Hi All,

I am working on enabling MMFA in the IBM security access manager version 9.0.7

I am able to generate the QR code and registration is happening successfully on device selection, however, after protecting demo application with MMFA and by using  urn:ibm:security:authentication:asf:qrcode_initiate it asks me to verify the authentication on verify app however there is no request coming on the device to approve or reject.

Can anyone let me know what can be the reason for the same?

The url which I am using for authentication through MMFA is:

https://<webseal>/mga/sps/authsvc?PolicyId=urn:ibm:security:authentication:asf:qrcode_initiate&username=username&Target=https://<webseal>/app/mobile-demo/diag

Is there any other way where we can done authentication from Movile verify App?

Thanks 
Rahul Jha

------------------------------
Rahul Jha
------------------------------

Rahul,

If you have successfully registered the device then this rules out most connectivity issues.

If you haven't configured PUSH notifications, then you will have to manually tell the mobile app to check for new transactions.  You can do this my pulling down on the page that shows your registered accounts - or use the "arrows in a circle" icon in the account you want to check (same page as the TOTP code is shown).

If transactions still fail to show, you could check the request.log on the Reverse Proxy to see if you are receiving the transaction lookup from the app and if it is being correctly authenticated (username shows in request log).  If you need more detail, you will need to enable pdweb.snoop trace to see full request from the application and accompanying response.  You could also check for errors/exceptions in the runtime messages.log file.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------

Thanks John,

I was able to see error at connectivity at scim/Me. Issue has been resolved by now. 

Thanks
Rahul Jha

------------------------------
Rahul Jha
------------------------------

Original Message:
Sent: Wed September 02, 2020 01:04 PM
From: Jon Harry
Subject: MMFA in ISAM 9.0.7

Rahul,

If you have successfully registered the device then this rules out most connectivity issues.

If you haven't configured PUSH notifications, then you will have to manually tell the mobile app to check for new transactions.  You can do this my pulling down on the page that shows your registered accounts - or use the "arrows in a circle" icon in the account you want to check (same page as the TOTP code is shown).

If transactions still fail to show, you could check the request.log on the Reverse Proxy to see if you are receiving the transaction lookup from the app and if it is being correctly authenticated (username shows in request log).  If you need more detail, you will need to enable pdweb.snoop trace to see full request from the application and accompanying response.  You could also check for errors/exceptions in the runtime messages.log file.

Jon.

------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------