add a Custom Attribute

This completes configuration on Salesforce end the following table is a summary of the 3-pieces of information that Keyless team will need to complete configuration of Keyless Enrollment service:

Post Configuration Walkthrough

Once we have completed the steps above, we are now in a position to step though the entire process of enrolling a user to Keyless and then continue with Keyless authentication going forward.

Keyless Enrollment

1. Create a new Salesforce user from SFDC dashboard (e.g. demouser@myorg-demo.com)

2. Enrol the newly created user to Keyless (if this account is not enrolled already)

3. From a web browser go to Keyless Enrol Site: https://<your-keylelss-registration-URL> (provided by Keyless team)

4. Authenticate to SFDC Portal with Userid/Password (following redirect from Keyless Enrollment page)

5. Click on Enrol link & Scan the QR Code using Keyless Authenticator App on you mobile device

6. Complete the registration process on your mobile device as guided by Keyless Authenticator App

7. Registered account will appear on Keyless Authenticator App on the mobile device

8. Log out from Salesforce browser session and this completes Keyless enrollment

Salesforce Account Linking to Keyless

1. Link Salesforce User to their registered Keyless account

2. Log on to SFDC with account linking URL

3. Account Linking URL can be found on Salesforce Setup -> Auth Provider -> Salesforce Configuration section, which will look like the following: https://<your-salesforce-tenant>.my.salesforce.com/services/auth/link/keyless

4. Authenticate with Keyless via Keyless Authenticator App on your mobile device

5. After a successful authentication with Keyless Salesforce portal will prompt you to Sign In with userID and password to link an SFDC user to the authenticated Keyless account. That completes the account linking between SFDC and Keyless account

Keyless biometric authentication to Salesforce

1. From a browser access your Salesforce portal: https://<your-salesforce-tenant>.my.salesforce.com

2. Log on to SFDC via Keyless: Click on SignIn with Keyless button as opposed to providing uid/password

3. Authenticate via Keyless Mobile Authenticator. That completes keyless authentication to SFDC

Authentication: Configure External IdP

Log in to PingOne Admin console for your environment.

1. Create an External Identity Provider
2. Select the Custom option to create an OpenID Connect IdP
3. Fill in IdP profile details
4. Provide OIDC Connection details

   • Client ID: Provided by Keyless Account team

   • Client Secret:

   • OIDC Discover Document URI: Provided by

5. Click on Use Discovery Document link to populate OIDC endpoints

6. Fill in OIDC scopes: openid profile email

7. Make a note of the callback URL generated by PingOne: This will be required by Keyless Account team
8. Provide OIDC attribute mapping between PingOne & Keyless IdP. Note that Keyless IDP will return username in preferred_username attribute on the incoming claim
9. Enable External IdP just created
10. Summary of Configuration on Keyless IdP
11. Update Authentication Policy to include Keyless External IdP

12. Under Experiences-> Authentication Policies -> Single Factor Add Keyless External IDP as a IdP to be presented on Login
13. Send the call back URL to the Keyless team.

This completes configuration of Keyless as External Identity Provider

Keyless Enrollment: SP/RP Configuration

For enrollment with keyless we'll need to create a new Application on PingOne for Keyless OIDC Service provider.

1. Create an OIDC application of type Web App

   .png)

2. Select OIDC and click on Configure link/button to continue to OIDC configuration
3. Provide a name, optionally a description and an icon that can be uploaded
4. Enter OIDC redirect URL provided by Keyless
5. Configure OIDC scopes: openid, profile & email
6. Configure Attribute mapping: preferred_username is the outbound attribute that would be populated with users email address as below:
7. On completion OIDC application configuration would look like the following, relevant items highlighted below can be edited and saved here

This completes the OIDC Service Provider/ Keyless Enrollment end of configuration.

Keyless Enrollment

From a web browser navigate to the enrollment URL provided by Keyless account team. Browser will follow redirect an take you to PingOne Logon page where you'll need to authenticate with PingOne credentials:

On successful authentication browser gets redirected to Keyless enrollment site where you can enroll your mobile device by scanning the QR code displayed on screen

Keyless Authentication

From a web browser navigate to an application secured using PingOne SSO solution such as: https://apps.pingone.com/<your-tenant-id>/myapps/

1. Authenticate with Keyless option on the logon screen will initiate passwordless authentication with Keyless
2. Your enrolled mobile device will receive a notification to perform a biometric authentication
3. On initial logon with Keyless PingOne performs account linking and you may have to enter your password

This document provides a step-by-step introduction for configuring OneLogin to work with Keyless. In this guide Keyless will be set up as both an OpenID Connect service provider and a OpenID Connect identity provider for OneLogin

Configure Authentication Identity Provider

In order to enable your users to authenticate into OneLogin dashboard via Keyless you’ll need to configure Keyless as a trusted IdP on OneLogin.

As part of the onboarding process you’ll receive the following pieces of information from keyless to complete a Trusted IdP configuration.

