Configure EFT to Use Web Admin

The Web Admin console is based on the REST API, so you must have REST API configured in the EFT administration interface, on the Server > Administration tab.

EFT now allows administrators to enforce MFA for EFT administration logins while optionally excluding REST API calls and the Web Admin client from MFA enforcement.

This provides flexibility for organizations that:

  • Require MFA for interactive admin access (EFT Admin GUI).

  • Want to avoid breaking automated integrations or internal tools that use the EFT REST API and cannot easily supply an MFA second factor.

With this improvement, you can:

  • Enable MFA globally for EFT admin accounts via Account Policies.

  • Then override whether MFA is enforced for:

    • The REST API, and

    • The Web Admin client.

When You Might Disable MFA for REST API or Web Admin

Typical use cases include:

  • Internal only REST API

    • Your REST API is only accessible from trusted internal networks, and you rely on network controls, firewalls, and service accounts with strong credentials, rather than MFA, for automated scripts and tools (for example, Postman, CI/CD pipelines, or monitoring systems).

  • Legacy or non interactive clients

    • Existing tools or scripts cannot be updated to handle MFA prompts or second factor codes, but you still want to enforce MFA for human administrators using the EFT Admin GUI.

  • Phased MFA rollout

    • You want to turn on MFA for EFT admin GUI logins first, then later enable MFA for the Web Admin client and REST API once your integration landscape is ready.

IMPORTANT: Disabling MFA for REST API or Web Admin reduces the overall strength of admin authentication for those channels. Use this override only when you have compensating controls in place (network isolation, IP allowlists, dedicated service accounts, etc.).

Prerequisites

Before you can override MFA behavior for REST API and Web Admin, ensure that:

  1. You have configured MFA under Account Policy (Specifying Multifactor Authentication).

  2. You are running a version of EFT that includes MFA admin support (introduced in EFT 8.3.0).

If MFA is not enabled at the server level, the REST API/Web Admin MFA override option will be dimmed.

How MFA Overrides Work

Once MFA is enabled for admin accounts, EFT exposes an option to enforce or bypass MFA for REST API and Web Admin:

  • A dedicated “Require additional factor auth” checkbox is available in the remote administration settings area.

  • This checkbox:

    • Dimmed (disabled) when MFA is not enabled on the server, under Account Policy (Specifying Multifactor Authentication).

    • Enabled by default when MFA is enabled at the server level.

    • Inherits MFA configuration from the Account Policy:

      • Same MFA provider (email or SMS)

      • Same policy rules apply

  • Behavior:

    • When enabled

      • MFA is required for REST API calls and the Web Admin client authentication, in addition to the EFT Admin GUI.

    • When disabled

      • REST API calls and Web Admin logins do not enforce MFA, even though MFA is enabled for EFT admin accounts in general via the Admin GUI.

This gives you a simple on/off toggle to bring REST API and Web Admin into the same MFA policy as the EFT Admin GUI, or to exclude them.

Configuring MFA Enforcement for REST API and Web Admin

Step 1: Enable MFA at the Server (Account Policy)

  1. Open the EFT administration console.

  2. Select the Server node (Localhost).

  3. Navigate to Administration tab for administrator accounts.

  4. Enable Multi Factor Authentication (MFA) for admin logins (Specifying Multifactor Authentication).

  5. Configure the desired MFA provider and settings:

    • Delivery method (e.g., email, SMS).

Once MFA is enabled here, EFT will:

  • Enforce MFA for EFT Admin GUI logins.

  • Enable the REST API/Web Admin MFA override option described below.

Step 2: Configure REST API / Web Admin MFA Override

  1. Still in the Administration configuration, locate the checkbox named: Require additional factor auth.

  2. Review the option state:

    • If MFA is not enabled, this checkbox will be dimmed and cannot be modified.

    • If MFA is enabled, the checkbox is:

      • Enabled by default (meaning REST API and Web Admin honor MFA).

  3. Choose the behavior you want:

    • To enforce MFA for all admin channels (recommended baseline):

      • Ensure Require additional factor auth is checked.

      • Result:

        • EFT Admin GUI: MFA required (not impacted by this checkbox).

        • Web Admin client: MFA required.

        • REST API based admin calls: MFA requirements apply (see API client considerations below).

    • To enforce MFA only for the EFT Admin GUI (exclude REST API/Web Admin):

      • Uncheck Require additional factor auth.

