Find out how to set up and use multifactor authentication (MFA) for logging into Mediaflux
...
| Table of Contents | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
| Anchor | ||||
|---|---|---|---|---|
|
...
account
You will need to go through a one-time set up process to enrol your account for MFA.
...
You will need two devices to complete this process:
YOUR PHONE (for the Mediaflux Pocket app parts)
YOUR PC (for the Mediaflux Pocket Registration Portal parts)
STEP 1: Install the Mediaflux Pocket app on your smartphone
...
Go to the Mediaflux Pocket Registration Portalon your PC (not the Mediaflux Pocket app on your smartphone).
Log in with the same domain and credentials that you usually use to log into Mediaflux.
If you are a University of Melbourne academic researcher (staff), you likely log into Mediaflux with the domain unimelb and your central UoM username and password.
If you are University of Melbourne graduate researcher (student), you likely log into Mediaflux with the domain student and your central UoM username and password.
If you are a researcher external to the University of Melbourne, you likely log into Mediaflux in one of two ways:
with the domain local and the username and password that you were sent when creating the account.
with the domain unimelb and the username and password for the Active Directory system account that you registered for.
...
Point your phone’s camera at the Mediaflux Pocket Registration Portal’s QR code to scan it.
| Info |
|---|
Some smartphones may require you to actively allow Mediaflux Pocket access to your phone camera before you can scan. |
...
Give your account and device a name, then click Enrol.
...
Once you are enrolled for MFA, you will receive an MFA push notification notifications on your phone smartphone when you log in to Mediaflux.
...
subsequent logins from the same computer should not shouldn't require you to accept any MFA push notifications
but if you log in from another computer, you will be prompted again
...
The log in process will be slightly different per each different Mediaflux client:
Mediaflux Explorer
...
While MFA will be mandatory (with certain use case exceptions as mentioned abovedetailed below), you may need to unenrol from it when:
as a piloting tester in the pre-mandatory phase, you’ve finished your testing and want to disable the MFA until it actually becomes mandatory for all users
changing/updating your mobile device (because swapping your MFA from one smartphone to another involves first unenrolling, then re-enrolling in MFA)
| Note |
|---|
Important: Unenrolling from Mediaflux Pocket does NOT enable access to Mediaflux without MFA. Once MFA is mandatory, Mediaflux will be inaccessible without it, regardless of whether you’re enrolled in Mediaflux Pocket or not. Unenrolling merely dissociates your Mediaflux account from the Mediaflux Pocket app on a particular smartphone (usually so that you can reestablish it on a different smartphone). |
To unenrol, go Go to the Mediaflux Pocket Registration Portal on your PC (not the Mediaflux Pocket app on your smartphone)and log in.
Click the Disable MFA button.
...
You will see the following screen indicating that you have successfully unenrolled.
...
Exemptions
There are only three some exemptions to having to perform MFA in order to log in to Mediaflux: shared links, Data Mover shareables, and secure identity tokens.
Shared Links
Shared links can be created in Mediaflux Explorer in order to share a location with an unauthenticated user. See Direct Shareable Links for more information.
Data Mover
Data Mover allows you to share data with others. These users are not required to log in to access the data you have shared and so will not be required to use MFA.
Secure identity tokens
Secure identity tokens can be used to authenticate with the Mediaflux Unimelb Command-Line Clients, sFTP (Secure File Transfer Protocol) and Network Share (SMB Protocol).
If you need to automate uploads in an unattended fashion from a server or instrument PC, you may apply for a secure identity token. The advantages of this approach are:
Uploads will not require an MFA push notification to be actioned
Your university credentials do not need to be stored on the source machine
If a token is compromised, this will not compromise your university credentials
See Secure identity tokens for more information or to apply for a token.
| Anchor | ||||
|---|---|---|---|---|
|
The initial Mediaflux MFA pilot program meeting was recorded and is available below for those who were unable to attend.
...
Known issues
MFA with Mediaflux is a new feature that is currently under active development. As such there are some known issues that we are tracking with the software vendor (Arcitecta). Pending resolution, here are some workarounds.
