Memority MFA Account Policies

id

String

The identifier is the unique identifier of each Memority MFA Account Policy.

It is case sensitive and no special characters (except - or _) are allowed.

-

name

String

The Memority MFA Account Policy name.

-

active

Boolean

Allows to define if the Memority MFA Account Policy is activated or not.

ON, OFF

description

String

Allows to describe the purpose of the Policy.

-

priority

Integer

Indicates the priority of this policy when resolving which policy to apply on an Identity (1 having more precedence).

If the Object is part of the Scope of several Policies, the Policy with the highest priority (the lowest value) will be taken into account.

1, 2, 3...

scope

-

Allows to configure on which Identities the policy will be applied.

-

serviceId

Integer

A technical identifier provided by the cloud platform infrastructure to target a specific MFA service.

-

imServiceAlias

String

A string correlated to the IM service id which is used during enrollment to identify the service.

-

ssoServiceAlias

String

A string correlated to the SSO service id which is used during enrollment to identify the service.

-

mobileServiceAlias

String

A string correlated to the mobile service id which is used during enrollment to identify the service.

-

profileName

String

A string template capable of holding variables replacement to customize the display of the MFA profile as seen by the user.

Ex: “My profile - {object__firstName}”

-

loginAttribute

String

A valid attribute definition id.

When a mobile enrollment QR code is generated, it will contain:

• The MFA activation code

• The tenant id

• The “login” of the user

This last “login” value is obtained by looking at the value of the attribute specified by this property.

login

enrollmentDelay

String

Duration of validity for an enrollment link sent by mail. This should be written as an ISO8601 period duration.

Ex: “P5D” (5 days validity)

P5D

maxMobiles

Integer

The maximum number of mobile enrollment allowed per user

3

maxBrowsers

Integer

The maximum number of browsers enrollment allowed per user

3

maxStrategy

Enum

The action to apply when a maximum devices limit is reached.

• ERROR (an error is displayed to the user)

• AUTO (the oldest used device is replaced before enrollment)

• AUTO_AFTER (the oldest used device is replaced after enrollment)

Devices quotas are always checked upon enrollment confirmation. If quota is exceeded, the oldest used devices are removed until the quota is met.

ERROR

loginGenerationParameters

Object

This property allows to modify the login generation.

The property is not mandatory but if set, all the sub properties must be declared, namely:

• loginTemplate: Takes a template in the form “{object.id}-{random.value}” which will be used for the login

• platformPrefix: a prefix for all logins

null

orphanStrategy

Enum

The strategy to adopt when a MFA account was deleted without using Memority delete API.

When a user account is normally deleted using the Memority portal, a cleanup is done on the user authentication status and authentication modes to remove his ability to authenticate using MFA.

However it is possible that the account was deleted directly on the cloud platform, either by mistake or for maintenance reasons. In this case the policy gives two options to choose from:

• WARN: Warn the user on the portal but keep the MFA login and authentication mode. The user will likely need to contact an administrator to sort the issue, or reset his account.

• CLEANUP: Cleanup the user. He will be in the same situation as a user who never had a MFA account. The user will need to perform an enrollment as a first time user.

WARN, CLEANUP

serviceUrl

String

The URL of the cloud service performing the MFA enrollment

uiIframePluginUrl

String

The URL of the frontend library (Iframe version)

uiSdkPluginUrl

String

The URL of the frontend library (SDK version)

uiSdkDomainUrl

String

The URL on which the SDK frontend plugin will operate on

memorityAppStoreUrl

String

The URL to the Apple App Store Memority mobile application

memorityPlayStoreUrl

String

The URL to the Google Play Store Memority mobile application

memorityImageLogo

String

The image logo to display during the enrollment for use with the Memority mobile application

memorityImageLogoType

String

The type of the Memority image logo (ex: “PNG”)

appStoreUrl

String

The URL to the Apple App Store custom mobile application

playStoreUrl

String

The URL to the Google Play Store custom mobile application

imageLogo

String

The image logo to display during the enrollment for use with the custom mobile application

imageLogoType

String

The type of the custom application image logo (ex: “PNG”)

idm.myMFAAccountPolicy.<policy id>.authentication.p12

BinarySecretWithPassword

The Base 64 encoded P12 certificate used for accessing the Memority MFA Account Policy cloud service and the passphrase associated with the certificate