Requirements and considerations for Push OTP

• Push OTP is supported in SAS PCE 3.9.1 GA version or later.

• MobilePASS+ Push OTP is supported on the following OS platforms:

  • Android 8.0 or later

  • iOS 14 or later

• MobilePASS 8 does not support Push OTP.

• Network access to use push and grant push permissions is required.

• Thales Push Service cannot guarantee the delivery of a push notification, since this is under the control of the push notification service providers (Apple and Google) and other factors, such as network connectivity.

If a push notification is not delivered, users can always fall back to manual OTP authentication.

For existing customers, a new token must be enrolled on MobilePASS+ to be able to use push.

Application integration

Any application that is integrated through SafeNet RADIUS Service (FreeRADIUS) or SafeNet Agent for AD FS can support Push OTP. Note that the new SafeNet Agent for AD FS must be installed. For additional details, refer to Configure applications for Push OTP section.

Integration guides for Push OTP are available in the knowledge base section of the Customer Support Portal (Knowledge Center > Search the Knowledge Base). These guides describe how to deploy multi-factor authentication (MFA) options in third-party applications using MobilePASS+.

Simple mode is available for all SafeNet RADIUS Service integrations. With simple mode, if Push OTP is enabled, the user can trigger a push notification by leaving the passcode field empty, or by entering any 1-character passcode (excluding s or g if either SMS or GrIDsure tokens are present). Refer to Triggering Push notifications in the agent section.

Deployment considerations

Before deploying MobilePASS+ with Push OTP, consider the following:

• If your users are primarily Android and iPhone users, then deploy MobilePASS+.

• If your apps are listed in the integration table, then deploy MobilePASS+.

• If your users or apps do not, or only possibly, meet the criteria above, then clarify the scope. For example, if your users are iPhone and BlackBerry users, Push OTP is available for only your iPhone users, and BlackBerry users must continue to use MobilePASS 8. If this is acceptable, deploy MobilePASS+ for your iPhone users.

How do I migrate current users?

Existing MobilePASS tokens on MobilePASS 8 cannot be used for MobilePASS+. Users who are currently using MobilePASS tokens need to enroll new MobilePASS tokens on MobilePASS+ to use Push OTP.

You need MobilePASS tokens in inventory to migrate users from MobilePASS 8 to MobilePASS+. After users enroll new tokens in MobilePASS+, you can revoke their tokens in MobilePASS 8, return them to inventory, and then reuse them to migrate more users from MobilePASS 8 to MobilePASS+.

Checklist: Set up Push OTP for new accounts

• You can select one MobilePASS application per OS type. For example, you can enable iOS for either MobilePASS+ or MobilePASS 8, but not both.

  • In the SAS console, select Policy > Token Policies > Software Token & Push OTP Settings > Allowed Targets and Push Notification Settings.
  • Make any changes to the platforms that you want to deploy Push OTP on. They must use MobilePASS+.

• (Optional) Configure user (refer to Set the Push OTP rejection policy (optional))and operator policies for rejected Push notifications (refer to Set the Operator policy).

• Allocate MobilePASS tokens. MobilePASS 8 and MobilePASS+ use the same token type.

• (Optional) Customize the rejection alert for the user and Operator, and the self-enrollment page and email template.

• To configure application integrations to support Push OTP, do one of the following:

  • Install and configure the new SafeNet Agent for AD FS 2.0.

  • Set the combination of RADIUS timeout and retry values to at least 60 seconds for SafeNet RADIUS Service (FreeRADIUS). For example:

    • Multiple NPS servers (backup and failover): Timeout: 60 seconds, Retries: 1
    • Single NPS server: Timeout: 20 seconds, Retries: 3

  • Deploy SafeNet Agent for NPS 2.0.

• Provision MobilePASS tokens to users.

• Users must download the MobilePASS+ app and complete the self-enrollment.

Checklist: Set up Push OTP for existing accounts

• Enable Push OTP. By default, the feature is disabled.

Once enabled, follow the intructiones mentioned in the above checklist. The only difference in setting up Push OTP for existing accounts is you need to enroll a new token on MobilePASS+. You can also revoke (optional) MobilePASS 8 tokens that are no longer needed.