The following is a list of frequently asked questions about i2Pass. If you have a question that is not covered here, ask us via email and we'll answer your question.
Register your E-mail address to receive automatic notification when this product is updated.
Can I use i2Pass in a mirrored environment?
Yes. There are four *FILE objects that you should consider for mirroring between your two system. No other objects other than these should be considered since you want to allow for the two i2Pass installations to exist at different release levels. These are all in the application library named I2PLIB:
IPRDTA - IP Address Controls (optional)
PASSCTL - 2FA Code Controls
PASSLOG - Activity Log (optional)
PASSUSER - User Profile Registration
If you are not controlling access by IP address, you can ignore the file named IPRDTA. For the Activity Log, you will not be able to tell which system recorded the activity of you mirror that file. It is your choice whether to mirror it or not. All other objects should be excluded from mirroring activity.
Are there any consideration for i2Pass when installing an IBM i OS upgrade?
Yes. After the IBM i OS upgrade is complete and all IBM PTFs have been installed but before you put your system back into productive use, you must run the following command:
GRTOBJAUT OBJ(QSYS/ASSIST) OBJTYPE(*MENU) USER(I2PASSUSR) AUT(*EXCLUDE)
This is needed to avoid users bypassing the 2FA validation process during a normal signon. See the i2Pass User's Guide under the section titled "IBM i Security Loophole" for more information.
If a user specifies a "Program/procedure" on the signon screen, will it bypass i2Pass controls?
Yes, this is possible. To correct for this situation, we ship alternate signon screens for the system that remove the "Program/procedure" line from the signon screen. We also include step-by-step instructions on how to install the alternate signon screen objects and test them.
Can I send the 2FA code to a cell phone as a text?
Yes!
Since version 3.03 you can sent native SMS messages though the built-in connection with our SMS utility, kConnect. Alternatively, you can also send codes using your cell carriers email-to-text feature. This can require extensive configuration and troubleshooting of SMTP and DNS services. More information about SMS Integration is available here.
When enrolling users, do I have to do them one at a time or can I enroll them all at once?
Your can enroll user profiles one at a time if you want to, but i2Pass also includes a batch enrollment utility that will let you enroll all active users or GENERIC* user profiles. We don't recommend that you do this while the software is installed on trial, but once you commit to i2Pass, it will simplify your activation process.
I am using the initial program setting on user profiles, will i2Pass still work for me?
Yes!
When you register a user profile in i2Pass, the initial program information is saved. When the two factor authentication process has been completed successfully, then your initial program will still be called.
