Support for Multi-Factor Authentication Attribute Management
The SailPoint connector for RACF can update Multi-Factor Authentication (MFA) attributes.
Prerequisites
- Apply PTFs (FSD0167 and FSD0168) on the agent.
- In the MFA Out of Band Policy section of the source UI, configure
MFA.OOBPOLICY - In the Special Account Attributes section of the source UI, configure
MFA.MAP.<factor-name>.<IBM-factor-name>
Supported Features
- Account aggregation
- Get User: Get MFA data
- Create User: Set MFA attributes while creating user
- Update User: Update MFA attributes while updating user
- Add or remove factors assigned to the user
- Add or remove policies assigned to the user
Account Attributes
To manage MFA attributes, add the attributes in the following table to the account schema. Adding the account attributes in the following table (as applicable) to the provisioning request also enables you to provision MFA attributes for RACF users.
| Account Attribute | Description | Attribute Type |
|---|---|---|
| MFA.ENABLE | Indicates if MFA is enabled for the user. Value: Y/N. | Single-value |
| MFA.PWFALLBACK | Indicates if a user can use a traditional password for authentication when MFA authentication fails. Value: Y/N | Single-value |
| MFA.FACTORS | Factors assigned to the user | Multi-value, Entitlement |
| MFA.POLICIES | Policies assigned to the user | Multi-value, Entitlement |
| MFA.<factor-name>.ACTIVE | For each factor, indicates if it is active for the RACF user. Value: Y/N | Single-value |
| MFA.<factor-name>.TAG.<tag-attribute> | Each factor has its own tag attributes. Each attribute that must be included in the aggregation must be individually added to the account schema. Value: the value of the tag | Single-value |
Caution
Provisioning MFA.Enable=N with additional attribute settings is not supported.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.