Getting Started
AuthNull adds multi-factor authentication and policy-based access control to the systems your users sign in to - Windows and Active Directory, databases, VPNs and network devices, and privileged servers. When a sign-in needs MFA, AuthNull sends a push to the user's phone through your MFA provider.
These steps are for administrators. End users only need to sign in to the end-user console and approve pushes.
Supported MFA Providers
AuthNull delivers pushes through your existing MFA provider:
| Provider | Push app | What you configure |
|---|---|---|
 Duo Security | Duo Mobile | Your Duo API hostname, Integration key, and Secret key |
 Okta Verify | Okta Verify | Your Okta org URL and an API token |
AuthNull Authenticator, AuthNull's own push app, is not released yet. Until it is, use Duo Security or Okta Verify. See AuthNull Authenticator (Coming Soon).
See MFA Providers to set one up.
Users also sign in to the AuthNull console itself with a password plus an authenticator app code (TOTP), a passkey, or a push.
Products
AuthNull is organised into four products. In the admin console, switch between them with Switch product at the top of the sidebar.
| Product | Protects | Guide |
|---|---|---|
| Identity | Directories, users, and Windows sign-in MFA | Identity MFA |
| Database | PostgreSQL and MySQL logins | Database MFA |
| RADIUS | VPNs and network devices | RADIUS MFA |
| PAM | Privileged SSH access to servers | PAM MFA |
Setup Steps
Step 1: Create Your Organization
Sign up at /org/signup on your AuthNull console - AuthNull Cloud, or your own server if you run AuthNull on-premises. The organization and its default tenant are created together, and you receive a "Tenant setup" email with your tenant's sign-in address.
Sign in, then set up your own second factor when prompted.
Step 2: Choose an MFA Provider
Open the account menu (top right), choose Settings → MFA Provider, and set up Duo Security or Okta Verify. See MFA Providers.
Step 3: Add Your Users
Bring in the people who will sign in:
- From a directory: in the Identity product, open Identity Sources → Add identity source and choose Active Directory or EntraID. See Connecting to Active Directory.
- Directly: Users → Add Users → Add User or Import Users. See Adding Users and Importing Users.
Step 4: Enrol Users with the MFA Provider
Users enrol in Duo Mobile or Okta Verify through your Duo or Okta organization. Their account there must use the same email address as in AuthNull - that is how pushes are routed.
Step 5: Start in Audit Mode
Open Settings → Tenant Configuration and set Authentication policy:
| Mode | What happens |
|---|---|
| Audit | Existing sign-ins are recorded and policies are created from them, so you can learn your environment without blocking anyone |
| Policy | Enforcement is simulated: you see which sign-ins would be blocked |
| Live mode | Zero trust: anything without a policy that allows it is blocked |
Start in Audit, review the policies it discovers, then move to Policy and finally Live mode. See Policy-Based Access Control.
Step 6: Set Up a Product
Follow the guide for the product you want to protect: Identity MFA, Database MFA, RADIUS MFA, or PAM MFA.
Step 7: Test and Review
Sign in to a protected system as a test user and approve the push. Each decision and its MFA outcome is recorded under Logs (Identity and RADIUS) or Access Logs (PAM).
Next Steps
- Overview and Architecture - how AuthNull fits into your environment
- Authenticating with Push MFA - what users see when they sign in
- Troubleshooting