diff --git a/main/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings.mdx b/main/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings.mdx index df5005431..1a94fa891 100644 --- a/main/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings.mdx +++ b/main/docs/authenticate/protocols/saml/saml-identity-provider-configuration-settings.mdx @@ -18,7 +18,7 @@ These are the settings used to configure a -If you have configured a [Custom Domain](/docs/customize/custom-domains), you must use your custom domain CNAME in place of the Auth0 domain. To learn more, read [Configure Features to Use Custom Domains](/docs/customize/custom-domains/configure-features-to-use-custom-domains#configure-saml-identity-providers). +If you have configured a [Custom Domain](/docs/customize/custom-domains), you must use your custom domain in place of the Auth0 domain. To learn more, read [Configure Features to Use Custom Domains](/docs/customize/custom-domains/configure-features-to-use-custom-domains#configure-saml-identity-providers). @@ -307,4 +307,4 @@ export const codeExample15 = `https://{yourDomain}/samlp?connection={yourConnect * [Locate the Connection ID or Name](/docs/authenticate/identity-providers/locate-the-connection-id) * [Customize SAML Assertions](/docs/authenticate/protocols/saml/saml-configuration/customize-saml-assertions) -* [Troubleshoot SAML Configurations](/docs/troubleshoot/authentication-issues/troubleshoot-saml-configurations) \ No newline at end of file +* [Troubleshoot SAML Configurations](/docs/troubleshoot/authentication-issues/troubleshoot-saml-configurations) diff --git a/main/docs/secure/attack-protection/breached-password-detection.mdx b/main/docs/secure/attack-protection/breached-password-detection.mdx index 45e1bd62f..f9f9473d5 100644 --- a/main/docs/secure/attack-protection/breached-password-detection.mdx +++ b/main/docs/secure/attack-protection/breached-password-detection.mdx @@ -1,188 +1,189 @@ ---- -description: Understand why a user receives a breached password email and general - web security tips. -'og:image': https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png -'og:title': Breached Password Detection -'og:url': https://auth0.com/docs/ -permalink: breached-password-detection -title: Breached Password Detection -'twitter:description': Understand why a user receives a breached password email and - general web security tips. -'twitter:title': Breached Password Detection ---- - - -These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements). - - - -Breached password detection protects your applications from bad actors signing up or logging in with stolen credentials. Auth0 can both notify users and block at-risk accounts. - -Auth0 tracks large security breaches that occur on major third-party sites. If Auth0 identifies that any of your users’ credentials were part of a breach, the breached password detection security feature triggers. In response, Auth0 can: - -* Block new users from signing up with stolen credentials. Entirely blocks the username/password combination. -* Block anyone from logging in with stolen credentials. Entirely blocks the account and prevents bad actors from accessing your application. The user can’t log in until they change their password. -* Send an email to the user when a login attempt happens. The email informs users about the risk and instructs them to change their password immediately. You can customize the message sent to users. To learn more, read [Customize Blocked Account Emails](/docs/customize/email/customize-blocked-account-emails). - -## Detect breaches faster with Credential Guard - -Breached password detection relies on breach data released to the public. Credential Guard is an additional Auth0 service you can add to breach password detection that screens for breaches to allow faster notification of compromised credentials. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Breached Password ProtectionCredential Guard
Plans includedB2B / B2C Professional and EnterprisePart of Attack Protection add-on in Enterprise plan
Data collection methodWeb scanners and scrapers search for user credentials in published security breachesDedicated security team infiltrates criminal communities and gains access to breach data that isn’t otherwise available
Typical detection timeUp to 7-13 months12-36 hours
CoverageEnglish only200+ countries and territories
