Multi-factor authentication (MFA) credentials for CICS Explorer connections

Authentication with MFA credentials can enhance sign-on security for CMCI connections to CICS® regions. MFA requires a password or passphrase coupled with a dynamic authentication token to verify the user's identity.

When MFA support is required, the Remote System Explorer (RSE) connection must be used to export CICS bundles to a z/OS® Unix System Services file system directly from CICS Explorer. MFA is not supported for z/OS FTP or z/OSMF connections.

Prerequisites for CICS Explorer sign-on with MFA

Ensure that the WUI region and CMAS are running at the same CICS level that is CICS TS 5.4 with APAR PI87691 or later.
Configure the WUI region to use a CMCI JVM server, as described in Configuring for CICS Explorer sign-on with Multi-Factor Authentication.
Ensure that CICS Explorer is at V5.4.0.4 or later and a CMCI connection is defined.

How to use an MFA credential

You define an MFA credential in a similar way to other connection credentials, except that you do not save a password or passphrase in the credential. For detailed instructions, see

Defining connection credentials in IBM Explorer for z/OS V3.1.1 product documentation.

Figure 1. Creating an MFA credential

Creating an MFA credential in the New Credentials dialogue

When you make a CMCI connection, you are prompted to specify a password or passphrase. In the Password or Passphrase field, you must specify your password or passphrase coupled with an authentication token. Ask your system administrator how to concatenate your password or passphrase and the authentication token.

Figure 2. Prompt upon sign-on with MFA

Signing on with an MFA credential in the Signon dialogue

The token has an expiration period. When it expires, you are prompted to specify your password or passphrase with a new token.

For more information about configuring a CICS Explorer connection to CICS systems, see Configuring a CICS system connection.