In EmpowerID, multi-factor authentication (MFA) is a flexibleversatile, points-based system that allows you administrators to specify determine the number and types of factors that users must present when authenticating, as well as during authentication and the weight or point value associated with each of those factorsfactor. When users reach the designated point threshold, they are authenticated and granted access to the system. To ease user adoption, EmpowerID supports several a variety of MFA types out-of-the box. These include-box to facilitate user adoption, including:
DUO Two-Factor Authentication – When
...
required
...
by a Password Manager Policy, users
...
must approve a secondary authentication request
...
pushed to their mobile phones, sent as a one-time passcode, or delivered via a phone call.
...
This MFA type requires a Duo account
...
...
and user enrollment in Duo, registering a mobile phone, tablet, landline, or U2F token.
...
If you do not have a Duo account, you can sign up for one by visiting https://signup.duo.com/
...
.
EmpowerID Mobile Authenticator – When
...
required
...
by a Password Manager Policy, users
...
must approve a secondary authentication request
...
pushed to their mobile phones. To
...
utilize this MFA
...
type,
...
EmpowerID must
...
EmpowerID One-Time Password
...
– When
...
required
...
by a Password Manager Policy, users
...
must verify their identity by entering
...
a one-time passcode generated by EmpowerID
...
, delivered via email, SMS,
...
or voice call. To use
...
SMS and voice
...
calling features
...
, organizations must
...
...
FIDO WebAuthN – When
...
required
...
by a Password Manager Policy, users
...
are prompted to insert their security key (e.g., Yubikey device) and press the button or
...
gold disk on the key
...
.
...
EmpowerID generates a certificate linking the Yubikey to the person authenticating
...
upon first use.
OATH Time-Based One-Time Password
...
– When
...
required
...
by a Password Manager Policy, users
...
must verify their identity by entering a time-based code generated by a client application installed on their mobile devices, such as Google Authenticator or DUO.
Yubico OTP
...
– When
...
required
...
by a Password Manager Policy, users
...
must verify their identity by generating a one-time password via their Yubikey.
...
Yubico OTP
...
requires an API key from Yubico and
...
registration in EmpowerID. Users must also
...
possess a Yubikey device.
| Note |
|---|
If an MFA Type is added to an application, users must are required to authenticate themselves through using the specified MFA Type before EmpowerID grants them access to the application. |
...
On the navbar, expand Single Sign-On and click Applications.
From the Applications tab of the Find Applications page, search for the application to which you want to apply LoA points and click the Display Name link for that policy.
On the Application Details page that appears, select the SSO tab in the lower pane and expand the Multifactor Authentication accordion.
Click the Add Type (+) button to the right of the grid.
In the dialog that appears, click the Type drop-down and select one of the above-mentioned MFA Types.
Set the priority for the type in the Priority field. The lower the number, the higher the priority. When more than one MFA Type is assigned to an application, EmpowerID directs users to the MFA Type with the highest priority first and then to the MFA Type with the next highest priority, and so on until the point threshold for the application is met.
Specify whether the MFA type is required. If required, users accessing the application must authenticate using the type. When an application has requires more than one MFA Type that is required, users must authenticate using each type in the order specified by the priority for the type.
Click Save.
...