multi-factor authentication

[Detlef Biederma]

Hello 

We plan to enable MFA.  Goal:  every user should use multi-factor auth.  

Possible ways:

• user based:  set   sys_user.enable_multifactor_authn  = true 
• role based:  set "Multi-factor Criteria" to one or more specific roles
• group/ip based:

If I try to go a simple way:  

• scheduled job (every hour):  set  sys_user.enable_multifactor_authn  = true   for all users
  would it initiate problems for technical users (interface users)   (not human's)  ?

Sincerely Detlef Biedermann

[Randheer Singh · Accepted solution]

Hi @Detlef Biederma ,
You should explore using adaptive authentication - MFA context policy to enforce MFA dynamically based on a policy.

You can create a policy that always evaluates to true. For example, you can use the authentication scheme filter criteria.

Here is the documentation for the feature. Here is the NowLearning course on Adaptive Authentication.
Please let me know if you want an example policy.

Thanks,

Randheer

[Detlef Biederma]

Thanks for the feedback.  

I was not aware, that there is an other property to enable "MFA context":

in addtion to:

Now I can elaborate a lot more functionality.

Thanks.

[Amit Pandey]

Hi @Detlef Biederma 

As per my understanding, scheduled jobs for MFA will be an aggressive measure. You may bump into unknown errors. I agree with Mr. @Randheer Singh. You should explore-

https://www.youtube.com/watch?v=rIQNf4M7LyU

Regards,

Amit

[Randheer Singh]

Hi @Amit Pandey ,

The YouTube link is pointing to an entirely different feature supported by adaptive authentication. Could you please update or remove it to avoid confusion? 
Thanks,

Randheer