Logging in with a CTC from another system

Your administrator can configure your account for check CTC authentication.

About this task

The in-band check CTC authentication factor allows you to get a cache token credential (CTC) from an IBM® MFA system in one SYSPLEX (called the source) and use it to log in in-band to another IBM MFA system in a different SYSPLEX (called the destination).

To use check CTC authentication, complete the following steps:

Procedure

Open the IBM MFA Out-of-Band web server login page provided by your administrator. You may want to bookmark this URL.
```
https://server-host:port/mfa/policy-name
```
You are prompted for the configured authentication factors.
Follow the web interface to enter the required tokens.

Note: Your administrator determines the maximum amount of time you have to complete all authentication factors, starting from the time you successfully entered your RACF® user name. If you do not complete all authentication factors within this time period, you must start over.
As you successfully enter the required tokens, the IBM MFA Out-of-Band web page prompts you for the next one.

When you have satisfied all of your token requirements, the IBM MFA Out-of-Band web page displays the CTC.

           Cache Token Credential
         You have satisfied the authentication policy.
                       CREDENTIAL
       Click the above Cache Token Credential to copy it to Clipboard, 
       and use this in place of your password to access applications

Manually enter or copy/paste the CTC as your password on the destination system to log on in-band to an application.

Note: If you are using Internet Explorer and use the cache token credential copy feature, be aware that Windows Internet Options settings can affect its function. Specifically, the "Allow Programmatic Clipboard Access" setting in one or more applicable zones can disable this feature or require you to respond to an additional prompt. The "Allow Programmatic Clipboard Access" setting is typically controlled by the system administrator.

On the destination system, IBM MFA validates the cache token credential and allows or denies the logon.