Restrict the Number of Authenticators Assigned Per User

To avoid replay attacks, you can restrict the maximum number of authenticators assigned to a user for specific authenticator types. This applies to single-device licensing (SDL) and multi-device licensing (MDL) authenticators, and authenticator instances (MDL only).

This feature is restricted to certain types of authenticators.

If the limit has been exceeded, OneSpan Cloud Authentication displays the following error message: The authenticator limit has been reached.

If a user account has 10 or more active instances of TYP00, TYP03, or TYP07, it will not be possible to activate more until enough instances have been deleted to be at or under the 10-instance limit.

This limit exceeded error affects the following endpoints:

• POST /authenticators/{serialNumber}/assign

• POST /{registrationID}/add-device

• POST /registrations

• POST /users/{userID@domain}/assign

The limit can be adjusted per tenant in the relevant authentication policies by a OneSpan administrator.