      • Result:

        • EFT Admin GUI: MFA required.

        • Web Admin client: No MFA enforced.

        • REST API based admin calls: No MFA enforced.

  4. Save your changes.

Behavior by Access Channel

Once configured, the behavior is:

EFT Admin GUI (Desktop Admin Client)

  • Governed by Account Policy MFA settings.

  • Not affected by the “Require additional factor auth” override.

  • If MFA is enabled at the server:

    • EFT Admin GUI logins require MFA.

Web Admin Client

  • Governed by:

    • Global MFA setting under Account Policy, and

    • The Require additional factor auth checkbox.

  • Behavior:

    • If MFA is enabled and the override is enabled:

      • Web Admin logins require MFA, as defined by your MFA.

    • If MFA is enabled but the override is disabled:

      • Web Admin logins do not require MFA, even though admin GUI does.

REST API (Admin Endpoints)

  • Governed by:

    • Global MFA setting, and

    • The Require additional factor auth checkbox.

  • Behavior:

    • If MFA is enabled and the override is enabled:

      • REST API authentication flows must satisfy MFA.

      • APIs such as:

        • POST /admin/v2/authentication

        • Related MFA verification endpoints will enforce the second factor in accordance with your account policy.

    • If MFA is enabled but the override is disabled:

      • REST API calls authenticate using their existing methods (for example, credentials/tokens) without MFA.

NOTE: The intent is that calls originating from tools like Postman or other headless integrations can be exempted from MFA by disabling this override, while still securing interactive GUI access with MFA.

Security Considerations

When deciding whether to disable MFA for REST API or Web Admin:

  • Network exposure

    • If your REST API is exposed to the internet, disabling MFA significantly increases risk. Consider keeping MFA enabled or using network-level restrictions (VPN, IP allowlists).

  • Service accounts

    • If you disable MFA for REST API but use strong, dedicated service accounts with long, random passwords or tokens, the risk may be acceptable for strict internal use.

  • Audit and monitoring

    • Enable detailed logging on admin REST API usage and Web Admin logins.

    • Monitor for suspicious patterns (unexpected IPs, unusual times, brute force attempts).

Best Practice

  • Start with MFA enforced for all admin channels (EFT Admin GUI, Web Admin, REST API).

  • Only disable MFA for REST API/Web Admin when:

    • You have identified specific integrations that cannot support MFA, and

    • You have compensating controls in place.

Troubleshooting and Common Scenarios

REST API Integration Breaks After Enabling MFA

Symptoms:

  • Automated scripts or tools (e.g., Postman collections, CI/CD jobs) that previously worked start failing authentication once MFA is turned on.

Resolution:

  1. Confirm MFA has been enabled for admin accounts under Account Policy.

  2. Check the Enforce additional factor auth for REST API and Web Admin setting:

    • If you want scripts to bypass MFA:

      • Uncheck the option and save.

    • If you want scripts to use MFA:

      • Ensure the client can handle the MFA flow and that your REST endpoints are updated according to your integration design.

Web Admin Users Not Prompted for MFA

  • Ensure that:

    1. MFA is enabled at the server (Account Policy).

    2. Enforce additional factor auth for REST API and Web Admin is checked.

  • If MFA is enabled but the checkbox is off, Web Admin will not require MFA.

To configure EFT to use the Web Admin

  1. Log in to the EFT administration interface, then click the Server > Administration tab.

  2. Select the Allow remote administration check box.

  3. Select the Enable REST API / web admin check box.

  4. In REST API/ web admin port, specify the port number if it is different from the default (4450).

  5. Select the Require SSL for remote administration check box, and create or specify the SSL certificate.

  6. In Administrator Access and Permissions, select the admin account(s) that need to administer Web Admin, then select the Web Admin Client check box, and the Programmatic API Policy, and then select server_full_access.

  7. Click Apply to save these settings.

To enable MFA for the Web Admin

  1. Enable MFA for EFT administration, review Specifying Multifactor Authentication.

  2. Enable the Require additional factor auth (review Account Policy Settings) check box.

  3. Click Apply to save these settings.

To disable MFA for the Web Admin and REST API

  1. Enable MFA for EFT administration, review Specifying Multifactor Authentication.

  2. Uncheck the Require additional factor auth (review Account Policy Settings) check box.

  3. Click Apply to save these settings.