---
title: Protecting Tokens with MFA
slug: kronpam-end-user-guide-3-8-1/protecting-tokens-with-mfa
docTags: 
createdAt: 2024-12-11T11:08:56.786Z
---

Kron PAM’s built-in MFA can be used as a secondary layer of authentication for logging into the Kron PAM Mobile Client Application for its online features (Approval Management, Geo-Fencing, and Password Management). 

To enable MFA for Kron PAM Mobile Client Application:

:::hint{type="info"}
1. The user must install the Kron PAM Mobile Client Application and register a token to receive an Offline Token from the Kron PAM Mobile Client Application. (The user gets the Offline Token by navigating to **Offline Token** > **Add **> **Register Token**).  
2. OTP must be enabled for the user group that will be using MFA for Kron PAM Mobile Client Application connections. (See section Multi-Factor Authentication in Kron PAM Reference Guide.) 
3. Navigate to **Administration > System Config. Man. **Set the **mobile.application.otp.enabled** parameter to true. 
:::



After these settings were done and a login operation was started on the Kron PAM Mobile Client Application, the Kron PAM Mobile Client Application will automatically look for a Registered Token in its Offline Tokens with the name that matches the **tfa.otp.issuer** parameter. If there is a registered token with another name (the value of** tfa.otp.issuer**), the Kron PAM Mobile Client Application will prompt the user to change the registered token. The user selects **Yes, **and the page forwards to the token page for entering a new token. If the token is matched with the six-digit value sent to the user, the user can log in. The current six-digit value of the Offline Token is validated with the Kron PAM server, login will be successful.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/9NxMRPeujg4q65ylLP5rb_image.png" size="40" width="273" height="456" position="center" caption="Token mismatch " showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Lcd-pa_chVp6bZ2FZj4Zh_image.png" size="42" width="428" height="491" position="center" caption="Token Code" showCaption="true"}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/g5mG2lkd26UeR9ZfcW8Jv_image.png" size="42" width="466" height="534" position="center" caption="Token mismatch " showCaption="true"}

If there’s no Registered Token in the Kron PAM Mobile Client Application and MFA is enabled with the parameter above, registering a token also requires Multi-Factor Authentication. The system will send a one-time password (OTP) user’s phone number. The user will be asked to enter the OTP on the Kron PAM Mobile Client Application.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/PlfwhIgdcAilZKqQZT8QS_image.png" size="34" width="366" height="599" position="center" showCaption="false"}

:::hint{type="info"}
The Kron PAM Mobile Client  MFA functionality works only with the registered tokens to ensure that the offline tokens are only working in one Kron PAM Mobile Client at a time. 
:::