...
Configure the SAML or OIDC identity provider linked to the first factor method to return end user’s email address and/or mobile phone number.
email address is required for the Unregistered SMTP
mobile phone number is required for the Unregistered SMS
Create an attribute mapping to map the attribute names to be exactly as specified below, which is what the Unregistered SMTP and SMS methods expect for the unregistered multi-factor authentication to work. Then link the attribute mapping to your first factor method(s). If the identity provider returns the attributes directly with the expected name, then attribute mapping is not necessary.
Note: If other claims from the first factor method should be passed to your application, they should be added to the attributemapping as well.Code Block # Create new Attribute Mapping with name "attributemapping" and link it to methods PUT /inboundPolicy/attributemapping PUT /inboundPolicy/attributemapping/$link/method/saml.example.1 PUT /inboundPolicy/attributemapping/$link/method/oidc.example.1
Attribute name must be
phone_number
for the mobile phone number.Code Block # Rename method attribute "mobile" as "phone_number" POST /inboundPolicy/attributemapping type=inboundPolicyItem&attributename=phone_number&attributevalue=%7Bmobile%7D
Attribute name must be
email
for the email address.Code Block # Rename method attribute "mail" as "email" POST /inboundPolicy/attributemapping type=inboundPolicyItem&attributename=email&attributevalue=%7Bmail%7D
Set configuration string
mfa true
for the second factor method.Code Block # Note that you need to set also the existing configuration parameters, otherwise # they get overwritten. In below request "configuration:..." is to mark that. PUT /method/unregistered.smtp configuration=mfa%20true&configuration=...
Link the second factor method as the next factor method for the first factor method.
Code Block PUT /method/oidc.1/$link/nextFactor/method/unregistered.smtp
Not possible to set with Management UI.
Link the second factor method to the application site and set it as an allowed method for the application.
Code Block PUT /site/demosite/$link/method/unregistered.smtp PUT /application/demosite/demoapp/$link/method/unregistered.smtp enabled=true
...