Mobile Client User Guide
Two-Factor Authentication

Protecting Tokens with MFA

2min

Kron PAM’s built-in MFA can be used as a secondary layer of authentication for logging into the Mobile Application for its online features (Approval Management, Geo-Fencing, and Password Manager).

  • Admin and user must install the Kron PAM Mobile App and register a token to receive Offline Tokens with the mobile app. (You get the Offline Tokens from the Offline Token > Add > Register Token menu).   
  • OTP must be enabled for the user group that will be using MFA for Mobile Application connections.

To enable MFA for Mobile Application:

  1. Navigate to Administration > System Config. Man.
  2. Set the mobile.application.otp.enabled parameter as true. After these settings are done and a login operation is started on the mobile application, the application will automatically look for a Registered Token in its Offline Tokens with the name that matches the tfa.otp.issuer parameter. If there are registered tokens with other names, then it will prompt the user to select a registered token. If the current six-digit value of the Offline Token (either the automatically or the manually selected one) is validated with the server, login will be successful. If there’s no Registered Token in the mobile application and MFA is enabled with the parameter above, registering token also requires a Multi Factor Authentication. The system will send a one-time password (OTP) user’s phone number. The user will be asked to enter the OTP on his/her mobile application.
1
Token mismatch

2
Token mismatch

3
Token mismatch


The Mobile Application MFA functionality works only with the registered tokens to ensure that the offline tokens are only working in one application at a time. 



PREVIOUS
Offline Token
NEXT
Two-Factor Authorization
Docs powered by Archbee