Most features supported on z/OS will work on z/VM all under one license. Order via ShopZ, get both operating systems, choose which one to install, and leverage existing MFA infrastructure.
Protection beyond the z/OS Sysplex Boundary (new in 2.1)
Supports the production of secure credentials that can be used both within and beyond the boundary of the sysplex where the credential was generated. This simplifies MFA configurations in large environments.
Extensions for RACF with auditing and provisioning
Introduce factor extensions to components of IBM RACF® user-related commands. Extend Security Authorization Facility (SAF) programming interfaces to define supported tokens during user authentication requests, enabling MFA-aware applications to specify factors in addition to RACF passwords or phrases. Audit extensions and provision and define MFA tokens using RACF user-related commands.
RADIUS support: RSA, Gemalto and generic
Use any factor based on the RADIUS standard protocol through the IBM Z MFA RADIUS gateway. Support RSA SecurID Token, with time-based algorithm, hard token or software-based tokens. RSA SecureID and Gemalto SafeNet implementations offer more robust and granular messaging.
IBM CIV integration
In addition to the existing factor support, IBM Z MFA includes IBM Cloud Identity Verify (CIV) integration using the CIV RADIUS gateway and IBM Z MFA generic RADIUS protocol factor. CIV integration supports compound in-band authentication, where the CIV-generated OTP can be used with a RACF password or password phrase.
IBM TouchToken and generic TOTP
IBM TouchToken enables user authentication to be directly evaluated on z/OS to ensure a means of enforcing two-factor authentication with no additional off-platform validation. Generic TOTP support includes generic TOTP token applications, including standard-compliant TOTP third-party applications on Android and Microsoft Windows devices.
Compound authentication
Enforce compound authentication, where more than one factor is required in the authentication process. Compound in-band authentication requires the user to supply a RACF credential (password or password phrase) in conjunction with a valid MFA credential.
Centralized RACF database support
Store authentication data in the RACF database, define and alter MFA data with RACF commands, and unload non-sensitive MFA fields in the RACF database with DBUNLOAD utility. z/OS® Security Server RACF enablement consists of updates to the RACF database, RACF commands, callable services, logon processing and RACF utilities.
IBM ISAM integration
Initiate authentication via IBM Security Access Manager (ISAM), using the “pick-up One-Time Passcode (OTP) procedure.” Use the OTP is used instead of the password when logging on to z/OS. ISAM integration supports compound in-band authentication, where the ISAM-generated OTP can be used in conjunction with the user's RACF password or passphrase
Native Yubico support
Utilize a variety of Yubikey devices that support the Yubico OTP algorithm. IBM Z MFA does not require an external authentication server, and all OTP evaluation is performed on the z/OS system by the IBM Z MFA started task.
Certificate-based authentication, PIV, CAC card support
Establish the foundation for supporting any certificate-based authentication system. Enable authentication for Personal Identity Verification (PIV) and Common Access Card (CAC) smart cards commonly used in federal government.
Fault tolerance and application exemption
Exempt MFA processing for applications with authentication properties that can prevent MFA from working properly. Define SAF profiles that will mark certain applications as excluded from MFA and allow a user to logon to that application with password, password phrase or PassTicket. Conversely, use SAF profiles to create inclusion policies to ease adoption of MFA for selected users and applications.
Prerequisites for IBM Z MFA:Technical details
Technical specifications
Software requirements
IBM Z MFA requires:
- RSA Authentication Manager 8.1 for RSA SecurID exploitation
- For SafeNet support, access to an external Gemalto SafeNet Authentication Service server
- Web browser: TLS 1.2 session capable; operates w/ local smart card drivers if smart cards are used
- For generic RADIUS support, access to an external server that supports the RADIUS PAP protocol.
- On-premises ISAM instance V9.0.6, or access to a CIV instance if using this support
- Tokens compatible with either IBM Z MFA supported factors or ISAM
Hardware requirements
IBM Z MFA requires one of the following Z family servers:
- IBM z14
- IBM z13
- IBM z13s
- IBM zEnterprise EC12 (zEC12)
- IBM zEnterprise BC12 (zBC12)
IBM Security Access Manager IBM Security Access Manager helps you simplify your users' access while more securely adopting web, mobile, IoT and cloud technologies. It can be deployed on-premises, in a virtual or hardware appliance or containerized with Docker. ISAM helps you strike a balance between usability and security through the use of risk-based access, single sign-on, integrated access management control, identity federation and mobile multi-factor authentication. Take back control of your access management with IBM Security Access Manager. Learn more IBM Cloud Identity IBM Cloud Identity helps secure user productivity with cloud-delivered Single Sign-On (SSO), multifactor authentication, and lifecycle management. It comes with thousands of pre-built connectors to help you quickly provide access to popular SaaS apps and pre-built templates to help integrate in-house apps.You may also be interested in
Which of the following processes is used to prove a user's identity?
What is the name of the process of submitting and checking credentials to validate or prove user identity?
What are the two types of groups Microsoft systems provide?
Which of the following is included in an access token select two?