Re: Free MFA for IBM i

[Justin Taylor <jtaylor.0ab@xxxxxxxxx>]

It's good to hear that restricted state works.  Of course, the next
question is how to handle MFA for QSECOFR?  Best practice is for admins to
use their own accounts rather than QSECOFR, but you still have to have
QSECOFR.  Do you leave QSECOFR unprotected (Lab Services recommendation
using the old product)?  If you use MFA, where do you put the client
authenticator?


As for time changes (assuming you mean Daylight Savings Time), I assume
both sides will always use UTC.



On Tue, Apr 8, 2025 at 1:13 PM Rob Berendt <robertowenberendt@xxxxxxxxx>
wrote:

> I have had it confirmed directly from the Gods Themselves that this will
> work in restricted state.  It is simply TOTP.  Make sure that your time on
> your IBM i is accurate (see using NTP) and it will match fine with your
> TOTP device. No communication necessary.  I had this same doubt.  I have
> been totally placated.