Configuring IBM MFA for high availability

In general use, the IBM® MFA web services started task needs to run only on one LPAR in a sysplex. However, you can start the IBM MFA web services started task on multiple LPARs that share the same RACF® database for high availability.

Before you begin

Before you start the IBM MFA web services started task on multiple LPARs, you must satisfy the following prerequisites:
  • Configure cache token sharing to be C or X so that the cache is shared, as described in Configure IBM MFA STC configuration attributes.
  • If using Certificate Authentication, the client Windows system must have the Internet option "Use HTTP 1.1" checked.
  • When ordering server certificates to use with IBM MFA web services, ensure that you specify Subject Alternate Names that cover all LPAR names that a user may enter into their browser to reach the server, as described in Configure an AT-TLS profile.

Procedure

  1. To start the started task, enter the following operator command:
    S <STC Job Name>
    For example:
    S AZF#IN01
  2. Start the started task on the desired LPARs in the sysplex.
  3. Verify that the task started. The absence of errors in the SYSLOG indicates success.