Re: Navigator for i

Well, TFA for initial network access is a common requirement but not all access to applications and data across the network is of the same sensitivity and not all access is made with the same credentials. Re-verifying identity for access to more sensitive functions and with tighter timeouts helps overcome some of the disadvantages of SSO and cached credentials (pc on but no one at the desk for one). Another case is the use of shared profiles where, for example, 2 people have the password for QSECOFR (I'm not advocating for this but it's not uncommon) but you want to audit who actually was using this profile, TFA can identify and log the user behind the approving device.

On 7/20/2020 5:55 PM, Michael Quigley - Sec wrote:

This brings up an interesting point. Console access for PCI (and other) compliance reasons generally dictate two-factor authentication. But I've always viewed that as required to get onto the network from where the access is made. If someone is local to the system, I figure they have their password and then they have themselves (being physically present. Am I taking too simplistic of a take on TFA for Navigator?

Michael Quigley
Computer Services
The Way international
www.TheWay.org

-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf
Of Tim Bronski
Sent: Monday, July 20, 2020 8:37 AM
To: Midrange Systems Technical Discussion <midrange-
l@xxxxxxxxxxxxxxxxxx>
Subject: Navigator for i

I'm trying to figure out if it's possible to extend/customize the "Navigator
for i" logon dialog. I'm trying to add a TFA component. Maybe this is a
question for someone like Tim Rowe? Any suggested starting points? I've
been all over google.

Tim