MFA Operator History Query

Exploring

This program lets you view the history of successful MFA authentications for the company.

SYSPRO automatically tracks each time an operator successfully authenticates themselves to SYSPRO through Multi-Factor Authentication and logs which authentication method is used. Its purpose is to assist system administrators in effectively managing system security.

This program is accessed from the Program List of the SYSPRO menu:

  • Program List > Administration > Security

Multi-Factor Authentication (MFA) is the process of identifying a user by validating two or more methods of authentication from independent credential categories. This authentication method ensures that a user is only granted access after successfully presenting two or more pieces of evidence to an authentication mechanism.

The three most commonly used authentication factors are:

  • Knowledge: something only the user knows (e.g. a user name and password, a PIN or answers to security questions).

  • Possession: something the user has (e.g. a smart-phone, Time-based One-time Password (TOTP) or smart card).

  • Inherence (or biometrics): something unique that proves the user's identity (e.g. a fingerprint, iris scan or voice recognition).

The principle of Multi-Factor Authentication is that there is no perfect authentication factor. Any one factor that is implemented will have its strengths and weaknesses. For this reason, the concept of Multi-Factor Authentication is that a second or third factor compensates for the weakness of the other factors and vice-versa.

The Time-based One-Time Password algorithm (TOTP) is an extension of the HMAC-based One-Time Password algorithm (HOTP) which generates a unique one-time password based on the current time.

It has been adopted as Internet Engineering Task Force standard RFC 6238, is the cornerstone of Initiative For Open Authentication (OATH), and is used in a number of two-factor authentication systems.

The one-time password must validate over a range of times between the authenticator and the authenticated because of latency (both network and human) and unsynchronized clocks.

Both the authenticator and the authenticatee compute the TOTP value, then the authenticator checks if the TOTP value supplied by the authenticated matches the locally-generated TOTP value.

Some authenticators allow values that should have been generated before or after the current time in order to account for slight clock skews, network latency and user delays.

Topics

Multi-Factor Authentication

Setup option categories

System Setup

Setup programs

MFA Operator Configuration

Multi-Factor Authentication Setup

Programs

Multi-Factor Authentication Setup

MFA Operator Configuration

Starting

You can restrict operator access to programs by assigning them to groups and applying access control against the group (configured using the Operator Groups program).

The following configuration options in SYSPRO may affect processing within this program or feature, including whether certain fields and options are accessible.

The Setup Options program lets you configure how SYSPRO behaves across all modules. These settings can affect processing within this program.

Setup Options > System Setup > Login

Multi-factor authentication

  • Multi-factor authentication required
  • User applicability

Multi-factor authentication methods

  • Email authentication required
  • Operator can set own email address
  • Email must match pattern
  • Google authenticator required

  • Multi-Factor Authentication is not currently available for the following (i.e. an operator configured for Multi-Factor Authentication won't be able to login to these platforms):

    • SYSPRO Supply Chain Portal

    • SYSPRO Espresso

  • SYSPRO operators cannot be enabled for simultaneous use of Multi-Factor Authentication and:

    • SSO using Active Directory (i.e. the operator is defined as an Active Directory user)
    • Concurrent usage (i.e. the Allow concurrent use of this operator option is enabled against the operator in the Operator Maintenance program)

Solving

The following auditing and logging capabilities are available to ensure that Multi-Factor Authentication is managed and tracked correctly:

The system automatically records when Multi-Factor Authentication is enabled, disabled, suspended or resumed for an operator using the MFA Operator Configuration program.

These entries are stored in the AdmMfaAuthEnabled table and you can use the System Audit Query program to view the history.

This table includes which operator changed the authentication status and the operator that was changed.

The system automatically tracks each operator's configured authentication method when they use the Multi-Factor Authentication Setup program.

These entries are stored in the AdmMfaAuthConfig table.

This program lets you view the history of successful MFA authentications for the company.

SYSPRO automatically tracks each time an operator successfully authenticates themselves to SYSPRO through Multi-Factor Authentication and logs which authentication method is used. Its purpose is to assist system administrators in effectively managing system security.

The entries are stored in the AdmMfaAuthHistory table which records each time an operator successfully logs into SYSPRO using Multi-Factor Authentication. It includes the date and time they were prompted for the additional authentication, as well as the method used to login and the computer name from which this was done. The MFA Operator History Query program lets you view the history.

Although failed login attempts are not currently logged, this will be addressed in a later software release.

When you login as an operator requiring Multi-Factor Authentication, the following rules apply to the AdmOperator table of your system-wide database:

  • The AuthenticationType entry must be M (indicating multi-factor authentication).

  • The OperatorType entry must be N (indicating normal operator).

  • The OperatorStatus entry must be A (indicating active).

  • The operator code cannot be prefixed with underscores (e.g. __BOT)

  • The operator cannot be locked out (i.e. the OperatorLockedOut entry must contain spaces and not an L entry).

An operator code that is configured for Multi-Factor Authentication can't be used to access applications that use e.net.

When disabling Multi-Factor Authentication for an operator, all the MFA-configured information is removed; only the history is retained.

Operators who are disabled for MFA revert to entering the traditional user name and password to access SYSPRO.

Disabling MFA for an operator is useful when that operator no longer requires an additional authentication method to access SYSPRO.

When suspending Multi-Factor Authentication for an operator, the additional authentication is effectively paused; all the MFA-configured information and history is retained.

Operators who are suspended for MFA revert to entering the traditional user name and password to access SYSPRO.

Suspending MFA for an operator is useful when that operator requires temporary suspension from the additional authentication requirement.

For example:

If an operator is configured to use Google authentication and they lose their phone, they can't access SYSPRO to configure or validate another method. Suspending their MFA allows them to do this.

Using

  • Columns in a listview are sometimes hidden by default. You can reinstate them using the Field Chooser option from the context-sensitive menu (displayed by right-clicking a header column header in the listview). Select and drag the required column to a position in the listview header.
  • Press Ctrl+F1 within a listview or form to view a complete list of functions available.

The following describes how a system administrator configures Multi-Factor Authentication in SYSPRO:

  1. From the pane within the System Setup category of the Setup Options program, indicate that Multi-Factor Authentication is required against all, or specific operators.

  2. Use the MFA Operator Configuration program to view and configure additional MFA requirements (e.g. enabling, disabling, suspending or resuming an operator's MFA requirement).

  3. Once MFA is enabled for operators, they are automatically prompted by the Multi-Factor Authentication Setup program when next they login to SYSPRO.

    Operators use this program to configure and validate their preferred authentication method.

  4. Each subsequent login to SYSPRO requires the one-time, time-based pin from the configured MFA method, before the operator's login is validated.

  5. Use the System Audit Query program to review an audit log of all operators enabled for Multi-Factor Authentication.

Referencing

Field Description

Date filter

Indicate the time period for which to display MFA authentication history.

Refresh view

This refreshes the listview information based on your entry at the Date filter field.

This listview includes records for all successful authentications into SYSPRO using Multi-Factor Authentication, based on the filters defined.

This pane provides options that enable you to filter the MFA History listview based on your preferred criteria.

Once you have indicated the criteria on which to filter, select the Apply custom filter function from the pane's toolbar. Alternatively, the Reset function will clear any criteria selected.