Key components and information for end-to-end external MFA integration

MFA provider

The configuration that represents the Verify public projection of an external MFA provider integration. At run time, this component acts as an API client. Requests and responses are sent through a real-time webhook.

Real-time webhook

Provides the secure authenticated internet connection and the HTTPS client to a target external MFA provider. Designate the webhook as the API contract enforcement point. The webhook mediates the request and responses that are sent between the internal component of Verify and the target external MFA provider.

MFA Provider information

A Verify MFA provider represents the Verify conceptualization of an external MFA provider. It defines what MFA factor capabilities are exposed and how Verify users are identified and resolved in the target MFA provider. An MFA provider configuration is shown in the following example.

{
    "name": "The Provider Name",
    "description": "ISV - External Provider Integration",
    "enabled": true,
    "credentialPrefix": "emfa",
    "webhookId": "{{webhook.id}}",
    "uniqueNameAttribute": "{{unique.name.attribute}}",
    "capabilities": [
        "mobile_otp",
        "mobile_bio",
        "custom_totp"
    ]
}

The following table shows the key configuration attributes.

Webhook information

A real-time webhook configuration must be associated with an MFA Provider configuration. The real-time webhook provides the technical runtime integration between ISV and the target MFA provider service. Ideally, the webhook is also the point at which the external MFA contract is enforced and therefore acts as an API and protocol mediator between ISV and the target MFA provider. The key mechanisms by which webhooks support the ability to enforce API contract and mediation are "resources" and "transformations". For external MFA support and integration, the definition of "resources" must match the ISV external MFA API contract.

{
    "name": "Some MFA Provider",
    "type": "realtime",
    "urls": ["https://some.address.com"],
    "authentication": {
        "type": "oauth",
        "oauth": {
            "client_id": "some_client_id",
            "client_secret": "some_client_secret",
            "token_endpoint": "https://some.address.com/token",
            "token_endpoint_auth_method": "client_secret_basic"
        }
    },
    "resources": {
        "enrollments": {
            "suffix": "/v1/enrollments",
            "method": "GET",
            "transform": {
                "outgoing": (CEL TRANSFORM),
                "incoming": (CEL TRANSFORM)
            }
        },
        "initiate": {
            "suffix": "/v1/mfa",
            "method": "POST",
            "expectedStatus": [201]
            "transform": {
                "outgoing": (CEL TRANSFORM),
                "incoming": (CEL TRANSFORM)
            }
        },
        "validate": {
            "suffix": "/v1/mfa",
            "method": "POST",
            "transform": {
                "outgoing": (CEL TRANSFORM),
                "incoming": (CEL TRANSFORM)
            }
        },
        "custom_totp_1": {
            "suffix": "/v1/mfa",
            "method": "POST",
            "transform": {
                "outgoing": (CEL TRANSFORM),
                "incoming": (CEL TRANSFORM)
            }
        },
        "result": {
            "suffix": "/v1/mfa/transactions",
            "method": "GET",
            "transform": {
                "outgoing": (CEL TRANSFORM),
                "incoming": (CEL TRANSFORM)
            }
        }
    },
    "purpose": ["external_mfa"]
}