Push notifications

Push notifications can be used as a multi-factor authentication (MFA) method, letting customers verify authentication requests from your brand's mobile application. Strivacity sends a push notification to an enrolled device, where the customer can approve or deny the request or complete number matching, depending on the configured authentication method.

Push notification authentication supports Approve or deny and Approve with number matching. Firebase Cloud Messaging (FCM) is supported for Android and iOS applications. Apple Push Notification service (APNs) is also supported for iOS applications as an alternative to FCM.

To use Push MFA, configure the mobile application under Policy resources > Push notifications, integrate the Strivacity mobile SDK into the application, and enable Push MFA in an Adaptive Access policy. Customers can enroll devices from My Account or when prompted during authentication, and manage enrolled devices in My Account.

Prerequisites

Before creating a push notification for MFA, make sure you have:

• A mobile application that integrates the Strivacity mobile SDK.
• Credentials for a supported push delivery service:
  • Android: Firebase Cloud Messaging (FCM)
  • iOS: Firebase Cloud Messaging (FCM) or Apple Push Notification service (APNs)
• A deep-link URL that opens your mobile application to the push authentication request.

Capabilities

• Use your brand's mobile application as an MFA authenticator on Android and iOS.
• Support Approve or deny and Approve with number matching authentication methods.
• Configure push notifications as an optional or mandatory method and define the approval lifetime.
• Let customers enroll multiple devices, name them, and manage enrolled devices in My Account.
• Use Firebase Cloud Messaging (FCM) for Android and iOS, or Apple Push Notification service (APNs) for iOS.
• Monitor push notification activity and authentication outcomes.

Configuration

Create a push notification configuration

Create a push notification for each mobile application that customers can use as an authenticator.

1. In the Admin Console, go to Policy resources > Push notifications.
2. Select Create.
3. Configure the following settings:
   1. Name: Identifies the push notification configuration in the Admin Console.
   2. Description: Provides additional information about the configuration.
   3. Policy tag: Assigns a policy tag to the configuration.
   4. Application name: Specifies the application name displayed to customers.
   5. Deep-link URL: Specifies the URL used to open the mobile application for a push authentication request.
   6. Authentication method: Determines how customers respond to authentication requests:
      1. Approve or deny: Customers approve or deny the request in the mobile application.
      2. Approve with number matching: Customers select in the mobile application the number displayed during authentication.

Configure delivery services

Configure at least one delivery service for the platforms supported by your mobile application.

Android

For Android applications, configure Firebase Cloud Messaging (FCM).

Upload the service account JSON file for the Firebase project associated with your mobile application.

iOS

For iOS applications, choose one of the following delivery services:

• Firebase Cloud Messaging (FCM): Upload the service account JSON file for the Firebase project associated with your mobile application.
• Apple Push Notification service (APNs):
  • Upload the APNs authentication key (.p8).
  • Enter the Key ID.

Enable push notifications in an Adaptive Access policy

After creating a push notification configuration, enable the MFA method in the Adaptive Access policy assigned to the application.

1. Open the Adaptive Access policy.
2. Go to Multi-factor methods.
3. Enable Push MFA.
4. Choose whether enrollment is Optional or Mandatory.
5. Select the push notification configuration to use.
6. Set the Push notification approval lifetime.

Customer enrollment

Customers can enroll a mobile device from My Account or when prompted during an authentication journey.

In My Account:

1. Go to Security settings.
2. Select Add new method.
3. Select Device.
4. Scan the displayed QR code with the brand's mobile application.
5. Complete the enrollment in the mobile application.

Customers can name the device during enrollment. If no name is provided, Strivacity generates a default name from the available device make and model information. Customers can enroll multiple devices.

After enrollment, the device appears under Device authenticators in My Account, where the customer can remove it.

When enrollment is initiated during an authentication journey, the customer completes the device enrollment through the brand's mobile application.

Authentication behavior

The authentication experience depends on the authentication method selected in the push notification configuration.

Approve or deny

Strivacity sends a push notification to the enrolled device. The mobile application displays the authentication request and lets the customer approve or deny it.

The mobile experience can also display context about the request, such as the browser or device, location, and time.

Approve with number matching

The authentication journey displays a number while the customer receives the authentication request on their enrolled device.

The mobile application displays several numbers. To approve the authentication request, the customer selects the number shown in the authentication journey.

While waiting for the response, customers can resend the push notification or select another available authentication method.

Monitor push notification activity

Push notification authentication activity is available through Strivacity monitoring and dashboard statistics.

Push notifications appear in Notification history, where the channel identifies the notification as a push notification, and the target identifies the enrolled device.

Authentication outcomes are also recorded for dashboard statistics.

Supported outcomes include:

• Approved: The customer approved the authentication request.
• Denied: The customer denied the authentication request.
• Undelivered: The push delivery service returned an error.
• Timeout: No response was received before the authentication request expired.

Related pages

• Push notification MFA in the login journey
• Push notification MFA enrollment in the registration journey
• How customers manage adaptive access