- -To add Credential Guard to your Auth0 agreement, [contact us](https://auth0.com/get-started?place=header&type=button&text=talk%20to%20sales). - -## Configure breached password detection - -When enabled, you can customize breached password detection preferences, such as the detection method, response scenarios, and notifications. - -1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. - - ![The toggle for turning on breached password detection in Auth0](/docs/images/cdy7uua7fh8z/239K5la6duvT7ZwpAt2ED1/555a7396d08120e32d5d226d41d84d31/Screen_Shot_2022-01-20_at_3.46.04_PM.png) -2. To turn on breached password detection, enable the switch at the top-right corner of the page. - - ![Configure breached password detection in Auth0](/docs/images/cdy7uua7fh8z/4xxqrdFGgd5toF8r6MZNvw/bce8ec201496ecfa538dc5c69e433653/2022-08-22_16-10-13.png) - - - - Enabling attack protection features without any response settings enabled activates Monitoring mode, which records related events in your tenant log only. To learn more, read [View Attack Protection Log Events](/docs/secure/attack-protection/view-attack-protection-events). - - - - - - If you cannot see the toggle to enable tenant logs for Risk Assessment, you may need to [upgrade your plan](https://manage.auth0.com/#/tenant/billing/subscription). - - - -### Configure detection method - -Based on features available with your plan, you can configure the detection method used to identify compromised credentials. - -1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. -2. In the **Detection** section, locate **Breached Password Detection Method**. -3. If your agreement with Auth0 includes Credential Guard, select **As soon as possible based on data received from the dark web, with Credential Guard**. -4. Otherwise, leave **When breach data is published** selected. -5. Select **Save** to apply changes. - -### Configure response scenarios - -You can configure how Auth0 responds to different scenarios when users may provide compromised credentials. - -1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. -2. Locate the **Response** section. - - ![](/docs/images/cdy7uua7fh8z/6AWOwZZVAo9pDmeRYppcvn/44b87e4c9b73a681da20db5e16d6b32a/Configure_response_scenarios.png) -3. Enable the **Block compromised credentials for new accounts** toggle to block users from using compromised credentials during signup. -4. Enable the **Block compromised user accounts** toggle to block users from using compromised credentials during login. -5. Enable the **Block compromised credentials use for password reset** toggle to block users from using compromised credentials upon password reset. - - - -If you are using Lock, our UI widget for authenticating users, with the Classic Login experience, then you must update to v11.33.3 or higher to use breached password detection for new accounts. To learn more about Lock, navigate to the [Lock library](/docs/libraries#lock). If you are using an Auth0 SDK, then you must update to the newest version to use breached password detection for new accounts. - - - -### Configure notifications - -You can configure how Auth0 notifies users and admins about the use of compromised credentials. - -1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. -2. Locate the **Notifications** section. -3. Enable the **Send notifications to users with compromised credentials** toggle to send an email to a user when Auth0 detects their credentials may have been compromised. -4. Enable the **Compromised user accounts** toggle to send an email to administrators when a user signs up with compromised credentials. -5. Enable the **Compromised user accounts** toggle to send an email to administrators when a user logs in with compromised credentials. -6. Choose the notification frequency: **Immediately**, **Daily**, **Weekly**, or **Monthly**. - - - - If you choose **daily**, **weekly**, or **monthly**, your notification will include the number of breaches to your application. If you choose **immediate**, your notification will include the user account attempting to breach your application. Logs are throttled to 1 per hour. - - -7. Select **Save**. - -#### Customize email notifications to users - -You can configure the notification Auth0 sends to your users when compromised credentials are used for login. - -1. Navigate to [Dashboard > Branding > Email Templates](https://manage.auth0.com/#/templates). -2. In the **Template** dropdown menu, select **Password Breach Alert**. -3. Update the template accordingly. You can use any of the available [common variables](/docs/customize/email/email-templates#common-variables) to customize the message. - -## Verify detection configuration - -You can verify your configuration by testing signup and login flows with an Auth0-provided breached password. - - - -Any