KB-7242: Validity period for Centrify Identity Service MFA challenges

Home >

KB-7242: Validity period for Centrify Identity Service MFA challenges

Product:

Centrify Identity Service, App Edition ,

Published:

22 August,16 at 09:38 PM

Rating:

Applies to: Centrify Identity Service, App Edition

Question:

How long are the various MFA challenges valid for before a user will need to re attempt the MFA challenge from the beginning?

Challenge examples:

User-added image

Answer:

There are different expiration thresholds, depending on the type of challenge used. See the below table for details:

Challenge	Duration
Password	Determined by Source directory policy
Phone Call	Will be attempted only once
Text message (SMS) confirmation code	5 Minutes until no longer valid
Email confirmation code	5 Minutes until no longer valid
User-defined Security Question	Determined by User - remains unchanged unless Question/Answer is updated by user
Third party Authenticator for user added applications (example: Google Authenticator)	30 Seconds +/-30 seconds (Max 90 seconds)
OATH OTP:	HOTP- Counter+13 codes TOTP- (period +/-period) max = 3(period).

An Administrator may also choose to modify the "Challenge Pass-Through Duration" option to allow a user to log back in and bypass the MFA challenges, if the User has already satisfied the challenges within the range of the time set here. (ie. If set to 30 minutes, the User will not need to be re-challenged unless more than 30 minutes has passed).

For additional information not covered in this guide or troubleshooting assistance, please review Centrify Online Help or the Customer Support Portal at https://www.centrify.com/support/customer-support-portal/