Normal login:
  password/passkey/session/token valid -> authenticated

Risk-based login:
  credential valid + context low risk -> authenticated
  credential valid + context medium risk -> step-up challenge
  credential valid + context high risk -> deny / hold / recovery review

if (!request.ip().equals(lastLoginIp)) {
  requireOtp();
}

Authentication decision = proof + context + policy + history + risk tolerance

Apakah claimant bisa membuktikan kontrol atas authenticator?

Apakah cara, lokasi, perangkat, waktu, pola, dan target aksi ini masuk akal untuk subject tersebut?

credential proof -> baseline assurance
context evaluation -> risk classification
policy decision -> allow / step-up / deny / review

Risk engine: "login risk = 72 / high"
Policy engine: "for password login, high risk requires passkey or recovery review"

Principal = subject yang berhasil dibuktikan melalui authenticator.
Signal = fakta lingkungan yang membantu menilai anomali.

new device -> step-up -> verified -> bind device -> reduce future friction

new device -> deny forever

forgot password
change email
replace MFA
disable passkey
invite admin
rotate API key

denied because model said 0.87392

Denied because impossible travel + new device + high-risk ASN + failed MFA attempts.

Bad:
  "Login blocked because your IP is from ASN 12345 and impossible travel was detected."

Better:
  "We could not verify this sign-in. Please complete additional verification."

Password compromised -> send OTP to compromised mailbox -> allow MFA reset

CREATE TABLE auth_risk_event (
  id UUID PRIMARY KEY,
  tenant_id UUID NOT NULL,
  subject_id UUID,
  account_id UUID,
  event_type TEXT NOT NULL,
  occurred_at TIMESTAMPTZ NOT NULL,

  ip_hash BYTEA,
  ip_prefix TEXT,
  asn INTEGER,
  country_code CHAR(2),
  region_code TEXT,
  city_hash BYTEA,

  user_agent_hash BYTEA,
  browser_family TEXT,
  os_family TEXT,
  device_id UUID,
  device_known BOOLEAN,

  credential_type TEXT,
  authenticator_id UUID,
  assurance_before TEXT,
  assurance_after TEXT,

  risk_score INTEGER,
  risk_level TEXT,
  decision TEXT,
  reason_codes TEXT[] NOT NULL DEFAULT '{}',

  correlation_id TEXT,
  request_id TEXT,
  trace_id TEXT
);

CREATE INDEX idx_auth_risk_event_subject_time
  ON auth_risk_event (tenant_id, subject_id, occurred_at DESC);

CREATE INDEX idx_auth_risk_event_ip_time
  ON auth_risk_event (tenant_id, ip_prefix, occurred_at DESC);

CREATE TABLE trusted_device (
  id UUID PRIMARY KEY,
  tenant_id UUID NOT NULL,
  subject_id UUID NOT NULL,
  device_binding_id BYTEA NOT NULL,
  display_name TEXT,
  first_seen_at TIMESTAMPTZ NOT NULL,
  last_seen_at TIMESTAMPTZ NOT NULL,
  last_ip_prefix TEXT,
  last_country_code CHAR(2),
  assurance_level TEXT NOT NULL,
  trust_state TEXT NOT NULL,
  revoked_at TIMESTAMPTZ,
  revoked_reason TEXT,
  UNIQUE (tenant_id, subject_id, device_binding_id)
);

server-issued device cookie + signed binding + rotation + revocation

canvas fingerprint + font list + audio fingerprint + invasive tracking

CREATE TABLE subject_risk_profile (
  tenant_id UUID NOT NULL,
  subject_id UUID NOT NULL,
  updated_at TIMESTAMPTZ NOT NULL,

  usual_country_codes TEXT[] NOT NULL DEFAULT '{}',
  usual_asns INTEGER[] NOT NULL DEFAULT '{}',
  known_device_count INTEGER NOT NULL DEFAULT 0,
  last_successful_login_at TIMESTAMPTZ,
  last_mfa_success_at TIMESTAMPTZ,
  last_password_change_at TIMESTAMPTZ,
  last_recovery_change_at TIMESTAMPTZ,

  failed_login_count_1h INTEGER NOT NULL DEFAULT 0,
  failed_login_count_24h INTEGER NOT NULL DEFAULT 0,
  account_takeover_suspected BOOLEAN NOT NULL DEFAULT FALSE,

