Data Governance Broker Documentation Index
Configuration Reference Home

reCAPTCHA Identity Authenticator

Note: this component stores cluster-wide configuration data and is mirrored across all servers in the topology within the the same cluster.

Note: changes to cluster-wide configuration objects are immediately and automatically mirrored across all servers within the same cluster, so offline changes are not supported.

The reCAPTCHA Identity Authenticator may be used to verify a user's response to a Google reCAPTCHA challenge.

The reCAPTCHA Identity Authenticator may be used as the first authenticator in an authentication chain to protect the rest of the authenticators against spam and abuse from bots. Once the reCAPTCHA is verified successfully, it will be remembered for the remainder of the flow and does not need to be verified again in subsequent invocations of the chain for the same flow.

↓Parent Component
↓Properties
↓dsconfig Usage

Parent Component

The reCAPTCHA Identity Authenticator component inherits from the Identity Authenticator

Properties

The properties supported by this managed object are as follows:


Basic Properties: Advanced Properties:
↓ description  None
↓ authentication-method-reference
↓ schema-urn
↓ recaptcha-key
↓ recaptcha-secret

Basic Properties

description

Description
A description for this Identity Authenticator
Default Value
None
Allowed Values
A string
Multi-Valued
No
Required
No
Admin Action Required
None. Modification requires no further action

authentication-method-reference

Description
Specifies identifiers of the authentication methods provided by this reCAPTCHA Identity Authenticator. Each value is exposed in the "amr" (authentication method reference) claim in an ID token, and also the "lastLoginMethods" and "lastSecondFactorMethods" properties of a user session SCIM sub-resource.
Default Value
captcha
Allowed Values
A string
Multi-Valued
Yes
Required
No
Admin Action Required
None. Modification requires no further action

schema-urn (Read-Only)

Description
The URN which identifies the SCIM extension schema that should contain attributes intended for this reCAPTCHA Identity Authenticator in authentication request and response messages.
Default Value
urn:pingidentity:scim:api:messages:2.0:RecaptchaAuthenticationRequest
Allowed Values
A URN begins with 'urn:', is followed by a namespace component that is no more than 32 alpha-numeric characters long, which is followed by one or more colon-delimited identifiers consisting of legal URN characters (letters, digits, and characters in '()+,-.:=@;$_!*'). For example, a URN in the 'acme' namespace might be "urn:acme:identity:User.name".
Multi-Valued
No
Required
Yes
Admin Action Required
None. Modification requires no further action

recaptcha-key

Description
Specifies the Google reCAPTCHA API key.
Default Value
None
Allowed Values
A string
Multi-Valued
No
Required
Yes
Admin Action Required
None. Modification requires no further action

recaptcha-secret

Description
Specifies the Google reCAPTCHA API secret.
Default Value
None
Allowed Values
A string
Multi-Valued
No
Required
Yes
Admin Action Required
None. Modification requires no further action


dsconfig Usage

To list the configured Identity Authenticators:

dsconfig list-identity-authenticators
     [--property {propertyName}] ...

To view the configuration for an existing Identity Authenticator:

dsconfig get-identity-authenticator-prop
     --authenticator-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Identity Authenticator:

dsconfig set-identity-authenticator-prop
     --authenticator-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new reCAPTCHA Identity Authenticator:

dsconfig create-identity-authenticator
     --authenticator-name {name}
     --type recaptcha
     --set recaptcha-key:{propertyValue}
     --set recaptcha-secret:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Identity Authenticator:

dsconfig delete-identity-authenticator
     --authenticator-name {name}