Multi-factor authentication (MFA) credentials for CICS Explorer connections
Authentication with MFA credentials can enhance sign-on security for CMCI connections to CICS® regions. MFA requires a password or passphrase coupled with a dynamic authentication token to verify the user's identity.
When MFA support is required, the Remote System Explorer (RSE) connection must be used to export CICS bundles to a z/OS® Unix System Services file system directly from CICS Explorer. MFA is not supported for z/OS FTP or z/OSMF connections.
Prerequisites for CICS Explorer sign-on with MFA
- Ensure that the WUI region and CMAS are running at the same CICS level that is CICS TS 5.4 with APAR PI87691 or later.
- Configure the WUI region to use a CMCI JVM server, as described in
Configuring for CICS Explorer sign-on with Multi-Factor Authentication.
- Ensure that CICS Explorer is at V5.4.0.4 or later and a CMCI connection is defined.
How to use an MFA credential
You define an MFA credential in a similar way to other connection credentials, except that you do
not save a password or passphrase in the credential. For detailed instructions, see
Defining connection credentials in IBM Explorer for z/OS V3.1.1 product documentation.

Figure 1. Creating an MFA credential

When you make a CMCI connection, you are prompted to specify a password or passphrase. In the
Password or Passphrase field, you must specify your password or passphrase
coupled with an authentication token. Ask your system administrator how to concatenate your password
or passphrase and the authentication token.
Figure 2. Prompt upon sign-on with MFA

The token has an expiration period. When it expires, you are prompted to specify your password or passphrase with a new token.
For more information about configuring a CICS Explorer connection to CICS systems, see Configuring a CICS system connection.