  PRIMARY KEY (tenant_id, subject_id)
);

trusted today does not mean trusted forever

public enum RiskLevel {
    LOW,
    MEDIUM,
    HIGH,
    CRITICAL
}

public record RiskReason(
    String code,
    int weight,
    String description
) {}

public record RiskAssessment(
    int score,
    RiskLevel level,
    List<RiskReason> reasons
) {
    public boolean hasReason(String code) {
        return reasons.stream().anyMatch(r -> r.code().equals(code));
    }
}

public final class AuthenticationRiskEvaluator {

    public RiskAssessment evaluate(AuthRiskInput input) {
        List<RiskReason> reasons = new ArrayList<>();

        if (!input.knownDevice()) {
            reasons.add(new RiskReason(
                "NEW_DEVICE",
                25,
                "Login from device not previously verified for subject"
            ));
        }

        if (input.impossibleTravelDetected()) {
            reasons.add(new RiskReason(
                "IMPOSSIBLE_TRAVEL",
                60,
                "Login location is inconsistent with recent successful login"
            ));
        }

        if (input.highRiskAsn()) {
            reasons.add(new RiskReason(
                "HIGH_RISK_ASN",
                20,
                "Network ASN is associated with elevated abuse risk"
            ));
        }

        if (input.failedAttemptsForSubjectLastHour() >= 5) {
            reasons.add(new RiskReason(
                "SUBJECT_FAILED_ATTEMPT_SPIKE",
                30,
                "Subject has many recent failed authentication attempts"
            ));
        }

        if (input.passwordChangedRecently()) {
            reasons.add(new RiskReason(
                "RECENT_PASSWORD_CHANGE",
                15,
                "Password was changed recently"
            ));
        }

        int score = reasons.stream().mapToInt(RiskReason::weight).sum();
        return new RiskAssessment(score, classify(score, reasons), reasons);
    }

    private RiskLevel classify(int score, List<RiskReason> reasons) {
        if (reasons.stream().anyMatch(r -> r.code().equals("IMPOSSIBLE_TRAVEL")) && score >= 80) {
            return RiskLevel.CRITICAL;
        }
        if (score >= 70) return RiskLevel.HIGH;
        if (score >= 35) return RiskLevel.MEDIUM;
        return RiskLevel.LOW;
    }
}

score=75 is not actionable
reasons=[NEW_DEVICE, HIGH_RISK_ASN, SUBJECT_FAILED_ATTEMPT_SPIKE] is actionable

public enum AuthDecisionType {
    ALLOW,
    STEP_UP,
    DENY,
    HOLD_FOR_REVIEW
}

public record AuthDecision(
    AuthDecisionType type,
    String requiredAssuranceLevel,
    Set<String> allowedChallengeTypes,
    String userMessageCode,
    List<String> auditReasonCodes
) {}

public final class AuthenticationRiskPolicy {

    public AuthDecision decide(LoginContext ctx, RiskAssessment risk) {
        if (risk.level() == RiskLevel.CRITICAL) {
            return new AuthDecision(
                AuthDecisionType.DENY,
                "AAL2",
                Set.of(),
                "AUTH_VERIFICATION_FAILED",
                reasonCodes(risk)
            );
        }

        if (risk.level() == RiskLevel.HIGH) {
            return new AuthDecision(
                AuthDecisionType.STEP_UP,
                "AAL2",
                Set.of("PASSKEY", "TOTP", "RECOVERY_REVIEW"),
                "AUTH_ADDITIONAL_VERIFICATION_REQUIRED",
                reasonCodes(risk)
            );
        }

