Your suggested change has been received. Thank you.

close

Suggest A Change

https://thales.na.market.dpondemand.io/docs/dpod/services/kmo….

Thales Logo
back

Push OTP

Requirements and considerations for push OTP

search

Requirements and considerations for push OTP

Requirements and considerations for push OTP

  • Push OTP is supported in STA.

  • MobilePASS+ Push OTP is supported on the following OS platforms:

    • Android 4.0 or later

    • iOS 8 or later

  • MobilePASS 8 does not support Push OTP.

  • Network access to use push and grant push permissions is required.

  • STA cannot guarantee the delivery of a push notification, since this is under the control of the push notification service providers (Apple and Google) and other factors, such as network connectivity.

If a push notification is not delivered, users can always fall back to manual OTP authentication.

For existing customers, a new token must be enrolled on MobilePASS+ to be able to use push.

Application integration

Any application that is integrated through SafeNet RADIUS Service (FreeRADIUS), SafeNet SAML Service, or SafeNet Agent for AD FS can support Push OTP. Note that the new SafeNet Agent for AD FS must be installed. For additional details, refer to Configure applications for push OTP.

Integration guides for Push OTP are available in the knowledge base section of the Customer Support Portal. These guides describe how to deploy multi-factor authentication (MFA) options in third-party applications using MobilePASS+ managed by STA.

Simple mode is available for all SafeNet RADIUS Service integrations. With simple mode, if Push OTP is enabled, the user can trigger a push notification by leaving the passcode field empty, or by entering any 1-character passcode (excluding s or g if either SMS or GrIDsure tokens are present). Refer to Triggering push notifications in the agent.

Deployment considerations

Before deploying MobilePASS+ with Push OTP, consider the following:

  • If your users are primarily Android and iPhone users, then deploy MobilePASS+.

  • If your apps are listed in the integration table, or integrated using SAML, then deploy MobilePASS+.

  • If your users or apps do not, or only possibly, meet the criteria above, then clarify the scope. For example, if your users are iPhone and BlackBerry users, Push OTP is available for only your iPhone users, and BlackBerry users must continue to use MobilePASS 8.

  • If this is acceptable, deploy MobilePASS+ for your iPhone users.

  • How do I migrate current users?

    Existing MobilePASS tokens on MobilePASS 8 cannot be used for MobilePASS+. Users who are currently using MobilePASS tokens need to enroll new MobilePASS tokens on MobilePASS+ to use Push OTP.

    You need MobilePASS tokens in inventory to migrate users from MobilePASS 8 to MobilePASS+. After users enroll new tokens in MobilePASS+, you can revoke their tokens in MobilePASS 8, return them to inventory, and then reuse them to migrate more users from MobilePASS 8 to MobilePASS+.

Token types and licenses

There is no difference between MobilePASS+ and MobilePASS 8 token types in terms of commercial license and pricing, allocations, provisioning tasks, and auto-provisioning rules.

Checklist: Set up push OTP for new accounts

MobilePASS application

You can select one MobilePASS application per OS type. For example, you can enable iOS for either MobilePASS+ or MobilePASS 8, but not both.

  • In the STA Token Management console, select Policy > Token Policies > Allowed Targets and Push Notification Settings.

  • Make any changes to the platforms that you want to deploy Push OTP on. They must use MobilePASS+.

See Enable the allowed targets and push notifications.

(Optional) Policies for rejected push notifications

(Optional) Configure user and operator policies for rejected push notifications.

See Set the push OTP rejection policy (optional).

See Set the operator policy.

Allocate MobilePASS tokens

Allocate MobilePASS tokens. MobilePASS 8 and MobilePASS+ use the same token type.

(Optional) Rejection alert messages

(Optional) Customize the user and operator push notification rejection alert messages, and the self-enrollment page and email template.

See Customize the rejection alert for the user and Customize the rejection alert for the internal operator.

See Customize the self-enrollment page and email template.

Application integrations

To configure application integrations to support Push OTP, do one of the following:

  • Install and configure the new SafeNet Agent for AD FS 2.0.

  • Set the combination of RADIUS timeout and retry values to at least 60 seconds for SafeNet RADIUS Service (FreeRADIUS). For example:

    • Multiple NPS servers (backup and failover): Timeout: 60 seconds, Retries: 1

    • Single NPS server: Timeout: 20 seconds, Retries: 3

    • Configure SAML services to display Push OTP user controls on the Login page.

    • Deploy SafeNet Agent for NPS 2.0.

See Configure applications for push OTP

Provision MobilePASS tokens to users.

Users must download the MobilePASS+ app and complete the self-enrollment.

See Token management and enrollment and the MobilePASS+ documentation.

Checklist: Set up push OTP for existing accounts

Enable Push OTP

By default, the feature is disabled.

See Enable the allowed targets and push notifications.

Select targets

You can select one MobilePASS application per OS type. For example, for iOS you can enable either MobilePASS+ or MobilePASS 8, but not both.

  1. In the STA Token Management console, select Policy > Token Policies > Allowed Targets and Push Notification Settings.

  2. Make any changes to the platforms that you want to deploy Push OTP on.

See Enable push OTP and MobilePASS+.

Push rejection policies (Optional)

Configure user and operator policies for rejected push notifications.

See Enable push OTP and MobilePASS+ and Set the operator policy.

Allocate additional MobilePASS tokens.

MobilePASS 8 and MobilePASS+ use the same token type.

Revoke MobilePASS 8 tokens that are no longer needed (Optional)

Enroll a new token on MobilePASS+ to use Push OTP.

Push rejection alerts (Optional)

Customize the user and operator push notification rejection alert messages, the self-enrollment page, and the email template.

See Customize the rejection alert for the user, Customize the rejection alert for the internal operator, and Customize the self-enrollment page and email template.

Configure applications

To configure application integrations to support Push OTP, do one of the following:

  • Install and configure the new SafeNet Agent for AD FS 2.0.

  • Set the combination of RADIUS timeout and retry values to at least 60 seconds for SafeNet RADIUS Service (FreeRADIUS). For example:

    • Multiple NPS servers (backup and failover): Timeout: 60 seconds, Retries: 1

    • Single NPS server: Timeout: 20 seconds, Retries: 3

  • Configure SAML services to display Push OTP user controls on the Login page.

  • Deploy SafeNet Agent for NPS 2.0.

See Configure applications for push OTP.

User self-enrollment

Users must download the MobilePASS+ app and complete the self-enrollment.

See Token management and enrollment and the MobilePASS+ documentation.