IBM Security Z Security

 View Only

 MFA Factor Tags

Joseph Sumi's profile image
Joseph Sumi posted 07/20/26 11:20 AM

Hello - having a problem producing a report for MFA values for users. I want to use the FACTOR TAGS when REGSTATE is OPEN for the FACTOR AZFTOTP1 to produce a report. It seems that mfa_factor_tag_value would need to be parsed to get to the REGSTATE ? Any help would be appreciated.

thanks, Joe 

Rob van Hoboken's profile image
Rob van Hoboken

Hi Joe.

The factor tags are a in a text string, one string for each factor.  To print the tags for each factor, CARLa has the MFA_FACTOR_TAG_VALUE field.  However, this field and the columns of the field are also a repeated fields, so the SELECT command is not really working: by default the SELECT command selects a profile where ANY of the value matches the selection.

To select a user where the MFA_TAG_NAME = REGSTATE and the MFA_TAG_VALUE = OPEN, use the NEWLIST FLATTEN option.  This creates an observation for each NAME/VALUE pair in the repeated group, like so:

newlist type=racf flatten=mfa_tag_name name=MFA_OPEN
  s s=base c=user mfa_tag_name=regstate mfa_tag_value=open
  sortlist profile('Userid',8) name factor_date MFA_FACTOR_TAG_VALUE

We recently implemented a report to track MFA users who declined to complete enrollment of their factor, so, yes, we also have this requirement.  I opened an IDEA to put a report like this into zSecure Admin, please vote for my idea.