        if (risk.level() == RiskLevel.MEDIUM && ctx.credentialType().equals("PASSWORD")) {
            return new AuthDecision(
                AuthDecisionType.STEP_UP,
                "AAL2",
                Set.of("TOTP", "PASSKEY"),
                "AUTH_ADDITIONAL_VERIFICATION_REQUIRED",
                reasonCodes(risk)
            );
        }

        return new AuthDecision(
            AuthDecisionType.ALLOW,
            ctx.currentAssuranceLevel(),
            Set.of(),
            "AUTH_OK",
            reasonCodes(risk)
        );
    }

    private List<String> reasonCodes(RiskAssessment risk) {
        return risk.reasons().stream().map(RiskReason::code).toList();
    }
}

public enum AssuranceLevel {
    ANONYMOUS,
    AAL1,
    AAL2,
    AAL3
}

public record AuthSession(
    UUID sessionId,
    UUID subjectId,
    AssuranceLevel assuranceLevel,
    Instant authenticatedAt,
    Instant lastStepUpAt,
    Set<String> completedFactors,
    UUID deviceId
) {}

public record AssuranceRequirement(
    AssuranceLevel minimumLevel,
    Duration maxAge,
    Set<String> acceptedFactors
) {}

Change display name:
  minimum=AAL1, maxAge=24h

Change password:
  minimum=AAL2, maxAge=15m

Disable MFA:
  minimum=AAL2, maxAge=5m, acceptedFactors must include existing enrolled factor

Create admin API key:
  minimum=AAL2, maxAge=5m, plus admin approval

CREATE TABLE step_up_challenge (
  id UUID PRIMARY KEY,
  tenant_id UUID NOT NULL,
  subject_id UUID NOT NULL,
  session_id UUID NOT NULL,
  action_code TEXT NOT NULL,
  challenge_type TEXT NOT NULL,
  status TEXT NOT NULL,
  created_at TIMESTAMPTZ NOT NULL,
  expires_at TIMESTAMPTZ NOT NULL,
  verified_at TIMESTAMPTZ,
  attempt_count INTEGER NOT NULL DEFAULT 0,
  max_attempts INTEGER NOT NULL,
  risk_reason_codes TEXT[] NOT NULL DEFAULT '{}',
  continuation_token_hash BYTEA NOT NULL
);

device_cookie = random_id + signature / encrypted envelope
server stores hash(random_id)

public boolean impossibleTravel(LoginLocation previous, LoginLocation current, Instant previousAt, Instant currentAt) {
    if (previous == null || current == null) return false;
    if (previous.countryCode().equals(current.countryCode())) return false;

    double distanceKm = haversine(previous.lat(), previous.lon(), current.lat(), current.lon());
    double hours = Duration.between(previousAt, currentAt).toMinutes() / 60.0;
    if (hours <= 0.0) return true;

    double speedKmh = distanceKm / hours;
    return speedKmh > 900; // intentionally rough threshold
}

impossible travel + known passkey + verified device -> step-up
impossible travel + password only + new device + high-risk ASN -> deny/hold

@Component
public final class RiskAwareAuthenticationSuccessHandler implements AuthenticationSuccessHandler {

    private final RiskService riskService;
    private final StepUpService stepUpService;
    private final AuthenticationSuccessHandler defaultSuccessHandler;

    public RiskAwareAuthenticationSuccessHandler(
        RiskService riskService,
        StepUpService stepUpService
    ) {
        this.riskService = riskService;
        this.stepUpService = stepUpService;
        this.defaultSuccessHandler = new SavedRequestAwareAuthenticationSuccessHandler();
    }

    @Override
    public void onAuthenticationSuccess(
        HttpServletRequest request,
        HttpServletResponse response,
        Authentication authentication
    ) throws IOException, ServletException {

