FAQ
Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform

English

Türkçe

English

Türkçe

Appearance

Basic

How does MFA work in AGS; which methods are available? ​

Short answer

In AGS, the second factor is requested with the MFA step that is added to the access flow after the authentication step; the step is bound to a Multi-Factor Authentication (MFA) profile, and the result continues the flow from the SUCCESS or FAILURE output. MFA Method has three options: Email OTP sends the code to the e-mail address of the user, TOTP generates the code in the authenticator application of the user, and HTTP OTP hands off the delivery of the code to the organization's own service (an SMS gateway, an e-mail service or a custom service) with an HTTP request. The built-in TOTP Standard, TOTP Strict and Email OTP profiles are selected directly in the flow.

How Does It Work? ​

  1. The user passes the Authentication Provider step; the flow reaches the MFA step and the MFA page opens.
  2. The code is generated according to the method: in Email OTP and HTTP OTP, TR7 generates a one-time code and sends it; in TOTP, the user registers the authenticator application with a QR code on the first visit and writes the code from the application at later logins.
  3. If the code is verified, the flow continues from the SUCCESS output; if it cannot be verified, from the FAILURE output.
  4. If Trust Device is on in the profile, the option to mark the device as trusted appears on the MFA page; a user who checks the option is not asked for a code again on the same device for the Trust Duration (default 30 days).

MFA Methods in TR7 ​

MFA MethodHow the code reaches the userBasic settings
Email OTPAn e-mail is sent with the E-mail Settings of TR7OTP Length (4–10, default 6), OTP Type, OTP Expiration (default 5 minutes), Email Source
TOTPGenerated in the authenticator application of the user; there is no deliveryTOTP Algorithm, TOTP Digits, TOTP Period, TOTP Window, Allow Backup Codes (What is TOTP?)
HTTP OTPA request is sent to the HTTP URL address in the profile; Channel is SMS, Email or CustomOTP settings, HTTP request, Success Conditions, Phone Source
  • The profiles are defined on the AGS → Authentication → Multi-Factor Authentication (MFA) screen; in the flow, the built-in profiles are also listed in the MFA Profile selector (built-in profiles).
  • TOTP registrations are kept per vService; they are monitored on the TOTP tab of the vService, and the registration of a user who has lost the phone is reset with Reset TOTP.

Common Misconceptions ​

  • "There is a separate method for sending the code by SMS." SMS is done with a request sent to the SMS gateway of the organization, by selecting Channel = SMS in the HTTP OTP method.
  • "A TOTP registration is valid on all vServices." The registration is bound not to the MFA profile but to the vService; the user makes a separate registration for each AGS-enabled vService.
  • "For Email OTP, the e-mail address of the user is entered manually." The address is taken from the user information in the session or from the source selected with Email Source.
  • "2FA in Management Access also covers AGS users." The Two-factor Authentication (2FA) on the Management Access screen protects only the login to the TR7 management interface (What is the difference between MFA and 2FA?).

How it is done in the documentation

Related questions