Multi-Factor Authentication
Multi-Factor Authentication (MFA) is Layer 3 of the Thinfinity® Workspace authentication model. It adds a second verification step on top of any primary authentication method — whether that method is a Directory Service login (Layer 1) or an SSO-delegated login through an External IdP (Layer 2). MFA does not replace the previous layers; it hardens them.
How MFA Works in Thinfinity Workspace
When MFA is active for an Authentication Method, the login flow adds one step after successful primary authentication:
- The user authenticates through the primary method (Directory Service credentials, OAuth redirect, SAML assertion, or RADIUS validation).
- The Primary Broker checks whether the Authentication Method used has a second factor assigned.
- If a second factor is configured, the platform redirects the user to the corresponding MFA screen — either a TOTP code input or a RADIUS MFA challenge. If no second factor is assigned to the Authentication Method, the login completes at step 1.
- The user provides the second-factor code.
- On successful validation, the session is established, and access is granted.
MFA is assigned per Authentication Method, not per user. A user who signs in through an OAuth method with MFA assigned is prompted for a second factor; the same user signing in through a Directory Service method without MFA assigned is not. Design your MFA strategy around the authentication paths you want to protect.
MFA Methods Supported by Thinfinity Workspace
Thinfinity Workspace supports four second-factor methods. Only one instance of each type can exist in the system, but each instance can be associated with multiple Authentication Methods simultaneously.
Native MFA (Built-in)
Through its own authentication interface, Thinfinity Workspace can require a TOTP code generated by apps such as Google Authenticator or Microsoft Authenticator. It works with any Authentication Method — Directory Service logins, OAuth, SAML, or RADIUS — and operates entirely within the installation.
Duo Security
Thinfinity Workspace integrates with Duo Security as a dedicated second-factor method. Duo enables advanced MFA capabilities such as push notifications, SMS codes, phone callbacks, and hardware tokens, managed entirely through Duo’s platform.
RADIUS-based Authentication
By integrating Thinfinity Workspace with RADIUS servers like Duo Security, it is possible to enforce a second factor (push notifications, SMS, hardware tokens) while keeping the existing identity infrastructure in place. Any second-factor solution that exposes a RADIUS interface can be used through this path.
The RADIUS path for Duo requires Duo’s Authentication Proxy running on your network, a separate component that acts as a RADIUS server and forwards requests to Duo’s cloud API. Where this proxy is already deployed for other services such as VPN or Wi-Fi, reusing it for Thinfinity Workspace serves in place of a separate direct Duo integration.
Inherited from an External IdP
If Thinfinity Workspace is integrated with an IdP such as Azure AD, Okta, or Google Identity, it can inherit the provider’s MFA configuration. This allows the enforcement of advanced authentication policies such as biometrics, geolocation, or trusted devices, and keeps MFA management centralized in the IdP.
Choosing an MFA Method
| Scenario | Recommended method | Reason |
|---|---|---|
| Simple, self-contained MFA | Native TOTP | No external dependencies. |
| Organization uses Duo Security | Duo | Reuses existing Duo infrastructure and policies. |
| RADIUS infrastructure already in place | RADIUS MFA | Reuses existing RADIUS-based MFA without additional tooling. |
| IdP already enforces MFA | IdP-inherited | Single prompt, centralized policy. |
| Compliance requires MFA at the application level | Native TOTP or RADIUS MFA | Enforced by Thinfinity Workspace regardless of IdP configuration. |
What Users See at Login
The second-factor screen depends on the method assigned to the Authentication Method. Thinfinity Workspace renders the screen for native TOTP and RADIUS MFA; for Duo Security and External IdP, the prompt belongs to that platform.
The screens Thinfinity Workspace renders use end-user wording rather than administrative vocabulary: they refer to second-step code verification and a Second-step Code Generator app instead of TOTP, 2FA, or multi-factor authentication. The wording is identical for native TOTP and RADIUS MFA, so the screen alone does not reveal which method is behind the prompt. Duo’s prompt follows Duo’s own wording and branding. Users reporting a problem will describe whichever screen they saw.
Native TOTP
Native TOTP requires a one-time enrollment before it can verify anything: the user and the platform hold no shared secret until the user’s authenticator app is bound to their account. Assigning it to an Authentication Method therefore changes what users of that method see the next time they sign in.
- The user signs in with their credentials as usual.
- Sign in with second-step code verification appears, showing a QR code and the issuer name configured in the TOTP method.
- The user scans the QR code with an authenticator app — Google Authenticator, Microsoft Authenticator, or any TOTP-compatible app.
- The user enters the code the app generates and selects Continue.
- The session is established, and the app is bound to the account.
On subsequent logins, a simpler version of this screen appears: since a device is already enrolled, the user is prompted to open their authenticator app and enter the current code to complete sign-in.
Enrollment is mandatory. Selecting Back on this screen returns the user to the login form but does not complete the sign-in — TOTP verification cannot be deferred.
Resetting a User’s Enrollment
A user who loses or replaces the device holding their authenticator app can no longer produce a valid code, and the enrollment must be cleared so they can bind a new device.
In Configuration > Authentication > Two-Factor Authentication, edit the TOTP method, expand Reset 2FA, enter the account in Username, and select Reset 2FA key for user. The user enrolls again at their next login, following the flow above.
For the full TOTP parameter set, see TOTP Settings.
Duo Security
After the user completes primary authentication, the platform redirects them to Duo’s own hosted prompt, where they complete push approval, a passcode, a phone callback, or whichever method Duo is configured to offer. Device enrollment, retries, and fallback options are all handled inside Duo’s platform. On the Thinfinity Workspace side, the Duo method’s credentials are the only configuration involved.
RADIUS MFA
RADIUS MFA validates a code already provisioned on an external RADIUS server. The same screen appears on every login: the user enters the current code from their existing token or app.
External IdP
When MFA is inherited from an External IdP, the second factor is challenged inside the provider’s own login flow, before the assertion or token reaches Thinfinity Workspace. Users complete the IdP’s prompt, and Thinfinity Workspace establishes the session on the strength of the assertion it receives, so the user is challenged once.
Configuring MFA
To activate MFA and assign a second factor to an Authentication Method, see Configuring MFA.
For reference details on each supported method, see: