MFA
Multi-factor authentication: requiring something more than a password, such as a code from a phone or token, before a user can log on.
Also written multi-factor authentication, IBM Z MFA, two-factor authentication, 2FA, TOTP
Multi-factor authentication, MFA, means a user must prove who they are in more than one way. Usually that is something they know, a password, and something they have, such as a phone app that shows a changing code, or a hardware token or smart card.
On z/OS, MFA is provided by IBM Z Multi-Factor Authentication, which works together with RACF. The site decides which users need it. When those users log on, RACF checks the extra factor as well as, or instead of, the password. Several factor types are supported, including time-based codes from authenticator apps and security tokens.
Some setups let the user type the password and the code together in the normal password field, so older applications that only have one password field can still use MFA.
Regulators and auditors increasingly expect MFA for powerful users, such as system programmers and security administrators, and often for everyone. At a site with MFA, keep your token or app available, because without it you cannot log on.
Where can I learn this hands-on?
Right here, at ZedBank. You take a junior job at a simulated bank and learn each part of the work by doing it, with Zed beside you. There's nothing to install.
Start at ZedBankRelated
- RACFThe security manager for z/OS, which decides who may sign on, read a dataset, or run a transaction.
- LogonSigning on to a mainframe system with a user ID and password to start an interactive session.
- Password phraseA long password, up to 100 characters, that RACF accepts in place of a traditional 8-character password.
- RACF user IDA person or program's identity on the system. Short, unique, and the basis of every access decision.
- PassTicketA one-time password substitute that a trusted program creates, so a user can be signed on without sending their real password.