password starting with `AUTH0-TEST-` triggers Breached Password Detection for testing purposes. - - - -### Signup flow - -Verify a user’s signup experience when Auth0 detects a breached password: - -1. Go through your signup flow and try to register a new account with a test breached password (`Paaf213XXYYZZ` or `Paat739!!WWXXYYZZ`) or any password starting with `AUTH0-TEST-`. -2. If **Block compromised credentials for new accounts** is enabled, you will receive an error message, preventing you from using the breached password. -3. Navigate to [Dashboard > Monitoring > Logs](https://manage.auth0.com/#/logs). -4. Search the logs for `type: "signup_pwd_leak"` to verify Auth0 blocked the signup. - -### Login flow - -Verify a user's login experience when Auth0 detects a breached password: - -1. Create a test user in [Dashboard > User Management > User](https://manage.auth0.com/#/users), and assign a test breached password (`Paaf213XXYYZZ` or `Paat739!!WWXXYYZZ`) or any password starting with `AUTH0-TEST-`. -2. Go through your login flow and submit the identifier and password that you assigned. -3. If **Block compromised user accounts** is enabled, the user will receive an error message, preventing them from logging in and advising to reset their password. -4. Navigate to [Dashboard > Monitoring > Logs](https://manage.auth0.com/#/logs). -5. Search the logs for `type: "pwd_leak"` to verify Auth0 blocked the login. -6. Navigate to [Dashboard > User Management > User](https://manage.auth0.com/#/users) to delete the test user. - -### Reset flow - -Verify a user's password reset experience when Auth0 detects a breached password: - -1. Create a test user in [Dashboard > User Management > User](https://manage.auth0.com/#/users). -2. Go through your password reset flow and submit one of the test breached passwords (`Paaf213XXYYZZ` or `Paat739!!WWXXYYZZ`) or any password starting with `AUTH0-TEST-`. -3. If **Block compromised user accounts** is enabled, the end-user will receive an error message, preventing them from resetting their password and advising them to use another password. -4. Navigate to [Dashboard > Monitoring > Logs](https://manage.auth0.com/#/logs). -5. Search the logs for `type: “reset_pwd_leak"` to verify Auth0 blocked the password reset. -6. Navigate to [Dashboard > User Management > User](https://manage.auth0.com/#/users) to delete the test user. - -## Learn more - -* [Bot Detection](/docs/secure/attack-protection/bot-detection) -* [Brute-Force Protection](/docs/secure/attack-protection/brute-force-protection) -* [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling) -* [View Attack Protection Log Events](/docs/secure/attack-protection/view-attack-protection-events) -* [Customize Blocked Account Emails](/docs/customize/email/customize-blocked-account-emails) \ No newline at end of file +--- +'og:description': Understand why a user receives a breached password email and general + web security tips. +'og:image': https://cdn2.auth0.com/docs/1.14553.0/img/share-image.png +'og:title': Breached Password Detection +'og:url': https://auth0.com/docs/ +permalink: breached-password-detection +title: Breached Password Detection +'twitter:description': Understand why a user receives a breached password email and + general web security tips. +'twitter:title': Breached Password Detection +--- + + +These materials and any recommendations within are not legal, privacy, security, compliance, or business advice. These materials are intended for general informational purposes only and may not reflect the most current security, privacy, and legal developments nor all relevant issues. You are responsible for obtaining legal, security, privacy, compliance, or business advice from your own lawyer or other professional advisor and should not rely on the recommendations herein. Okta is not liable to you for any loss or damages that may result from your implementation of any recommendations in these materials. Okta makes no representations, warranties, or other assurances regarding the content of these materials. Information regarding Okta's contractual assurances to its customers can be found at [okta.com/agreements](http://okta.com/agreements). + + + +Breached password detection protects your applications from bad actors signing up or logging in with stolen credentials. Auth0 can both notify users and block at-risk accounts. + +Auth0 tracks large security breaches that occur on major third-party sites. If Auth0 identifies that any of your users’ credentials were part of a breach, the breached password detection security feature