...
| Table of Contents | ||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
...
| Anchor | ||||
|---|---|---|---|---|
|
...
account
You will need to go through a one-time set up process to enrol your account for MFA.
...
You will see the following screen indicating that you have successfully unenrolled.
...
Exemptions
There are only three some exemptions to having to perform MFA in order to log in to Mediaflux: shared links, Data Mover shareables, and secure identity tokens.
Shared Links
Shared links can be created in Mediaflux Explorer in order to share a location with an unauthenticated user. See Direct Shareable Links for more information.
Data Mover
Data Mover allows you to share data with others. These users are not required to log in to access the data you have shared and so will not be required to use MFA.
Secure identity tokens
Secure identity tokens can be used to authenticate with the Mediaflux Unimelb Command-Line Clients, sFTP (Secure File Transfer Protocol) and Network Share (SMB Protocol).
If you need to automate uploads in an unattended fashion from a server or instrument PC, you may apply for a secure identity token. The advantages of this approach are:
Uploads will not require an MFA push notification to be actioned
Your university credentials do not need to be stored on the source machine
If a token is compromised, this will not compromise your university credentials
See the unimelb-mf-upload page Secure identity tokens for more information .
Long-Lived SMB Mounts
This is a new feature. For SMB mounts on servers, expected to operate unattended for long periods of time.
MFA push notifications will not be sent when mounting the SMB share
Your university credentials do not need to be stored on the source machine
If a token is compromised, this will not compromise your university credentials
| Text highlighter |
|---|
XXXTODO link to new page describing this feature. |
...
or to apply for a token.
| Anchor | ||||
|---|---|---|---|---|
|
The initial Mediaflux MFA pilot program meeting was recorded and is available below for those who were unable to attend.
...
Known issues
MFA with Mediaflux is a new feature that is currently under active development. As such there are some known issues that we are tracking with the software vendor (Arcitecta). Pending resolution, here are some workarounds.
“Session Expired” when enrolling for MFA
When attempting to enrol using the QR code at the MFA registration portal, you always see the error message:
Mediaflux Pocket: Enrollment failed
Session expired. Please re-login and try again
This issue seems to either be intermittent or only affect some users' phones.
| Expand | ||
|---|---|---|
| ||
You can enrol manually from within the Mediaflux Pocket app.
|
When enrolled for MFA, unable to log in to MFA portal
If you are currently enrolled for MFA and have logged in to Mediaflux recently (within the last 24 hours), you will not be able to log in to the MFA registration portal. This means that you can’t use the portal to unenrol from MFA. The message shown by the portal is:
Multi-Factor Authentication Required
A notification has been sent to the enrolled device -
Please verify on your device to continue.
| Expand | ||
|---|---|---|
| ||
You can unenrol from within the Mediaflux Pocket app.
|
If iPhone is locked, actioned push notifications show "No Response" error
If your iPhone is locked when you try to connect with MFA for the first time in a 24 hour period, a push notification is sent to your phone. When you unlock your phone and tap on the notification, the Mediaflux Pocket app opens, but the verification status is listed as “No Response” and cannot be accepted.
| Expand | ||
|---|---|---|
| ||
|
| Anchor | ||||
|---|---|---|---|---|
|
General
| Expand | ||
|---|---|---|
| ||
Multifactor authentication (MFA) will be implemented for the University’s Mediaflux service. This means that in addition to signing in with your existing credentials, you will soon also need to authenticate via a secondary app on your mobile device to access the Mediaflux service. |
| Expand | ||
|---|---|---|
| ||
Okta does not work for all of the different protocols offered by Mediaflux. Okta does not support MFA beyond browser-based access and is not sufficient to address the comprehensive needs of the many Mediaflux user access points and profiles. For this reason, the University is implementing MFA specifically for Mediaflux. |
| Expand | ||
|---|---|---|
| ||
MFA will apply to all clients when logging in with usernames/passwords. |
| Expand | ||
|---|---|---|
| ||
MFA will affect existing mounts when the mount is re-authenticated. Re-authentication typically usually happens several times a day. |
| Expand | ||
|---|---|---|
| ||
Yes. This change is applicable to any user who logs in to the Mediaflux service using a username and password. |
| Expand | ||
|---|---|---|
| ||
User acceptance testing of this MFA solution was completed in late May. The next step is for a 4–5-week pilot phase due to commence in early September. Full roll out is planned for Quarter 4, 2024. |
| Expand | ||
|---|---|---|
| ||
Production loads using SMB mounts will need to set up MFA on their Unimelb account. If you require long-lived SMB mounts then you may also need to apply for an SMB Secure Identity Token. |
| Expand | ||
|---|---|---|
| ||
We are not enabling MFA for DaRIS. |
| Expand | ||
|---|---|---|
| ||
Any projects or users currently using the Mediaflux platform will need to use the new Mediaflux MFA once it is fully implemented in Q4 2024. If your project uses the Mediaflux platform, this change will apply. If you'd like to automatically upload large amounts of data via SFTP, SMB or HTTPS you can apply for a Secure Identity Token. |
| Expand | ||
|---|---|---|
| ||
When fully deployed, all users Mediaflux Users (both internal and external to the university) will be required to use MFA when logging in with a username and password. If you have a workload that requires it, you can apply for a Secure Identity Token. This will bypass MFA. |
Enrolment
| Expand | ||
|---|---|---|
| ||
An Android or Apple smartphone is required to use MFA with Mediaflux. If you do not have a smartphone please contact Research Computing Services for assistance. |
...
| Expand | ||
|---|---|---|
| ||
|
Usage
| Expand | ||
|---|---|---|
| ||
You will be prompted for MFA the first time you log in from each computer (based on its IP address) within a 24 hour period. Subsequent logins from the same computer, even if they are via a different protocol, will not send a push notification. If you receive a notification for activity that you don’t recognise, you should contact Research Computing Services immediately. |
...
Contact RCS (Research Computing Services)
UoM Staff: httphttps://go.unimelb.edu.au/or96tu78
UoM Students: httphttps://go.unimelb.edu.au/4exrExternal Users: http://go.unimelb.edu.au/75vr 6o78