The steps are as follows

1. Create a new Trusted IDP: Go to Authentication → Trusted IdPs → New Trust

2. Provide a name for the Trusted IdP configuration e.g. Keyless

3. Check Enable Trusted IDP

4. Check Show In Logon Panel, this will require you to choose an icon (default Keyless icon provided in onboarding package)

5. Fill in issuer URI

6. Check the following options:

   • Sign users into OneLogin

   • Sign users into additional applications

   • Send Subject Name ID or Login Hint in Auth Request

7. On User attribute section:

   • Fill in {tidp.preferred_username}

   • Select Email in User Attribute Mapping

8. Select OIDC as authentication protocol type and fill in the following fields in OIDC Configuration section (OIDC endpoint URIs, Client ID & Secret valued are provided in Keyless onboarding package)

   • Authentication Endpoint

   • Select POST as Token Endpoint Authentication Method

   • Token Endpoint

   • User Information Endpoint

   • In Scopes field type in: openid email profile

   • On Client Id & Client Secret fields fill in the values provided by Keyless

9. Click Save and that would complete our configuration

Configure Enrollment Service Provider

To enable enrollment of your users to Keyless we’ll need to configure a client application on OneLogin. Parameters required to create the application on OneLogin are provided in your Keyless onboarding package.

The following information is provided in your onboarding package to configure OneLogin Application:

1. Go to Applications → Add App

   • Search OIDC on Find Applications and select OpenId Connect (OIDC)

   • On Configuration screen provide a display name and uncheck Visible in portal and click Save

   • Under Configuration tab provide the following parameters provided by Keyless:

     • Login Url

     • Redirect URIs (a single URI)

     • Post Logout URIs (a single URI)

2. Under SSO tab make note of the following 3-pieces of information that need to be sent back to Keyless for configuration on the Keyless end

   • Client ID

   • Client Secret

   • Issuer URL

3. Make sure that Application Type is Web

4. Token Endpoint section Authentication Method is POST

5. Additionally on Users tab select the relevant Users/Groups to enable these users/groups to be enabled to get enrolled on to Keyless

6. Click Save to complete the configuration. Your users now can use the Keyless enrollment URL provided to enrol their devices with Keyless
7. Remember to send the following information back to Keyless to complete the configuration:

   • Client ID

   • Client Secret

   • Issuer URL

Introduction Email

To be sent 1-2 weeks before rollout.

Subject:

Keyless Passwordless Authentication is coming!

Content:

Dear [name] The IT team is notifying you that your login experience will soon improve. Keyless is being deployed to make your login experience faster, safer, and easier.

Why are things changing? The modern day employee wastes on average 24 hours per year logging into systems and apps. With Keyless, you no longer have to worry about passwords, writing them down, resetting them, or the time it takes to type them in. Keyless protects you against phishing, credential reuse, and account takeover by taking passwords out of the equation.

Starting [month, day] you will use your mobile device with the Keyless mobile app installed to login to your SSO. Say goodbye to your security hardware token or typing of usernames, passwords or codes at every login.

is the leading provider of best in class privacy-preserving passwordless authentication. Keyless lets you log into your desktop, mobile and web applications with your mobile device. Your personal data can never be accessed by anyone, except yourself. More information is coming soon!

Release Week Email

To be sent on the week of the rollout.

Subject:

Keyless Authentication is here!

Content:

In a couple of days we will be rolling out Keyless the new authentication solution which will remove your need to use passwords. Keyless will make your login experience faster, safer and easier.

Starting [month, day] you will use your mobile device with the Keyless mobile app installed to approve every login to your SSO.

Enroll by downloading the Keyless Authenticator from the or the and by following the in-app steps and the .

Any questions, please reach out to the support team at {insert email alias}.

Registration Email

This message should be sent on the enrollment date.

Subject:

Keyless is Live!

Content:

Today you will enroll in Keyless, the new passwordless authentication solution! Keyless will make your login experience faster, safer and easier. Follow the below steps to begin:

Step 1: If you haven't done so yet, please download the Keyless application. Search for “Keyless” on the iOS App Store or in your Google Play Store to install the app.

Keyless Authentication Node

This integration relies on the ForgeRock OIDC Node which is available in AM6.0 or greater.

Prerequisites

Make sure you have the following information, provided to you during your onboarding with Keyless.

• OpenID Connect Client ID

• OpenID Connect Secret

• OpenID Discovery URL

Configuration

1. Create or modify a tree to use the OpenID Connect Node

2. Enter the following values for each configuration option in the OpenID Connect Node

Testing

1. Open a private window in your browser.

2. Navigate to the login page of the realm that Keyless is configured for.

3. Enter your username and authenticate with Keyless on your mobile device (make sure to use a user that is enrolled to Keyless)

4. You should now be logged into the ForgeRock portal.

Account Linking

The process of adding an account to the Keyless Authenticator application. In a quick, 30 second process, the end user can add an account by scanning a QR code and authentication using the Keyless Authenticator application.

