Preventing Choose Another Policy

Preventing Users from Choosing Another Authentication Policy

RapidIdentity Authentication Policies can be set with a unique feature referred to as Authentication Policy Choices and, when enabled, allows users that are associated with multiple authentication policies to "Try another method" when presented with an authentication challenge they're unable to meet.

Authentication Policy Choices are enabled for all authentication policies and their associated users and gives users the flexibility to choose an authentication method or methods based on their specific needs and environment. However, there are some use cases where an administrator may want to give some but not all users this ability.

There are several ways an administrator can restrict certain users from choosing a different authentication policy in RapidIdentity, and the following provides instructions for configuring the one recomended by Identity Automation.

1. Copy the Authentication Policy you want to restrict users to meaning, when the that policy applies to a specific user, they will not have the ability to "Try another method":

   1. Navigate to Configuration > Policies > Authentication Policy.

   2. Highlight the appropriate policy and select the duplicate icon from the menu choices at the bottom of the list of current authentication policies.
      

      You are now editing the configuration of the duplicate policy.

   3. On the General Tab:

      1. Give your policy a meaningful name such as Authentication Policy to Restrict Compromised Credentials.
      2. Do not make your policy a Forgot Password policy, leave the check box unchecked.
      3. Give your policy a meaningful description.
      4. Check the Always Fail checkbox.
      5. Leave Insecure QR ID Scans Enabled unchecked.
      6. Select the Enabled checkbox to Enable the policy.

   4. Save the Policy.

   5. Use the Ordering Icons from the menu choices at the bottom of the list of current authentication policies to move the policy immediately below the policy you want to restrict users to.
      

   6. Save the order.

That's it! With this new authentication policy and the "Always Fail" option set, all users that are associated with a specific policy will not have the ability to "Try another method" after being denied with that policy.