Who knows more about protecting Z than Z people?
See the product details for IBM Z Multi-Factor Authentication - Updated for V2.0
IBM Z Multi-Factor Authentication features
Expanded across z/VM operating systems (new in 2.1)
Most features supported on z/OS will work on z/VM all under one license. Order via ShopZ, get both operating systems, choose which one to install, and leverage existing MFA infrastructure.
Protection beyond the z/OS Sysplex Boundary (new in 2.1)
Supports the production of secure credentials that can be used both within and beyond the boundary of the sysplex where the credential was generated. This simplifies MFA configurations in large environments.
Extensions for RACF, ACF2 and TopSecret with auditing and provisioning
Introduce factor extensions to components of IBM RACF®, ACF2 and TopSecret user-related commands. Extend Security Authorization Facility (SAF) programming interfaces to define supported tokens during user authentication requests, enabling MFA-aware applications to specify factors in addition to RACF, ACF2 and TopSecret passwords or phrases. Audit extensions and provision and define MFA tokens using RACF, ACF2 and TopSecret user-related commands.
RADIUS support: RSA, Gemalto and generic
Use any factor based on the RADIUS standard protocol through the IBM Z MFA RADIUS gateway. Support RSA SecurID Token, with time-based algorithm, hard token or software-based tokens. RSA SecureID and Gemalto SafeNet implementations offer more robust and granular messaging.
IBM CIV integration
In addition to the existing factor support, IBM Z MFA includes IBM Cloud Identity Verify (CIV) integration using the CIV RADIUS gateway and IBM Z MFA generic RADIUS protocol factor. CIV integration supports compound in-band authentication, where the CIV-generated OTP can be used with a RACF password or password phrase.
IBM TouchToken and generic TOTP
IBM TouchToken enables user authentication to be directly evaluated on z/OS to ensure a means of enforcing two-factor authentication with no additional off-platform validation. Generic TOTP support includes generic TOTP token applications, including standard-compliant TOTP third-party applications on Android and Microsoft Windows devices.
Enforce compound authentication, where more than one factor is required in the authentication process. Compound in-band authentication requires the user to supply a RACF credential (password or password phrase) in conjunction with a valid MFA credential.
Centralized RACF, ACF2 and TopSecret database support
Store authentication data in the RACF, ACF2 or TopSecret database, define and alter MFA data with RACF, ACF2 or TopSecret commands, and unload non-sensitive MFA fields in the database with DBUNLOAD utility. z/OS® Security Server RACF, ACF2 and TopSecret enablement consists of updates to the database, commands, callable services, logon processing and utilities.
IBM ISAM integration
Initiate authentication via IBM Security Access Manager (ISAM), using the “pick-up One-Time Passcode (OTP) procedure.” Use the OTP is used instead of the password when logging on to z/OS. ISAM integration supports compound in-band authentication, where the ISAM-generated OTP can be used in conjunction with the user's RACF password or passphrase
Native Yubico support
Utilize a variety of Yubikey devices that support the Yubico OTP algorithm. IBM Z MFA does not require an external authentication server, and all OTP evaluation is performed on the z/OS system by the IBM Z MFA started task.
Certificate-based authentication, PIV, CAC card support
Establish the foundation for supporting any certificate-based authentication system. Enable authentication for Personal Identity Verification (PIV) and Common Access Card (CAC) smart cards commonly used in federal government.
Fault tolerance and application exemption
Exempt MFA processing for applications with authentication properties that can prevent MFA from working properly. Define SAF profiles that will mark certain applications as excluded from MFA and allow a user to logon to that application with password, password phrase or PassTicket. Conversely, use SAF profiles to create inclusion policies to ease adoption of MFA for selected users and applications.
Prerequisites for IBM Z MFA:
- z/OS V2.2 Security Server RACF 2.2, or later, with PTFs for MFA support
IBM Z MFA requires:
- RSA Authentication Manager 8.1 for RSA SecurID exploitation
- For SafeNet support, access to an external Gemalto SafeNet Authentication Service server
- Web browser: TLS 1.2 session capable; operates w/ local smart card drivers if smart cards are used
- For generic RADIUS support, access to an external server that supports the RADIUS PAP protocol.
- On-premises ISAM instance V9.0.6, or access to a CIV instance if using this support
- Tokens compatible with either IBM Z MFA supported factors or ISAM
IBM Z MFA requires one of the following Z family servers:
- IBM z14
- IBM z13
- IBM z13s
- IBM zEnterprise EC12 (zEC12)
- IBM zEnterprise BC12 (zBC12)
Expert resources to help you succeed