Client-side MFA - Steps and Checks To Prepare for Client-side MFA (for clients)

Introduction

This article guides clients through the necessary steps to prepare for enabling Client-Side Multi-Factor Authentication (MFA) within Reward Gateway | Edenred (RGER). This feature allows RGER to recognize and trust the Multi-factor Authentication that your organization performs through your Identity Provider (IdP), such as Okta, Microsoft Azure, or Edenred Connect, minimizing additional MFA prompts when accessing RGER applications.

Notes:

• This is a general guide covering all IdPs. Please click on the relevant link above to follow instructions for your specific IdP.  
• For help and support setting this up please get in touch with your  IT/Tech administrator. 

Outcomes

By following this guide, you will be able to:

• Ensure your IdP is properly configured for MFA and Single Sign-On (SSO)
• Work with your Reward Gateway | Edenred contact to enable Client-side MFA
• Verify successful integration and a seamless sign-in experience on web and mobile platforms

Prerequisites

Before configuring Client-Side MFA, please ensure:

• Your organization uses Okta, Microsoft Azure, or Edenred Connect as your IdP
• MFA enforcement is enabled and active on your company's IdP.
• Single Sign-On (SSO) is configured on your platform and working successfully.
• You have liaised with your CSM or Reward Gateway | Edenred contact who will coordinate the configuration process.

Checklist:  

Step 1: Check if SSO is Enabled

SSO should already be set up if you are reading this article. Double-check it works for your platform and users.

Step 2: Check if MFA is Enabled and Enforced

Ensure that MFA is active and enforced for your users/platform.

Step 3: Test Your SAML Response

• Test the SAML response to confirm it reflects a successful MFA authentication:
• Perform a sign-in as a test user.
• Capture the SAML response (see AWS guide or use browser tools/SAML tracing extensions).

Inspect the response for MFA claims as described below. 

Configuration Details

Once you have completed testing the above. Please see the following guides for instructions on specific IdPs:  

• Okta
• Microsoft Azure  
• Edenred Connect 

General Troubleshooting Tips

• If you still see multiple MFA prompts, ensure your IdP is passing the correct authentication context to Reward Gateway IdP.
• Your Reward Gateway | Edenred contact may review internal logs to confirm whether MFA signals are correctly received.
• Confirm that mobile the appropriate SSO is enabled, if mobile experience is inconsistent. 

Best Practices for all IdPs

• Maintain active communication with your Reward Gateway | Edenred contact throughout setup.
• Validate your existing SSO and MFA setup independently before enabling Client-Side MFA.
• Test thoroughly on all platforms your employees use (web and mobile).
• Contact support promptly if issues arise - this facilitates log review and quicker resolution.