Definition
“MFA” stands for “Multi-Factor Authentication”.
Memority MFA Account Policies (also referred to as myMFA policies) allows to configure how MFA should be applied to the population of users.
In order for an identity to be able to use MFA enrollment and authentication, it is necessary that this identity is part of the scope of at least one MyMFA policy.
Configuration
You can access the Memority MFA Account Policy configuration :
-
by clicking on "Policies" → “Memority MFA Account Policies”
-
by clicking on "System" → "Configurations" → "Data Model" and perform an import/export.
Properties - Information
|
Property name |
Type |
Description |
Values (default value in bold) |
|---|---|---|---|
|
id |
|
The identifier is the unique identifier of each Memority MFA Account Policy. It is case sensitive and no special characters (except - or _) are allowed. |
- |
|
name |
|
The Memority MFA Account Policy name. |
- |
|
active |
|
Allows to define if the Memority MFA Account Policy is activated or not. |
ON, OFF |
|
description |
|
Allows to describe the purpose of the Policy. |
- |
Properties - Assignment
|
Property name |
Type |
Description |
Values (default value in bold) |
|---|---|---|---|
|
priority |
|
Indicates the priority of this policy when resolving which policy to apply on an Identity (1 having more precedence). If the Object is part of the Scope of several Policies, the Policy with the highest priority (the lowest value) will be taken into account. |
1, 2, 3... |
|
scope |
- |
Allows to configure on which Identities the policy will be applied. |
- |
Properties - Configuration
Mandatory elements
|
Property name |
Type |
Description |
Values (default value in bold) |
|---|---|---|---|
|
serviceId |
|
A technical identifier provided by the cloud platform infrastructure to target a specific MFA service. |
- |
|
imServiceAlias |
|
A string correlated to the IM service id which is used during enrollment to identify the service. |
- |
|
ssoServiceAlias |
|
A string correlated to the SSO service id which is used during enrollment to identify the service. |
- |
|
mobileServiceAlias |
|
A string correlated to the mobile service id which is used during enrollment to identify the service. |
- |
Customization elements
|
Property name |
Type |
Description |
Values (default value in bold) |
|---|---|---|---|
|
profileName |
|
A string template capable of holding variables replacement to customize the display of the MFA profile as seen by the user. Ex: “My profile - {object__firstName}” |
- |
|
loginAttribute |
|
A valid attribute definition id. When a mobile enrollment QR code is generated, it will contain:
This last “login” value is obtained by looking at the value of the attribute specified by this property. |
login |
|
enrollmentDelay |
|
Duration of validity for an enrollment link sent by mail. This should be written as an ISO8601 period duration. Ex: “P5D” (5 days validity) |
P5D |
|
maxMobiles |
|
The maximum number of mobile enrollment allowed per user |
3 |
|
maxBrowsers |
|
The maximum number of browsers enrollment allowed per user |
3 |
|
maxStrategy |
|
The action to apply when a maximum devices limit is reached.
Devices quotas are always checked upon enrollment confirmation. If quota is exceeded, the oldest used devices are removed until the quota is met. |
ERROR |
|
loginGenerationParameters |
|
This property allows to modify the login generation. The property is not mandatory but if set, all the sub properties must be declared, namely:
|
null |
|
orphanStrategy |
|
The strategy to adopt when a MFA account was deleted without using Memority delete API. When a user account is normally deleted using the Memority portal, a cleanup is done on the user authentication status and authentication modes to remove his ability to authenticate using MFA. However it is possible that the account was deleted directly on the cloud platform, either by mistake or for maintenance reasons. In this case the policy gives two options to choose from:
|
WARN, CLEANUP |
Advanced configuration
These settings are only relevant for compatibility and exceptional on premise installation of the solution.
|
Property name |
Type |
Description |
|---|---|---|
|
serviceUrl |
|
The URL of the cloud service performing the MFA enrollment |
|
uiIframePluginUrl |
|
The URL of the frontend library (Iframe version) |
|
uiSdkPluginUrl |
|
The URL of the frontend library (SDK version) |
|
uiSdkDomainUrl |
|
The URL on which the SDK frontend plugin will operate on |
|
memorityAppStoreUrl |
|
The URL to the Apple App Store Memority mobile application |
|
memorityPlayStoreUrl |
|
The URL to the Google Play Store Memority mobile application |
|
memorityImageLogo |
|
The image logo to display during the enrollment for use with the Memority mobile application |
|
memorityImageLogoType |
|
The type of the Memority image logo (ex: “PNG”) |
Additionally, if one requires to use a custom mobile application to handle the MFA subscription, these settings can be configured:
|
appStoreUrl |
|
The URL to the Apple App Store custom mobile application |
|
playStoreUrl |
|
The URL to the Google Play Store custom mobile application |
|
imageLogo |
|
The image logo to display during the enrollment for use with the custom mobile application |
|
imageLogoType |
|
The type of the custom application image logo (ex: “PNG”) |
Example
MyMFA policy.pdfMyMFA policy.xml
Certificate configuration
After creating a new Memority MFA Account Policy, 1 Setting must also be configured:
|
Setting name |
Type |
Description |
|---|---|---|
|
idm.myMFAAccountPolicy.<policy id>.authentication.p12 |
|
The Base 64 encoded P12 certificate used for accessing the Memority MFA Account Policy cloud service and the passphrase associated with the certificate |
Handling identity migration
When an identity that was in the scope of a Memority MFA Account policy exit this scope (because the identity was patched and no longer match the policy scope), the following happen:
-
The MFA account is deleted, along with all the enrolled devices.
-
A reserved flag “MYMFA_ACCOUNT_MIGRATION” is positioned on the identity indicating that it has migrated from its former MFA policy. This flag can be handled, for instance, in a business policy to send a new enrollment link to the user. The flag will be cleared upon subsequent patches to the identity.
Read Next
-
Business Policies A Business Policy allows to configure how to trigger actions on Object Types through a Feature with an optional configured Workflow.
-
Object Policies An Object Policy is an Identity Management Service Policy allowing to execute arbitrary actions on Managed Objects, either on a scheduled basis, or in reaction to an Object Operation.
-
Deduplication Policies A Deduplication Policy describes how duplicates should be searched for when creating a managed object.
-
Feature Access Policies A Feature Access Policy is composed of a right which encompasses several Features.
-
Manual Provisioning Policies A Manual Provisioning Policy allows to define that manual provisioning or deprovisioning Workflow is launched when the Role assignment status changes.
-
Object Lifecycle Policies An Object Lifecycle Policy allows to configure rules, on all Object Types, that will alter an Object attribute directly when certain lifecycle events occur.
-
Password Policies A Password Policy determines how passwords should be composed and which rules apply to their lifecycle.
-
Role Request Policies A Role Request Policy allows to define if a Role can be requested, for whom, by whom, and using which Workflow.
-
Workflow Administration Policies A Workflow Administration Policy is composed of a right which encompasses several Features.
-
Memority MFA Account Policies -
Homepage Selection Policies A Memority Home Page Selection Policy allows to configure differents home page depending on user rights.
-
SoD Policies In Memority, SoD rules are based on a SoD policy. A SOD Policy allows to define what kinds of conflicts you can specify and what attributes the system will use to detect them.