In EmpowerID multi-factor authentication (MFA) is a flexible, points based system that allows you to specify the number and types of factors that users must present when authenticating, as well as the weight or point value associated with each of those factors. When users reach the designated point threshold, they are authenticated and granted access to the system. In order to ease user adoption, EmpowerID supports a number of MFA types out of the box. These include:
DUO Two-Factor Authentication — When this MFA type is required on a Password Manager Policy, users with the policy must approve a secondary authentication request that is either pushed to their mobile phones, sent as a one-time passcode, or delivered via a phone call. In order to use this MFA Type, your organization must have a Duo account that is registered in EmpowerID. Users must also enroll in Duo and register either their mobile phone (recommended), tablet, landline or U2F token. Additionally, to use Duo Push's one-tap authentication, users must have the Duo Mobile app installed on their mobile phones. If you do not have a Duo account, you can sign up for one by visiting https://signup.duo.com/.
FIDO Universal 2nd Factor (U2F) — When this MFA Type is required on a Password Manager Policy users with the policy will be prompted to insert their security key (Yubikey device) and press the button or the gold disk on the key to continue. If this is the first time the Yubikey device is being used, EmpowerID generates a certificate linking the Yubikey to the person authenticating. Once the certificate is generated, the Yubikey cannot be used by any other person for FIDO U2F authentication.
Yubico OTP — When this MFA Type is required on a Password Manager Policy, users with the policy must verify their identity by generating a one-time password via their Yubikey. As Yubico OTP uses YubiCloud for verifying OTPs, you need to get an API key from Yubico and register the key in EmpowerID. Users must also have a Yubikey. If you do not have an API key, you can get one from Yubico by visiting https://upgrade.yubico.com/getapikey/. Please note that you will need to have a Yubikey to get an API key.
Set the priority for the type in the Priority field. The lower the number the higher the priority. Priority is only applicable when the MFA Type is required.
Specify whether the MFA type is required. If required, users with the policy must authenticate using the type. When a policy has more than one MFA Type that is required, users must authenticate using each type in the order specified by the priority for the type.