Add Multifactor Authentication to Workflow Processes

Workflow Studio includes an activity named RunMultifactorAuthentication that you can drag and drop onto the design surface of any stock or custom workflows to force the person using the workflow to undergo multi-factor authentication (MFA) before the workflow continues. This allows you to add an extra layer of security to processes where more caution is warranted, such as when a person account is being deleted from EmpowerID, for example.

To inject MFA into a workflow, you only need to do the following:

1. Add the RunMultifactorAuthentication activity to the workflow

2. Add a reference to the MultiFactorAuthenticator.dll to the workflow

3. Create new properties on the workflow and bind those to the corresponding properties of the activity. These properties are dynamic workflow parameters whose values can be set in the UI by EmpowerID administrators.

This article demonstrates adding MFA to a workflow by adding the RunMultiFactorAuthentication activity to a copy of the stock DeleteMultiplePeopleWithOptions workflow.

To add multifactor authentication to a workflow

1. In Workflow Studio, search for and open the DeleteMultiplePeopleWithOptions workflow.

2. From the Common toolbar, click Save As and then save a copy of the workflow in the folder of your choice, naming it DeletePeopleWithOptionsMFA.

   Open

   

    

3. Search for the RunMultiFactorAuthentication activity and then drag it onto the design surface of your workflow.

   Open

   

    

4. Rearrange the workflow so that RunMultiFactorAuthentication is the first activity.

    

5. From the Code Tree pane of the Workflow Solution, right-click References and select Add Reference > Add Assembly Reference.

    

6. Select MultiFactorAuthenticator and click Add selected items.

    

7. Back in the workflow designer, click the Properties tab for the workflow.

    

8. From the Workflow Properties tab, right-click the top-level workflow node and select Add New Property.

    

9. In the Add New Property dialog that opens, add the TargetUsePolicyMultifactor property of type Boolean (as mentioned in the above table).

    

10. Repeat steps 8 and 9 to add to the workflow the rest of the required properties (as mentioned in the above table).

11. Click the Bindings tab above the workflow. We will use this tab the bind the workflow properties you just created to their corresponding properties on the MFA activity.

     

12. From the Bindings tab, expand the Workflow properties tree on the left and the MFA activity properties tree on the right.

13. Drag the properties you just added to the workflow from the Workflow properties tree onto their corresponding MFA activity properties.

14. From the Workflow properties tree, click the Base Properties node to expand it and then click the Workflow node.

15. Locate the Initiator property.

     

16. Drag the Initiator property onto the TargetPerson property of the MFA activity. This specifies that MFA be run against the person initiating the workflow.
    
    When you have completed binding the workflow and activity properties, the trees should look like the below image.

     

17. Return to the workflow designer and click the Compile button. Compiling allows you to check for any errors.

     

18. Click Close to close the Operations log.

    
    If you have errors, fix them and then compile the workflow again.
    
    

19. When ready, click the Compile and Publish button to publish the workflow.

     

20. From the Publishing Wizard that appears, click Next to begin the process.

     

21. Click Yes when prompted about creating a request workflow.

     

22. Click OK to accept the default values presented by the Request Workflow dialog.
    
    Take note of the URL as that where you can access the workflow.

     

23. When prompted to restart services, click No.

24. Reset IIS.

To add parameters to the request workflow

1. From the navbar of the Web interface, expand Object Administration and click Workflows.
   
   This takes you to the Workflows page, where can search for and manage settings for all published workflows.

    

2. Search for the workflow and then click the Display Name link for it.

    

3. On the Workflow Details page that appears, click the Request Workflow Parameters accordion.

    

4. From the expanded accordion, click the Add New Parameter button.

    

5. Enter the name and value for the parameter and then click SAVE.

    

6. Add each required parameter, specifying their values. Be sure the names match the workflow property names exactly.

7. When finished adding parameters, recycle the EmpowerID app pools.