Latest postImplementing Risk based Adaptive Authentication
Not every login deserves the same treatment. A password typed in from the same laptop as always is one thing; the same password showing up from a country the user's never logged in from is another — and asking for MFA on every single sign-in just to catch the second case annoys everyone hitting the first.
O2ID's condition node can make simple calls like that, but only within
limits: it evaluates a CEL expression
with deliberately no loops, no variables, and no network access. A tenant
admin writes the expression, and it has to be safe to evaluate blind every
single time — keeping it that limited is what makes that safe. Real risk
decisions rarely fit in one expression, though. "Is this login suspicious?"
usually means asking an external fraud-scoring service, then weighing
whatever it says back — a handful of signals, each worth something
different, added up into a score. That needs a function, not a condition.
This post wires up a login flow that calls a fraud-check service through a
webhook node, folds the answer into a step-up decision with a
script node, and only asks for TOTP when the score says so.