triggers. In response, Auth0 can: + +* Block new users from signing up with stolen credentials. Entirely blocks the username/password combination. +* Block anyone from logging in with stolen credentials. Entirely blocks the account and prevents bad actors from accessing your application. The user can’t log in until they change their password. +* Send an email to the user when a login attempt happens. The email informs users about the risk and instructs them to change their password immediately. You can customize the message sent to users. To learn more, read [Customize Blocked Account Emails](/docs/customize/email/customize-blocked-account-emails). + +## Detect breaches faster with Credential Guard + +Breached password detection relies on breach data released to the public. Credential Guard is an additional Auth0 service you can add to breach password detection that screens for breaches to allow faster notification of compromised credentials. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Breached Password ProtectionCredential Guard
Plans includedB2B / B2C Professional and EnterprisePart of Attack Protection add-on in Enterprise plan
Data collection methodWeb scanners and scrapers search for user credentials in published security breachesDedicated security team infiltrates criminal communities and gains access to breach data that isn’t otherwise available
Typical detection timeUp to 7-13 months12-36 hours
CoverageEnglish only200+ countries and territories
+ +To add Credential Guard to your Auth0 agreement, [contact us](https://auth0.com/get-started?place=header&type=button&text=talk%20to%20sales). + +## Configure breached password detection + +When enabled, you can customize breached password detection preferences, such as the detection method, response scenarios, and notifications. + +1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. + + ![The toggle for turning on breached password detection in Auth0](/images/cdy7uua7fh8z/239K5la6duvT7ZwpAt2ED1/555a7396d08120e32d5d226d41d84d31/Screen_Shot_2022-01-20_at_3.46.04_PM.png) +2. To turn on breached password detection, enable the switch at the top-right corner of the page. + + ![Configure breached password detection in Auth0](/images/cdy7uua7fh8z/4xxqrdFGgd5toF8r6MZNvw/bce8ec201496ecfa538dc5c69e433653/2022-08-22_16-10-13.png) + + + + Enabling attack protection features without any response settings enabled activates Monitoring mode, which records related events in your tenant log only. To learn more, read [View Attack Protection Log Events](/docs/secure/attack-protection/view-attack-protection-events). + + + + + + If you cannot see the toggle to enable tenant logs for Risk Assessment, you may need to [upgrade your plan](https://manage.auth0.com/#/tenant/billing/subscription). + + + +### Configure detection method + +Based on features available with your plan, you can configure the detection method used to identify compromised credentials. + +1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. +2. In the **Detection** section, locate **Breached Password Detection Method**. +3. If your agreement with Auth0 includes Credential Guard, select **As soon as possible based on data received from the dark web, with Credential Guard**. +4. Otherwise, leave **When breach data is published** selected. +5. Select **Save** to apply changes. + +### Configure response scenarios + +You can configure how Auth0 responds to different scenarios when users may provide compromised credentials. + +1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. +2. Locate the **Response** section. + + ![](/images/cdy7uua7fh8z/6AWOwZZVAo9pDmeRYppcvn/44b87e4c9b73a681da20db5e16d6b32a/Configure_response_scenarios.png) +3. Enable the **Block compromised credentials for new accounts** toggle to block users from using compromised credentials during signup. +4. Enable the **Block compromised user accounts** toggle to block users from using compromised credentials during login. +5. Enable the **Block compromised credentials use for password reset** toggle to block users from using compromised credentials upon password reset. + + + +If you are using Lock, our UI widget for authenticating users, with the Classic Login experience, then you must update to v11.33.3 or higher to use breached password detection for new accounts. To learn more about Lock, navigate to the [Lock library](/docs/libraries#lock). If you are using an Auth0 SDK, then you must update to the newest version to use breached password detection for new accounts. + + + +### Configure notifications + +You can configure how Auth0 notifies users