MFA Server - User portal and mobile app web server should be installed where?

Hi. We are in the process of testing the Multi-Factor Auth server and are currently using it for two-factor authentication to RDS for a couple of users. At the moment we are only using the phone call/text options but I'd like to get the mobile app portion
working to test.  Also still need to implement the user self-service portal for testing.
Currently I have a vm that was dedicated to MFA where the Multi-Factor Authentication Server software was installed.  Now though I'm a bit confused as to if its safe to install the user portal and mobile app web service portion on this same machine
or if they should go on a different server(s)?  Currently the box is internal but I'm guessing if it has also act as the web server we would stick it behind the TMG for external inbound access.  Is external access to the primary MFA server ok? 
What's the best practice for separation of the MFA roles; or is there none and its fine to just put it altogether? 
Thanks.

Hello Col. Forbin,
Thanks for posting here!
You have a dedicated MFA server and if you install User Portal on the same server as the MFA Server, it uses RPC to communicate with the MultiFactorAuth service locally.
If the User Portal is installed on a different server, it must connect via the Web Service SDK. You can use either a username/password of a service account that is a member of the PhoneFactor
Admins security group, or you can configure client certificates. If using the username/password, you can encrypt the appSettings section of the web.config file if desired.
Under Inetpub\wwwroot\MultiFactorAuth when you edit the web.config file you need to make sure these values are set.
USE_WEB_SERVICE_SDK:
true
WEB_SERVICE_SDK_AUTHENTICATION_USERNAME: domain\user
WEB_SERVICE_SDK_AUTHENTICATION_PASSWORD:
password
OVERRIDE_PHONE_APP_WEB_SERVICE_URL: 
You might want to refer this thread link:
https://social.msdn.microsoft.com/Forums/en-US/ad1f6fc1-ab3f-482d-a435-e4fd6665f640/mfa-user-portal-issue?forum=windowsazureactiveauthentication
Additional reference links:
https://technet.microsoft.com/en-us/library/dn376347.aspx#multifactor
https://pfweb.phonefactor.net/install/6.2.1.16387/release_notes.txt
Let me know if you have any further questions!
Regards,
Sadiqh Ahmed

Similar Messages

  • Planning App Web Server changed.

    Hello gurús!
    I´m in a big issue. In my org, we have 3 physical servers with 3 servers installed: Essbase, Shared Services and Planning. The problem is that we cloned that servers to virtual machines to duplicate these servers. We want to reconfigure that virtualized servers to work like that physical servers. Essbase and Shared Services was reconfigured succefully, but planning had problems with Web Logic licence. For that, we decided to change app web server from web logic to apache tomcat 5. After that, we reconfigure planning using the same instance, data sources and application that were in the source physical server. But it doesn´t work, because planning does not connect with apllications, and Workspace doesn´t not work properly. It only listen at port 45000 and did not at 19000 (like in physical server). Also, workspace cannot connect with planning (if we want to create a planning application it throws these errors: "Invalid or not find module configuration", "Required application module HyperionPlanning.planning is not configured. Please contact your administrator.", "Comunication Error".
    Also, when I start workspace from Start->Programs->Hyperion.... In server console it throws a that Warning: "Please initialize the log4j System Properly". This maybe the reason because planning and workspace doesnt write any logs?
    Thanks for your time floks.
    Best regards,
    Fabián

    What did you do to clone, use a P2V vm conversion? What about hostnames and dns names ? Personally I don't believe trying to clone is a good idea.
    Cheers
    John
    http://john-goodwin.blogspot.com/

  • Using Flash to develop to games and mobile apps

    This semester I registered for an online course called Motion Graphics with my college.
    The course was supposed to be an introduction to Adobe Flash and Adobe After Effects.
    I signed up for the class specifically because I wanted to learn Adobe Flash to create games and mobile apps.
    Unfortunately, it turns out that as of this semester my college is phasing out Adobe Flash from all of its courses,
    and the course I signed up for is now only teaching After Effects and won't be teaching Flash at all.
    I asked the course instructor about this, and she said it was because "flash can no longer work with creating many "apps" and other applications do not except flash." [sic]
    Is this even a factual statement?
    My college still offers several Java-related courses, but I really would have preferred to learn Flash and ActionScript instead.
    I suppose my primary question here is:
    Would it be better to learn Flash or to learn Java to create apps and games that can run on all of the most common platforms (e.g. Android, iOS, Windows)?