        LoginRiskContext ctx = LoginRiskContext.from(request, authentication);
        RiskAssessment assessment = riskService.evaluate(ctx);
        AuthDecision decision = riskService.decide(ctx, assessment);

        if (decision.type() == AuthDecisionType.ALLOW) {
            riskService.recordDecision(ctx, assessment, decision);
            defaultSuccessHandler.onAuthenticationSuccess(request, response, authentication);
            return;
        }

        if (decision.type() == AuthDecisionType.STEP_UP) {
            StepUpChallenge challenge = stepUpService.createChallenge(ctx, assessment, decision);
            riskService.recordDecision(ctx, assessment, decision);
            response.sendRedirect("/auth/step-up?challenge=" + challenge.publicId());
            return;
        }

        SecurityContextHolder.clearContext();
        riskService.recordDecision(ctx, assessment, decision);
        response.sendRedirect("/login?error=verification_required");
    }
}

public final class AssuranceAuthorizationManager
        implements AuthorizationManager<RequestAuthorizationContext> {

    private final AssuranceRequirement requirement;

    public AssuranceAuthorizationManager(AssuranceRequirement requirement) {
        this.requirement = requirement;
    }

    @Override
    public AuthorizationDecision check(
        Supplier<Authentication> authentication,
        RequestAuthorizationContext context
    ) {
        Authentication auth = authentication.get();
        if (auth == null || !auth.isAuthenticated()) {
            return new AuthorizationDecision(false);
        }

        AuthenticatedPrincipal principal = (AuthenticatedPrincipal) auth.getPrincipal();
        SessionAssurance assurance = principal.assurance();

        boolean sufficientLevel = assurance.level().compareTo(requirement.minimumLevel()) >= 0;
        boolean fresh = assurance.lastVerifiedAt().isAfter(Instant.now().minus(requirement.maxAge()));
        boolean factorOk = assurance.completedFactors().containsAll(requirement.acceptedFactors());

        return new AuthorizationDecision(sufficientLevel && fresh && factorOk);
    }
}

{
  "iss": "https://id.example.com/realms/acme",
  "sub": "01J...",
  "aud": "case-management-api",
  "scope": "case:read case:approve",
  "acr": "aal2",
  "amr": ["pwd", "otp"],
  "auth_time": 1783090100,
  "risk_level": "low",
  "tenant_id": "acme"
}

@ApplicationScoped
public class RiskAwareAuthenticationMechanism implements HttpAuthenticationMechanism {

    @Inject IdentityStoreHandler identityStoreHandler;
    @Inject RiskService riskService;
    @Inject StepUpService stepUpService;

    @Override
    public AuthenticationStatus validateRequest(
        HttpServletRequest request,
        HttpServletResponse response,
        HttpMessageContext context
    ) throws AuthenticationException {

        Optional<UsernamePasswordCredential> credential = extractCredential(request);
        if (credential.isEmpty()) {
            return context.doNothing();
        }

        CredentialValidationResult result = identityStoreHandler.validate(credential.get());
        if (result.getStatus() != CredentialValidationResult.Status.VALID) {
            riskService.recordFailure(request);
            return context.responseUnauthorized();
        }

        LoginRiskContext riskContext = LoginRiskContext.from(request, result);
        RiskAssessment assessment = riskService.evaluate(riskContext);
        AuthDecision decision = riskService.decide(riskContext, assessment);

        if (decision.type() == AuthDecisionType.ALLOW) {
            return context.notifyContainerAboutLogin(
                result.getCallerPrincipal(),
                result.getCallerGroups()
            );
        }

        if (decision.type() == AuthDecisionType.STEP_UP) {
            stepUpService.createChallenge(riskContext, assessment, decision);
            return context.redirect("/auth/step-up");
        }

        return context.responseUnauthorized();
    }
}

credential validation remains separate from risk policy
risk policy decides final authentication status / assurance level

low risk -> 302 /home
medium risk -> 302 /auth/step-up
high risk -> generic verification failure

HTTP/1.1 401 Unauthorized
Content-Type: application/json
WWW-Authenticate: Bearer error="insufficient_authentication", error_description="additional verification required"

