Activating a user when SUSPENDED is YES

The suspension threshold limits the number of times a user consecutively fails to provide a valid TOTP code. If the user fails more than this number of times, their SUSPENDED tag is set to YES. The suspension threshold setting is separate and distinct from a RACF® revoked status.

About this task

See Configure AZFTOTP1 for important information regarding the Suspension Threshold setting.

Procedure

  1. Enter the following command to display IBM® MFA information for a user profile, including the suspended state: 
    LISTUSER [Login ID] MFA
    MULTIFACTOR AUTHENTICATION INFORMATION:      
---------------------------------------      
   FACTOR = AZFTOTP1 
   SUSPENDED:YES a            
   FAILCOUNT:0 b                                  
   STATUS = ACTIVE                                 
   FACTOR TAGS =                                   
     REGSTATE:PROVISIONED
    Callout Notes:
    1. The user has exceeded the suspension threshold you set, and the SUSPENDED tag is set to YES.
    2. The user's consecutive failure count is reset to zero.
  2. Enter the following command to reactivate a user for TOTP. 
    ALU [Login ID] MFA(FACTOR(AZFTOTP1) 
TAGS(SUSPENDED:NO))
  3. Enter the following command to confirm that the user is no longer in the suspended state: 
    LISTUSER [Login ID] MFA