Modify Entrust Soft Token authenticator settings

Review the Entrust Soft Token authenticator settings, and edit them as required. Changes made to these settings apply to all assigned Entrust Soft Tokens in your account.

Modify an Entrust ST Authenticator

1. Click > Policies > Authenticators. The Authenticators page appears.

2. Select Entrust Soft Token. The Entrust Soft Token settings page appears.

3. Select the OTP Digit Length. This sets the number of digits in the OTP generated by the token.

4. By default, Application Launch Scheme is set to igmobileotp. Change this value only if you use a custom mobile application.

5. Optional: Select PIN Required if you want users to enter a PIN.

6. Set the Max. Time Steps to the amount of time (in 30 second intervals) that the token response is valid. The default is 10 (5 minutes).

7. Set the Max. Reset Time Steps to the amount of time (in 30 second intervals) for a token reset. The default is 120 (60 minutes), which is the allowable time difference between the soft token and the server clocks.

   note

   If the token reset does not work, try increasing the Max. Time Steps and then try to reset the token again. If the problem continues, contact the Entrust Support Team.

8. Enter the Activation Password Length to set number of characters that can be included in the password assigned to a user.

9. Enter the Activation Lifetime to set the amount of time in seconds that a user has to activate their Entrust ST.

10. Select Allow Unsecure Device to allow the Entrust ST to run on an unsecured device (such as custom ROM Androids or jail-broken iOS devices).

11. Select Allow Device Biometrics Authentication to allow users to unlock the mobile application with biometric authentication instead of the token PIN. If disabled, users must enter their PIN.

12. Select the activation methods to include in the Entrust Soft Token activation email. You must select at least one option.

13. Select Require Device Verification to require users to perform device verification when they activate their mobile soft token on the mobile soft token app. Device verification ensures that the user's device has a trusted device certificate.

14. Select Require App Verification to require users to perform app verification when they activate their mobile soft token on the mobile soft token app. If you select this option, the following additional settings appear:

    • Android Application Package Name

    • IOS Application Bundle ID

    • IOS Team ID

      note

      You only need to change these values if your users use a custom mobile identity app. There is no need to change them for the Entrust Identity app. When App verification is enabled, an attestation from Apple or Google is provided that validates the mobile application performing the activation. This feature ensures token activation occurs only from trusted mobile applications.

15. Select Enable Mutual Challenge to require users to respond to a mutual push authentication challenge. When enabled, users must match the challenge that appears on the IDaaS page with the mutual challenge shown in their Entrust Identity soft token app.

16. Set the Mutual Challenge Length to the number of characters in the mutual challenge.

17. Set the Mutual Challenge Alphabet to the characters that can appear in the challenge.

18. Set Mutual Challenge for Percent of Requests to the percentage of user challenges that include a mutual challenge.

19. Select Allow Actionable Notifications to allow users to perform actions directly from push notifications. For example, Confirm or Deny access.

    note

    PIN Required must be disabled to use this feature.

20. Click Save to confirm changes.

Validate your changes

After you save, verify the following:

1. Updated policy values remain selected after refresh.
2. Activation email methods appear as configured.
3. Users can complete activation with the required verification settings.
4. If enabled, mutual challenge and actionable notifications behave as configured.