The Authenticate User or Group assertion can be used to ensure that a valid username and password is being used when prompted to authenticate. Before adding the Authenticate User or Group assertion, you would need to:

• Create a user or group in an Identity Provider
• Add the Require HTTP Basic Credentials to the assertion.

After adding the Authenticate User or Group assertion, you will want to right-click on the assertion, choose Select Target Message and select Request.

In this example, the Authenticate User or Group assertion is added to authenticate user jeremy.canfield.

When prompted to authenticate, if you provide a bogus username or password . . .

. . . the following will be displayed.

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
 <soapenv:Body>
  <soapenv:Fault>
   <faultcode>soapenv:Server</faultcode>
   <faultstring>Policy Falsified</faultstring>
   <faultactor>https://api.example.com/example</faultactor>
   <detail>
    <l7:policyResult xmlns:l7="http://www.layer7tech.com/ws/policy/fault" status="Authentication Required"/>
   </detail>
  </soapenv:Fault>
 </soapenv:Body>
</soapenv:Envelope>

Likewise, the Gateway Audit Events will have Authentication Required (401). In this example, the Associated Logs tab in the Audit Log shows a bogus credentials were used in the request.

Let's now authenticate with valid credentails. If the user forgot their password, you can reset the users password.