    To be on topic, the course is about "motion graphics", and After Effects is an excellent, highly used tool in that trade. When creating video, Flash is used much less because it's very inferior. Again, in "motion graphics". With a robust expression scripting language in After Effects, Flash lost its footing in this department. Flash was probably only previously part of that course to deploy your video to the web, but it's not necessary or desirable due to (as kglad mentioned) Adobe discontinued Flash Player for mobile. Your target just changed to outputting MP4.
    What you want to do, make apps, is a completely different world. Adobe AIR SDK is a great, frequently updated runtime that I've made dozens of apps with. Java is used with the Android SDK to make native Android apps. Objective-C with Xcode and the iOS SDK is used to make native iOS apps. Visual Studio and Azure (or HTML5/JS/CSS) are used to make Windows apps. The big difference here is the AIR SDK can get a good return on investment from re-using most of the code base of your app (depending on its type) by its scripting language porting to Android, iOS (and I think still Blackberry tabs), not Windows however.
    If you want to make apps, you took the wrong class.
    There are numerous frameworks out there similar to AIR that can deploy to multiple targets that are worth consideration on their own. From specific frameworks (like game-oriented) such as Unity to extremely abstract (used for anything) like Phonegap and standard HTML5 web development.
    I haven't used Flash to make anything like a website in almost a decade. It's strictly been device apps, desktop apps, kiosks and product demonstrations. It's an extremely capable IDE for just about everything, except modern motion graphics.

  • Help for Installing PHP and Sun One Web Server

    Hi
    I tried to install PHP 5.1.4 and Sun One Web Server 6.1. I am not able to complete this and got stuck. All the available materials in net seems to flow above my head.
    It will be very helpful if someone could let me know the step by step configuration a bit brief for the same.
    Thanks in advance
    Kathirvel Balakrishnan

    Hi Craig
    I am following these steps,
    1st step : Installing PHP on the WindowsNT server (NT users only)
    Copy the php files on your server
    Get the php zip file
    Copy the php files under a directory (for example : d:php4)
    (be careful don't use c:Program Filesphp because of the space between Program and Files
    copy php4ts.dll to c:winnt and msvcrt.dll if you don't already have it on your system
    Edit php.ini-dist
    rename php.ini-dist to php.ini
    Edit php.ini : Indicate in which directory you have copied youre php files. (extension_dir = d:php4extensions ; directory in which the loadable extensions (modules) reside.)
    copy php.ini in winnt directory (php.ini is parsed in my config)
    Matthias Kramer told me that he had to move php.ini to <path-to-netscape-server>/https-servername/config for it to be parsed
    Make a file association under Windows NT
    In a DOS Window, type assoc .php=PHPScript
    ftype PHPScript=d:php4php.exe %1 %*
    Test the 1st step
    Create a C:test.php file with a single line like <? echo("Nothing to write"); ?>
    Create a C:test.bat file with 2 lines test.php
    pause
    double-clic on test.bat
    If you see something like X-Powered-By: PHP/4.0.3
    Content-type: text/html
    Nothing to write
    then the NT association works!!
    2nd step : Configuring Netscape Enterprise Server or iPlanet for PHP4 with nsapi (NT & UNIX)
    Unix users only
    Compile PHP as follows: ./configure --with-nsapi=/usr/local/netscape/server4 --enable-libgcc
    make
    make install
    Add LD_LIBRARY_PATH=<libdir> to your Netscape server startup script
    where <libdir> is the full path to the directory where libstdc++.so.2.10.0 is located (usually /usr/local/lib)
    Add a mime-type to the Netscape Server
    In the Netscape Administration console chose Preferences|Mime Types
    Add a new type called magnus-internal/x-httpd-php for exts=php
    Click here for screenshot
    Stop your Web Server
    Make a copy of obj.conf located in: <path-to-netscape-server>/https-servername/config
    Modify obj.conf
    There are several section in obj.conf
    At the end of the Init section of obj.conf (necessarely after mime type init),
    place this two lines For NT users
    Init fn="load-modules" funcs="php4_init,php4_close,php4_execute,php4_auth_trans" shlib="d:/php4/sapi/php4nsapi.dll"
    Init fn="php4_init" errorString="Failed to initialise PHP!"
    For Unix users
    Init fn="load-modules" funcs="php4_init,php4_close,php4_execute,php4_auth_trans" shlib="/usr/local/netscape/server4/bin/libphp4.so"
    Init fn="php4_init" errorString="Failed to initialise PHP!"
    In The < Object name="default" > section,
    place this line (necessarely after all 'ObjectType' and before all 'AddLog' lines) Service fn="php4_execute" type="magnus-internal/x-httpd-php"
    Add a new object called x-httpd-php <Object name="x-httpd-php">
    ObjectType fn="force-type" type="magnus-internal/x-httpd-php"
    Service fn=php4_execute
    </Object>
    Restart your Web Server
    Test the 2nd step
    Put the test.php file in the document root of your server
    Then type http://server/test.php
    If you can see "nothing to write" in your browser then it works!
    AS mentioned in step 1,
    I am not getting the PHP message.
    I am installing it in my laptop, it has no IP, is that has to do something with this.
    Please guide me from here.
    Thanks in advance
    Kathirvel