“Session Expired” when enrolling for MFA
When attempting to enrol using the QR code at the MFA registration portal, you always see the error message:
Mediaflux Pocket: Enrollment failed
Session expired. Please re-login and try again
This issue seems to either be intermittent or only affect some users' phones.
| Expand | ||
|---|---|---|
| ||
You can enrol manually from within the Mediaflux Pocket app.
|
When enrolled for MFA, unable to log in to MFA portal
If you are currently enrolled for MFA and have logged in to Mediaflux recently (within the last 24 hours), you will not be able to log in to the MFA registration portal. This means that you can’t use the portal to unenrol from MFA. The message shown by the portal is:
Multi-Factor Authentication Required
A notification has been sent to the enrolled device -
Please verify on your device to continue.
| Expand | ||
|---|---|---|
| ||
You can unenrol from within the Mediaflux Pocket app.
|
If iPhone is locked, actioned push notifications show "No Response" error
If your iPhone is locked when you try to connect with MFA for the first time in a 24 hour period, a push notification is sent to your phone. When you unlock your phone and tap on the notification, the Mediaflux Pocket app opens, but the verification status is listed as “No Response” and cannot be accepted.
| Expand | ||
|---|---|---|
| ||
|
...
tokens
DataMover
long-lived SMB mounts using local or system accounts
...
| Anchor | ||||
|---|---|---|---|---|
|
General
| Expand | ||
|---|---|---|
| ||
Multifactor authentication (MFA) will be implemented for the University’s Mediaflux service. This means that in addition to signing in with your existing credentials, you will soon also need to authenticate via a secondary app on your mobile device to access the Mediaflux service. |
| Expand | ||
|---|---|---|
| ||
Okta does not work for all of the different protocols offered by Mediaflux. Okta does not support MFA beyond browser-based access and is not sufficient to address the comprehensive needs of the many Mediaflux user access points and profiles. For this reason, the University is implementing MFA specifically for Mediaflux. |
| Expand | ||
|---|---|---|
| ||
MFA will apply to all clients when logging in with usernames/passwords. |
| Expand | ||
|---|---|---|
| ||
MFA will affect existing mounts when the mount is re-authenticated. Re-authentication typically usually happens several times a day. |
| Expand | ||
|---|---|---|
| ||
Yes. This change is applicable to any user who logs in to the Mediaflux service using a username and password. |
| Expand | ||
|---|---|---|
| ||
User acceptance testing of this MFA solution was completed in late May. The next step is for a 4–5-week pilot phase due to commence in early September. Full roll out is planned for Quarter 4, 2024. |
| Expand | ||
|---|---|---|
| ||
Production loads using SMB mounts will need to set up MFA on their Unimelb account. If you require long-lived SMB mounts then you may also need to apply for an SMB Secure Identity Token. |
| Expand | ||
|---|---|---|
| ||
We are not enabling MFA for DaRIS. |
| Expand | ||
|---|---|---|
| ||
Any projects or users currently using the Mediaflux platform will need to use the new Mediaflux MFA once it is fully implemented in Q4 2024. If your project uses the Mediaflux platform, this change will apply. If you'd like to automatically upload large amounts of data via SFTP, SMB or HTTPS you can apply for a Secure Identity Token. |
| Expand | ||
|---|---|---|
| ||
When fully deployed, all users Mediaflux Users (both internal and external to the university) will be required to use MFA when logging in with a username and password. If you have a workload that requires it, you can apply for a Secure Identity Token. This will bypass MFA. |
Enrolment
| Expand | ||
|---|---|---|
| ||
An Android or Apple smartphone is required to use MFA with Mediaflux. If you do not have a smartphone please contact Research Computing Services for assistance. |
...
| Expand | ||
|---|---|---|
| ||
I am concerned about my privacy:
I am concerned about using my personal smartphone:
I am concerned about the performance impact on my smartphone:
|
| Expand | ||
|---|---|---|
| ||
Mediaflux is an external product used, but not owned, by the University. The product provider has helped make our Mediaflux use here at UoM much safer by incorporating multifactor authentication into the product for us. But in selecting an optimal tool to facilitate this, the provider has chosen their own new Mediaflux app (Mediaflux Pocket) over any existing MFA tool that the University already uses (such as Okta). While this decision means installing another MFA app on our phones to safely use Mediaflux, the good news is that the provider is further developing their app to include all sorts of useful features for frequent Mediaflux users, so stay tuned for updates! |
| Expand | ||
|---|---|---|
| ||
Yes, you will need the Mediaflux Pocket app to accept MFA authentication push notifications when you log in to Mediaflux. If you have accidentally deleted the app, please contact Research Computing Services for assistance. |
| Expand | ||
|---|---|---|
| ||
|
Usage
| Expand | ||
|---|---|---|
| ||
You will be prompted for MFA the first time you log in from each computer (based on its IP address) within a 24 hour period. Subsequent logins from the same computer, even if they are via a different protocol, will not send a push notification. If you receive a notification for activity that you don’t recognise, you should contact Research Computing Services immediately. |
...
Contact RCS (Research Computing Services)
UoM Staff: httphttps://go.unimelb.edu.au/or96tu78
UoM Students: httphttps://go.unimelb.edu.au/4exrExternal Users: http://go.unimelb.edu.au/75vr 6o78