{
  "error": "step_up_required",
  "challenge_uri": "/auth/challenges/abc",
  "accepted_methods": ["passkey", "totp"]
}

HTTP/1.1 401 Unauthorized
Content-Type: application/json

{
  "error": "verification_failed"
}

Read case -> normal session OK
Draft action -> AAL1 OK
Submit recommendation -> AAL2 required
Approve sanction -> AAL2 fresh + known device + no high risk signals
Override escalation -> AAL2 fresh + privileged role + supervisor approval
Export evidence -> AAL2 fresh + audit reason

Authentication risk informs workflow controls.
It must not be hidden inside login code only.

auth_risk_assessment_total{level="low"}
auth_risk_assessment_total{level="medium"}
auth_risk_assessment_total{level="high"}
auth_step_up_required_total{method="totp"}
auth_step_up_success_total{method="passkey"}
auth_step_up_failure_total{method="totp"}
auth_high_risk_deny_total{reason="impossible_travel"}
auth_known_device_bind_total
auth_known_device_revoke_total
auth_false_positive_report_total

{
  "event": "AUTH_RISK_DECISION",
  "tenant_id": "acme",
  "subject_id": "01J...",
  "risk_score": 75,
  "risk_level": "HIGH",
  "decision": "STEP_UP",
  "reason_codes": ["NEW_DEVICE", "HIGH_RISK_ASN", "FAILED_ATTEMPT_SPIKE"],
  "credential_type": "PASSWORD",
  "device_known": false,
  "correlation_id": "req-123"
}

Collect what is needed.
Hash what can be hashed.
Aggregate where possible.
Expire aggressively.
Explain policy internally.
Restrict access to risk logs.

Collect every browser fingerprint property forever because maybe useful.

Store known-device binding, coarse geo, ASN, reason codes, and event history with retention.

@Test
void newDeviceAndFailedAttemptsRequiresMediumRisk() {
    AuthRiskInput input = AuthRiskInput.builder()
        .knownDevice(false)
        .failedAttemptsForSubjectLastHour(6)
        .highRiskAsn(false)
        .impossibleTravelDetected(false)
        .build();

    RiskAssessment assessment = evaluator.evaluate(input);

    assertThat(assessment.level()).isEqualTo(RiskLevel.MEDIUM);
    assertThat(assessment.reasons())
        .extracting(RiskReason::code)
        .contains("NEW_DEVICE", "SUBJECT_FAILED_ATTEMPT_SPIKE");
}

@Test
void highRiskPasswordLoginRequiresStepUp() {
    RiskAssessment risk = new RiskAssessment(
        75,
        RiskLevel.HIGH,
        List.of(new RiskReason("NEW_DEVICE", 25, ""), new RiskReason("HIGH_RISK_ASN", 50, ""))
    );

    AuthDecision decision = policy.decide(passwordLogin(), risk);

    assertThat(decision.type()).isEqualTo(AuthDecisionType.STEP_UP);
    assertThat(decision.requiredAssuranceLevel()).isEqualTo("AAL2");
}

com.example.auth.risk
  RiskAssessment.java
  RiskReason.java
  RiskLevel.java
  RiskSignal.java
  AuthRiskInput.java
  AuthenticationRiskEvaluator.java
  AuthenticationRiskPolicy.java
  RiskDecisionRecorder.java

com.example.auth.stepup
  StepUpChallenge.java
  StepUpService.java
  StepUpController.java
  AssuranceRequirement.java
  AssuranceAuthorizationManager.java

com.example.auth.device
  DeviceBinding.java
  DeviceBindingService.java
  DeviceCookieSigner.java
  TrustedDeviceRepository.java

AuthService verifies credential.
RiskService evaluates context.
StepUpService orchestrates challenges.
SessionService raises/lowers assurance.
AuditService records decision.

observe context -> score risk -> apply policy -> challenge/deny/allow -> record outcome -> tune policy

proof != risk
risk != decision
authentication != authorization
session != assurance
recovery != bypass