Package org.springframework.security.config.annotation.authorization

Annotation Interface EnableMultiFactorAuthentication

@Retention(RUNTIME) @Target(TYPE) @Documented @Import(org.springframework.security.config.annotation.authorization.MultiFactorAuthenticationSelector.class) public @interface EnableMultiFactorAuthentication
Enables Multi-Factor Authentication (MFA) support within Spring Security. When authorities() is specified creates a DefaultAuthorizationManagerFactory as a Bean with the authorities() specified as additional required authorities. The configuration will be picked up by both EnableWebSecurity and EnableMethodSecurity. 

 @Configuration
 @EnableMultiFactorAuthentication(authorities = { GrantedAuthorities.FACTOR_OTT, GrantedAuthorities.FACTOR_PASSWORD })
 public class MyConfiguration {
     // ...
 }
NOTE: At this time reactive applications do not support MFA and thus are not impacted. This will likely be enhanced in the future.
Since:
7.0

  • Required Element Summary

    Required Elements
    Modifier and Type
    Required Element
    Description
    String[]
    authorities
    The additional authorities that are required.

  • Element Details

    • authorities

      String[] authorities
      The additional authorities that are required.
      Returns:
      the additional authorities that are required (e.g. { FactorGrantedAuthority.FACTOR_OTT, FactorGrantedAuthority.FACTOR_PASSWORD }). Can be null or an empty array if no additional authorities are required (if authorization rules are not globally requiring MFA).
      See Also: