Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo
back

Push OTP

Requirements and considerations for Push OTP

search

Requirements and considerations for Push OTP

Please Note:

Requirements and considerations for Push OTP

  • Push OTP is supported in SAS PCE 3.9.1 GA version or later.

  • MobilePASS+ Push OTP is supported on the following OS platforms:

    • Android 8.0 or later

    • iOS 14 or later

  • MobilePASS 8 does not support Push OTP.

  • Network access to use push and grant push permissions is required.

  • SAS cannot guarantee the delivery of a push notification, since this is under the control of the push notification service providers (Apple and Google) and other factors, such as network connectivity.

If a push notification is not delivered, users can always fall back to manual OTP authentication.

For existing customers, a new token must be enrolled on MobilePASS+ to be able to use push.

Application integration

Any application that is integrated through SafeNet RADIUS Service (FreeRADIUS) or SafeNet Agent for AD FS can support Push OTP. Note that the new SafeNet Agent for AD FS must be installed. For additional details, refer to Configure applications for Push OTP.

Integration guides for Push OTP are available in the knowledge base section of the Customer Support Portal (Knowledge Center > Search the Knowledge Base). These guides describe how to deploy multi-factor authentication (MFA) options in third-party applications using MobilePASS+ managed by SAS.

Simple mode is available for all SafeNet RADIUS Service integrations. With simple mode, if Push OTP is enabled, the user can trigger a push notification by leaving the passcode field empty, or by entering any 1-character passcode (excluding s or g if either SMS or GrIDsure tokens are present). Refer to Triggering Push notifications in the agent section.

Deployment considerations

Before deploying MobilePASS+ with Push OTP, consider the following:

  • If your users are primarily Android and iPhone users, then deploy MobilePASS+.

  • If your apps are listed in the integration table, then deploy MobilePASS+.

  • If your users or apps do not, or only possibly, meet the criteria above, then clarify the scope. For example, if your users are iPhone and BlackBerry users, Push OTP is available for only your iPhone users, and BlackBerry users must continue to use MobilePASS 8. If this is acceptable, deploy MobilePASS+ for your iPhone users.

How do I migrate current users?

Existing MobilePASS tokens on MobilePASS 8 cannot be used for MobilePASS+. Users who are currently using MobilePASS tokens need to enroll new MobilePASS tokens on MobilePASS+ to use Push OTP.

You need MobilePASS tokens in inventory to migrate users from MobilePASS 8 to MobilePASS+. After users enroll new tokens in MobilePASS+, you can revoke their tokens in MobilePASS 8, return them to inventory, and then reuse them to migrate more users from MobilePASS 8 to MobilePASS+.

Checklist: Set up Push OTP for new accounts

Checklist: Set up Push OTP for existing accounts

Once enabled, follow the intructiones mentioned in the above checklist. The only difference in setting up Push OTP for existing accounts is you need to enroll a new token on MobilePASS+. You can also revoke (optional) MobilePASS 8 tokens that are no longer needed.