  • What is the default User Id and Password for Endeca Server Console

    Hell All,
    I have installed Endeca Server 7.6.0.0.0 in Windows 64-bit. When I try login to http://localhost:7001/endeca-server/console/ it asking Login id and Password to for "sh_sample" datadomin that i imported from SampleApp. I tried using Admin Server user id and it did not work.
    Please help.
    Thank you

    Hi,
    It is possible that you are asking about these two issues:
    1. SH sample data set is a data set that can be used with the Endeca Server, outside of the context of Studio. In particular, this data set represents an already created index, and thus can be queried by using SOAP UI, or other tool for working with Endeca Server's web services directly. This data set does not include collections (in v.7.6.0.0), and thus cannot be viewed or worked with, in Studio (which, like Integrator, requires having collections, as compared to Endeca Server 7.6.0.0 in which collections are optional at ingest time).
    2. The Endeca Server Console that you are trying to use is packaged with the Endeca Server because it is part of the Data Enrichment Module. Data Enrichment Module includes the Console and plugins. You can use the plugins within Studio. The Console, although it is installed with the Endeca Server, is not intented to be used in this release (because the Data Enrichment plugins are available to users through Studio).
    To get back to your questions, if you would like to use SH data set, please see the instructions in the Endeca Server Installation Guide. http://docs.oracle.com/cd/E40521_01/server.760/es_install/toc.htm#Using%20the%20SH%20sample%20data
    As for the Console, it should not be used. Instead, use Studio's Enrichments. For information, please see: Enriching Data Set Attributes

  • Apache and Java System Web server

    Is it possible to run Apache Web Server and Java System Web Server on the same computer or is one of them which has to run.

    Sure it can be run simultaneously as long as they don�t share the same Socket (pair of IP-Address/TCP-Port).
    But the question is does it make sense at all - what would you get from Apache which is not there in SJS WS?

  • I have an iphone 4s and have installed the new ios download and can no longer find games and other apps that i have downloaded. Where would they be or have they been wiped?

    I have an iphone 4s and have installed the new ios download and can no longer find games and other apps that i have downloaded. Where would they be or have they been wiped?

    Hi,
    don´t be worry, this would not be a problem.
    You have to take the same Aplle ID on both devices, then you can sync them via iTunes by using all universal apps on each device, create playlists, albums and all the things you need and sync it, no problem...
    cu
    dienoppe

  • If I buy a new hard drive reinstall my OS and Adobe apps, will this count as installing on 2nd comp?

    If I buy a new hard drive, or format my current one and reinstall my OS and Adobe apps, will this count as installing on a 'second computer'? If so, how then do I go about ACTUALLY installing the apps on a second computer if I'm unable to 'de-register' the 'first' one because it was on an old hard drive?

