Introduction

The Reauthentication Workflow allows Tenant Admins to enforce additional authentication during an active Windows session for applications integrated with Epic EHR. This ensures that user identity is re-verified before performing sensitive actions or continuing access.

Prerequisites

You must have access to Tenant Admin account.
The Windows Login application must be created in the Tenant Admin Portal, for more information refer: How to create and configure Application Type - Passwordless

Steps to Configure Re-authentication Workflow

Log in to the Tenant Admin Portal.
On the Applications page, select the preferred Windows Login application.

The application details page is displayed.
Click Configure tab > Epic EHR .

The Epic EHR page is displayed.
Configure the following:
Click Save.
The Reauthentication workflow is successfully configured.

Enable Reauthentication Workflow

Turn on Enable Reauthentication Workflow toggle button.
Select one of the available reauthentication modes from dropdown:
Application Factors: Uses authentication factors assigned at application level.
First Factor Only: only reauthenticates using the first authentication factor configured.
Second Factor Only: only reauthenticates using the second authentication factor configured.
Click Save.

Reauthenticate Current User: Reauthenticates the currently logged-in Windows user using the configured authentication device.
Do the following:
1. Select Reauthenticate Current User.
2. From the Application Factor dropdown, choose the authentication factor assigned at the application level.
3. Click Save.

Current User Editable

Reauthenticates the currently logged-in user but allows the authentication device to submit a different user if required.

Note: The default factor for this authentication is set to application factor and cannot be changed.

Configure Two User Authentication

Under Mode for 1st user, select the authentication factor from dropdown.
Under Mode for 2nd user, select the authentication factor from dropdown.
Click Save.

Reauthenticate Current User - Second Factor

Select Reauthenticate Current User - Second Factor.
From the Application Factor dropdown, choose the authentication factor assigned at the application level:
1. OLOID is Used as Primary and Secondary Auth Device
2. OLOID is Used as Primary Authentication Device
3. OLOID is Used as Secondary Authentication Device
Click Save.

Configure Factors

Configure the appropriate Primary and Secondary factors for second-factor reauthentication through Oloid.

To configure factors, do the following:
1. Under Select Primary Factor (Context 41), select one of the following options from dropdown:
  - Application Factor (default): Uses authentication factors assigned at application level.
  - First Factor Only: Uses only the first authentication factor configured.
  - Second Factor Only: Uses only the second authentication factor configured.
  - Oloid Session: Uses the user's existing Oloid session token, so the user is not prompted again for the primary factor. If the Oloid session is not found or has expired, Oloid falls back to Application Factor.
  - Custom Primary Factor: Uses the factors that you select in the Custom Factor dropdown.
2. If Custom Primary Factor, from the Custom Factor dropdown, select one or more factors, such as Face, Badge, PIN, Epic Password, QR Code, TOTP, Duo MFA, Ping MFA or Okta MFA.
3. Click Save.
  Note: The Custom Factor dropdown lists all factors supported for your tenant.
4. Under Select Secondary Factor (Context 42), select one of the following options from dropdown:
  - Application Factor (default): Uses authentication factors assigned at application level.
  - First Factor Only: Uses only the first authentication factor configured.
  - Second Factor Only: Uses only the second authentication factor configured.
  - Custom Secondary Factor: Uses the factors that you select in the Custom Factor dropdown.
5. If you selected Custom Secondary Factor, from the Custom Factor dropdown, select one or more factors.
  Note: Factors already selected for the Primary Factor (Context 41) are disabled in the Secondary Factor list, and vice versa.
6. Click Save.
Note: The Primary and Secondary factors must always be different. If you select a Custom option and do not choose any factor, Save is blocked and the error Select at least one custom factor. is displayed.

Reauthentication workflow successfully configured.