Creating a white label service

Helium & mAccess

Authentication mode

• Without password: user's password is not required to generate an OTP

• With password: user's password is required to generate an OTP

Service password format

You can select here the format of the password. According to your needs this can be either an alphanumeric password or a PIN code with 4 to 8 digits.

No. retries before locking password

You can define here the maximum number of tries a user may attempt with his password or PIN code, before locking his access.

Helium (browser)

Activated

Users will be able to connect to the "Secure Sites" and applications with Helium.

Template

Maximum number of devices

You can define here the maximum number 'Helium' instances a service user will be able to activate.

Tools automatically blocked after

You can define here the period of inactivity (in days) after which a Helium device is automatically blocked for users.

Tools automatically deleted after

You can define here the period of inactivity (in days) after which a Helium deviceis automatically deleted.

Display "push notification" first

• Yes → The push notification option is shown first.

• No → The Helium password field is shown first.

Display "push notification" only

• Yes → Only the push notification option is shown

• No → All options are shown, in the order defined by “Display push notification first” parameter.

mAccess (mobile SDK)

mAccess activation

mAccess activation allows you to add the SDK to your client applications (MFA library for mobile authentication)

Maximum number of mAccess based devices

You can define here the maximum number of mAccess based applications, a service user will be able to activate.

Authentication with biometrics allowed

Allows users to use their fingerprint to authenticate with the application instead of their password (It should be implemented by the appropriate mAccess functions in your code/Application)

Authentication with biometrics only

If you activate this option, your users will be restricted to authenticate with their fingerprint only (This is only possible if the service has been set without password)

Connected OTP

If activated, authentication requests with connected OTP are accepted. If not activated, they are refused.

Connected OTP format

You can choose the format based on what your authentication interface supports.
Choose OTP length according to the security level required, meaning the probability of finding the correct OTP by luck or brute force: the longer the OTP, the safer it is.

Connected OTP validity duration (sec.)

You can define here the duration of validity for online generated (connected) OTPs. In case of complex network infrastructures operating numerous network equipments it might be useful to set this duration to a higher value. This guarantees that the OTP is still valid when submitted to TrustBuilder servers for the final verification.

Offline OTP

If activated, authentication requests with offine OTP are accepted. If not activated, they are refused.

Offline OTP format

Choose OTP length and complexity according to the security level required, meaning the probability of finding the correct OTP by luck or brute force: the longer the OTP, the safer it is.

Transaction sealing

This option allows you to use mAccess to seal transactions with your application.

mAccess timeout

This is the time in seconds during which your service doesn't request users to type their mAccess password again (for connected OTP only). To generate an offline OTP, users must type their password each time.

mAccess push notification parameters

No PIN push allowed

• Yes: the user's mAccess PIN or password is not required to authorize a connection request received via push notifications.

• No: the user's mAccess PIN or password is required to authorize a connection request received via push notifications.

iPhone parameters

Settings to configure notifications for applications integrating the mAccess SDK for iOS with APNs.

• Choose the certificate file.

• Indicate whether it is a production certificate or a Sandbox certificate.

• Enter the certificate password

• Enter the AppID.

Android parameters

These parameters were used for GCM (Google Cloud Messaging) configuration which is now obsolete. They have been replaced by the Firebase parameters section.

Firebase parameters

Settings to configure Firebase notifications for applications integrating the mAccess SDK.

• Active Firebase API:

  • None: no push is sent to mAccess (can be used to protect against push bombing attacks, for example).

  • Legacy API: (deprecated as of June 2024) push notifications are sent to mAccess - The Firebase Server Key is mandatory.

  • V1 API: push notifications are sent to mAccess - a JSON file from the Firebase console is mandatory.

• Firebase Server Key: was specific to Android with Firebase Legacy API (now deprecated).

• Serviceaccount (JSON): the content of the JSON file containing the private key for your project.

• Notification Collapse Key (Optional): When several notifications are sent in a short period of time, it allows these notifications to be aggregated.

• Application Package Name: was specific to Android with Firebase Legacy API (now deprecated).

Custom Authenticator parameters

Firebase parameters

For a specific version of the Authenticator app that has been modified and has its own notification settings.

APNs parameters

SCIM

Send activation email on creation

If this option is activated, and if the account has a valid email address, an activation email will be sent when the account is created via SCIM.

General settings

Push notifications

• Yes → (default) Custom mobile apps using the TrustBuilder SDK receive notifications for authentication and transaction confirmation requests.

• No → Custom mobile apps using the TrustBuilder SDK no longer receive notifications for authentication and transaction confirmation requests. Users can still retrieve these requests from the list of pending operations.

Windows Logon

Enables or disables Trustbuilder Windows Logon feature - More information

FIDO2 Keys

Not available

Other settings

Activate a new device per email

If you activate this option, your users will be able activate new devices, by generating new activation codes they will receive on their email address.

Email PIN/password recovery

If you activate this option, your users will be able to directly receive recovery codes on their email address to reset their PIN/password.

Send an email to users when they activate a device

If you activate this option, your users will receive an email each time they activate a new device

User login policy

• Real user logins are in use: if real user logins are used in the TrustBuilder Provisioning Web Services and Management Console, TrustBuilder application can automatically insert the login of a user during the authentication procedure

• User logins are aliases: if logins used in TrustBuilder Provisioning and Management tools are aliases, the user will have to manually insert his/her login during the authentication procedure

Maximum number of devices of all types

You can define here the maximum number of authentication devices of all types a service user will be able to activate.

IP Filtering

• Activate IP filtering (option): Activate the filtering of IP addresses that will have access to TrustBuilder Web Services.

• Authorized IP addresses (option): You can define a list of authorized addresses here, using a semicolon-separated list of IP addresses