    TheTx,
    Yes! you can simply go ahead and deactivate the product before wiping your hard drive. This would simply reset the counter back to 0 and you will be able to activate the product on the new machine as well .
    Kartikay Sharma

  • One of server core 12 and showing in sql server 24. how it possible?

    Hello  everyone,
    I'm confused in sql server 2008 r2 when try to check no. of cores in sql server property are double in sql server and os showing 12 cores.
    one of my friend saying 1 cores= 2 processors. 
    What is happen behind that...
    Thanks in advance...

    Hi,
    Are you same person Baraiya Krit who posted below same question I have always observed question posted by you and Baraiya are same. if such is the case
    both should be merged and you should note not to post same question with different profile otherwise i have to report that as spam and your profile would be deleted. If such is case you are wasting people time
    http://social.msdn.microsoft.com/Forums/sqlserver/en-US/505a2871-a7fd-487e-b39d-788ff78b6c95/one-of-server-core-12-and-showing-in-sql-server-24-how-it-possible?forum=sqldatabaseengine
    If you are from same firm and different person why not post one question.
    Moderators please have a look
    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it
    My Technet Articles

  • Integrating a PHP Web App with an Existing Azure Mobile Services and Mobile App

    I've got an existing mobile app that is integrated with Azure's mobile services. The mobile services are currently connected to Azure Active Directory with MFA enabled. I'd like to build a separate PHP-based web application (Azure VM) that uses this existing
    mobile service and authentication.
    I reviewed the Azure PHP SDK, but didn't see any tie-ins to the Mobile Service. Additionally, Azure has some great tutorials, but for mobile services they all seem to focus on iOS, Android, and Windows phone. Any insight into how to tie a PHP-app into this
    backend would be much appreciated!

    Although there isn't any client library for PHP, you can still access Mobile Service using the
    Azure Mobile Service REST API.
    Abdulwahab Suleiman

  • Confused with Lync 2013 Autodisocver and mobile app

    Hello
    i am confused about some stuff related to lync 2013 client discovery and mobility:
    1) internal client will try to resolve lyncdisocverinternal , then why on the internal CA request i can see lyncdiscover &lync disocoverextrnal?
    2)for auto discover to work from extrnal does it look for the A record "sip.mydomian.com" or its searching for lyncdisocver?
    3) does Mobility (client for ipad or Andriod) try to connect to edge server if if its located on the internal network or it can understand if its on the internal wifi to use internal and its outside the network it will use external?
    please help

    All Mobility Service traffic goes through the reverse proxy, regardless of where the origination point is—internal or external.
    The Lync Server 2013 Autodiscover Service returns all Web Services URLs for the user's home pool, including the Mobility Service (Mcx and UCWA) URLs. However, both the internal Mobility Service URL and the external Mobility Service URL are associated with
    the external Web Services FQDN.
    You can run the command Set-CsMcxConfiguration –ExposedWebURL internal.
    The parameter internal indicates whether the URL used by the Autodiscovery Service is accessible to users both inside and outside the organization firewall (External) or only accessible to users inside the firewall (Internal).
    If you set to internal, you can’t connect externally.
    For details, check
    http://technet.microsoft.com/en-us/library/hh690030.aspx
    Lisa Zheng
    TechNet Community Support

  • How to set up User id and Password for Web services or authentication

    Hi ,
    I am new to web services . I have created a new Web service in SAP , and while creating Service defination , set the Authentication as LOW for server proxy .Then created End-point in SOAMANAGER with USREID/PWS requried .This WSDL i am planning to share with Third party to call from Java application.
    But my web service checks for authorization which needs to be set up to allow the user id and pws .
    So question is how do i pass my user id and pws as i do not see this WSDL with User id and pws option displayed for me when i test this using SOAP UI .I saw some of WSDL with tag "AuthHeader" with user id and pws tags in them .So how could i get them ?
    Or requirement is that my Third party should be able to access my Web service in PRD and also be able to have authorization to auth object embedded in FM inside service defination .So how is this acheived ?
    Thanks,
    Sitaraman

    Hi,
    After creation of WSDL , you will get URL lkie http://idessapdev.ad.infosys.com:8000/index.html.
    For this URL your third party system need sto add id and pwd for accessing like http://idessapdev.ad.infosys.com:8000/index.html&userid = 111&pwd= wwgw.
    this is not the exact syntax. you can check with your third party system for this URL.
    Regards,
    Lokeswari.