Authentication

The process of using the Keyless Authenticator application to gain access to certain applications, service or workstation.

De-enrolling

The act of removing a Keyless account associated to a specific users.

Relying Party

The web or workstation service which an administration uses to generate policies and access for users of a specific service.

Platform

A user’s authentication device type (iPhone, Android, etc).

Push Notification

This is an out-of-band authentication request that is sent to the Keyless Authenticator App on an enrolled device

Keyless Helpdesk Portal

The Keyless team is available to assist with any request through our help service portal available online. There, you will be able to view existing requests submitted for your organization and can request new tickets.

For direct support from Keyless, visit the Keyless Support Center.

Creating Effective Support Tickets

Level 3 Support has the ability to contact Keyless Support directly to raise issues that have no clear resolution. Keyless support will work with your teams to reach rapid resolution.

Use the description text that best matches the scenario. An example of a request containing information which will reduce the time to resolution may include:

• Phone Model: IPhone 8

• Phone OS: iOS 13.2.2

• Time of Issue: I experience the issue as early as 4:30 am EST to trying after hours as late 9:30 p.m. EST

• Place of Issue: Office

• Relevant Log Files/Screenshots: as attachments

• Issue: User Is unable to unlock their workstation using Keyless

• Steps taken when issue is experienced:

  • Step 1 ....

  • Step 2...

  • Step 3...

Retrieving Logs from Mobile Apps

The Keyless Authenticator application contains an easy to use menu to enable the user to provide help desk teams with information about the user's associated software and devices.

Encouraging users to upgrade to the latest version of the Keyless Authenticator application and the latest available operating system may improve application performance and reduce the risk of bugs while improving the security of the user experience.

To guide a user in how to submit mobile information to your organization, ask the user to select the Settings menu, or gear in the top right corner of the main screen of their mobile app. From here, have the user select “Contact Support” and the user’s email service will appear with the contents of the message.

Troubleshooting

Enabling backups

Enabling backups is highly recommended.

To enable the backup functionality, please make sure that the user has the most up to date Keyless App from the App Store or Google Play and follow the steps below:

A user cannot see the QR code

Users must make sure they are using one of the supported web browsers. If the problem persists, users may need to clear their cache and cookies.

Keyless Authenticator cannot identify the user's face

The user needs to make sure that the face

• is fully visible in the preview on the screen.

• is not covered by hair, a scarf, a hat, or a mask.

• is adequately illuminated.

Make sure that there are no direct light sources on the device's internal camera as these light sources may compromise the enrollment process.

Keyless Authenticator does not receive notifications

The user must ensure that they has entered their email correctly, and that the phone has internet connection.

1. The user must disable "Do not disturb" and "Do not disturb while driving" on the smartphone.

2. The user must verify that they have enabled notifications for Keyless Authenticator:

3. On Android devices

   1. Long press on the Keyless Authenticator icon

   2. Open the "App info" item in the menu

   3. Open the "Notifications" item

   4. Make sure that "Show notifications" is enabled

4. On iOS devices:

   1. Open the Settings application

   2. Open Notifications -> Keyless

   3. Make sure "Allow Notifications" is enabled

Understanding timeout events

Timeouts are a common foundation for security and a consistent source of hidden risk to an end user’s experience.

• On Authentication: Most timeouts can be resolved by having the user repeat the action, such as authentication, and quickly proceeding to their next action – such as authenticating.

• On Pairing: Timeouts equally serve to limit the exposure of a user’s active enrollment.

Users may experience timeouts during registration for several reasons:

1. A user has reached an active QR scan screen – and is downloading the mobile application and this has led to a timeout of the QR screen. Simply have the user have their app open with their scan QR camera ready and select try again on the workstation.

2. A user has reached the QR screen, and the QR screen has vanished – or timed out – while the user is in the middle of enrolling or registering an authenticator. The user is unfortunately taking too long to complete the pairing. Try and have the user do this again during a troubleshooting session and identify which part of the process is taking the user the most amount of time.

What will the authentication experience be like for end-users?

Once a user is enrolled, authentication with Keyless is fast and secure. The user logs in to the relying party service using only their username. The user will then get a push notification to the Keyless Authenticator app asking them to authenticate by showing their face. Upon successful authentication, the user will be granted access to the relying part service.

What will the enrollment experience be like for end-users?

Users will begin with the link provided in their enrollment email. Users will be asked to login with their corporate account credentials:

Once successfully signed in with their existing username and password, users can scan a QR code with their mobile authentication device using the Keyless Authenticator app:

The user will then be prompted to authenticate by showing htheir face in the Keyless Authenticator application. If successfully authenticated, the following screen will appear. The user is now enrolled and their account is activated.

What if a user tries to re-enroll?

If an existing user tries to re-enroll, Keyless will notify them that they cannot re-enroll, before providing an option to unlink the previous account.