and admins about the use of compromised credentials. + +1. Go to [Dashboard > Security > Attack Protection](https://manage.auth0.com/#/security/attack-protection) and select **Breached Password Detection**. +2. Locate the **Notifications** section. +3. Enable the **Send notifications to users with compromised credentials** toggle to send an email to a user when Auth0 detects their credentials may have been compromised. +4. Enable the **Compromised user accounts** toggle to send an email to administrators when a user signs up with compromised credentials. +5. Enable the **Compromised user accounts** toggle to send an email to administrators when a user logs in with compromised credentials. +6. Choose the notification frequency: **Immediately**, **Daily**, **Weekly**, or **Monthly**. + + + + If you choose **daily**, **weekly**, or **monthly**, your notification will include the number of breaches to your application. If you choose **immediate**, your notification will include the user account attempting to breach your application. Notifications and logs are throttled to 1 per hour. + + +7. Select **Save**. + +#### Customize email notifications to users + +You can configure the notification Auth0 sends to your users when compromised credentials are used for login. + +1. Navigate to [Dashboard > Branding > Email Templates](https://manage.auth0.com/#/templates). +2. In the **Template** dropdown menu, select **Password Breach Alert**. +3. Update the template accordingly. You can use any of the available [common variables](/docs/customize/email/email-templates#common-variables) to customize the message. + +## Verify detection configuration + +You can verify your configuration by testing signup and login flows with an Auth0-provided breached password. + + + +Any password starting with `AUTH0-TEST-` triggers Breached Password Detection for testing purposes. + + + +### Signup flow + +Verify a user’s signup experience when Auth0 detects a breached password: + +1. Go through your signup flow and try to register a new account with a test breached password (`Paaf213XXYYZZ` or `Paat739!!WWXXYYZZ`) or any password starting with `AUTH0-TEST-`. +2. If **Block compromised credentials for new accounts** is enabled, you will receive an error message, preventing you from using the breached password. +3. Navigate to [Dashboard > Monitoring > Logs](https://manage.auth0.com/#/logs). +4. Search the logs for `type: "signup_pwd_leak"` to verify Auth0 blocked the signup. + +### Login flow + +Verify a user's login experience when Auth0 detects a breached password: + +1. Create a test user in [Dashboard > User Management > User](https://manage.auth0.com/#/users), and assign a test breached password (`Paaf213XXYYZZ` or `Paat739!!WWXXYYZZ`) or any password starting with `AUTH0-TEST-`. +2. Go through your login flow and submit the identifier and password that you assigned. +3. If **Block compromised user accounts** is enabled, the user will receive an error message, preventing them from logging in and advising to reset their password. +4. Navigate to [Dashboard > Monitoring > Logs](https://manage.auth0.com/#/logs). +5. Search the logs for `type: "pwd_leak"` to verify Auth0 blocked the login. +6. Navigate to [Dashboard > User Management > User](https://manage.auth0.com/#/users) to delete the test user. + +### Reset flow + +Verify a user's password reset experience when Auth0 detects a breached password: + +1. Create a test user in [Dashboard > User Management > User](https://manage.auth0.com/#/users). +2. Go through your password reset flow and submit one of the test breached passwords (`Paaf213XXYYZZ` or `Paat739!!WWXXYYZZ`) or any password starting with `AUTH0-TEST-`. +3. If **Block compromised user accounts** is enabled, the end-user will receive an error message, preventing them from resetting their password and advising them to use another password. +4. Navigate to [Dashboard > Monitoring > Logs](https://manage.auth0.com/#/logs). +5. Search the logs for `type: “reset_pwd_leak"` to verify Auth0 blocked the password reset. +6. Navigate to [Dashboard > User Management > User](https://manage.auth0.com/#/users) to delete the test user. + +## Learn more + +* [Bot Detection](/docs/secure/attack-protection/bot-detection) +* [Brute-Force Protection](/docs/secure/attack-protection/brute-force-protection) +* [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling) +* [View Attack Protection Log Events](/docs/secure/attack-protection/view-attack-protection-events) + +* [Customize Blocked Account Emails](/docs/customize/email/customize-blocked-account-emails)