  • Oracle error ORA-00600 when using Oracle 10g and Sun One Web Server 6.1

    I have a java application that was running under Solaris 8 and Oracle 9i. I am trying to get it up and running on a new server that is configured with Solaris 9 and Oracle 10g. Whenever the application tries to connect to the database it receives the following error: ORA-00600 [ttcgcshnd-1][0]. My research indicates that this is an internal Oracle error that represents a low level unexpected condition. I have looked through my configuration for the Web Server and I have not been able to determine the cause of this problem. My DBA tells me that we have the latest patch installed for Oracle! Has anyone encountered this problem before? Any help would be greatly appreciated!

    If the problem is also present in a SWING app, i.e. outside the web server, then it is porbably something external to the webserver.
    I think you should ensure that the driver and database are compatible with each other. It is very likely that you need a new jdbc driver for the new database.
    download from here http://www.oracle.com/technology/software/tech/java/sqlj_jdbc/htdocs/jdbc101020.html
    try the ojdbc14.jar

  • Enabling end - user access in Sun One Web Server 6.1 SP2

    Hi,
    I am new to Sun One Web Server 6.1 SP2 and I can't figure how to enable the end user access so that the end users can change their password.
    On iPlanet 6.0 SP2, in the Distributed Admin page, I could enable Distrubuted Administration as well as end user access on the webserver. The end users could then change their own password. I can't find a similar feature in Sun One Web server 6.1 SP2.
    Could anyone out there tell me how to get this done?
    Thanks in advance!

    Hi,
    I just found from release notes that End user administration feature (which was under Distributed Administration ) is no longer supported in Sun One Web Server 6.1. [Problem ID 4865295 in release notes]
    Could anyone provide a workaround to get over this and allow the end users to change their passwords?
    Many thanks in advance,
    auporna.

  • Managing users, groups and shares with Mavervicks server

    I recently upgraded from Snow Leopard Server to Mavericks.
    In Snow Leopard, WorkGroup manager was the primary way to create shares, users and groups. Now it would seem that it is optional and in fact, I do not even see how to create a share in WorkGroup except for perhaps a group share which I'm not quite sure how to do.
    For my setup, I have setup Open Directory and create a few Local Network users. DHCP is managed via my airport and the DNS is on but only for server and points to my Airport IP address.
    QUESTIONS:
    Should I be managing users with WorkGroup manager or server app, Whats the advantage? 
    I don't have user profiles (files) stored on the server they are local. That being the case, why does each user have a network folder on the server?
    Thanks!

    Workgroup Manager and MCX are deprecated.  These technologies should only be used if you can not accomplish your tasks with Server.app and Profile Manager.  If you have specific requirements that can not be satisfied in Server.app and Profile Manager you should send feedback to Apple.
    So to your questions:
    Should I be managing users with WorkGroup manager or server app, Whats the advantage?
    I don't have user profiles (files) stored on the server they are local. That being the case, why does each user have a network folder on the server?
    1:  Ideally, no.  Unless...  You are supporting machines prior to 10.8.5 or can not find an equivalent function in Server.app and Profile Manager.  There is no advantage to using it.  Apple will eventually stop distributing it.  It is available now for legacy support only.  If you have a need for MCX management then WGM remains viable.  But, ideally, you should be looking to Profile Manager.
    2:  This is because you created your accounts using Local Home Folder template instead of None - Services Only.  The Local Home Folder template has the unfortunate side-effect of creating a user home folder on the server.  I too dislike this.  If you only want to use the accounts for services, then you should create the accounts using None - Services Only.  By the way, it is safe to delete these home folders if you would like.
    Reid
    Apple Consultants Network
    Apple Professional Services
    Author "Mavericks Server – Foundation Services" :: Exclusively available in Apple's iBooks Store

Maybe you are looking for