MEEM is the MFA Enrollment and Exemption Manager. It is intended to coordinate enrollment in Multi-Factor Authentication. MEEM does not work with any specific technology, but is intended to work with Enrollment Flows and, indirectly, Authenticators.

MEEM has various configuration points, but broadly it is intended to integrate with two Enrollment Flows:

  1. A Self Signup or Invitation Flow (the "Initial" Enrollment Flow), used to perform general enrollment into the CO
  2. An MFA Authenticator Enrollment Flow, used to set up a Multi-Factor Authenticator for the Enrollee

(info) The MeemEnroller Plugin is considered Experimental.

Initial Enrollment Flow

The Initial Enrollment Flow should be considered as usual for Self Signup or Enrollment, including whatever Enrollment Attributes are desired. Beyond that, Email Confirmation must be set to either Automatic or Review. Do not Establish Authenticators as part of this flow.

Once the Enrollment Flow is created, attach an Enrollment Flow Wedge using the MeemEnroller Plugin. The following configurations are supported:

Configuration Flow Diagram

MFA Status

If MEEM is configured to record MFA Status, a database entry will be made recording the MeemEnroller configuration, the CO Person ID, the IdP Identifier, and whether or not MFA was asserted. Note MEEM does not currently update MFA Status outside of the Initial Enrollment Flow.

MFA Status may be examined using the REST API, below.

MFA Authenticator Enrollment Flow

The primary task of the MFA Authenticator Flow is to set up an Authenticator Plugin for use as a second factor. The flow should be configured as follows:

Do not attach any Enrollment Attributes to the flow.

Once the Enrollment Flow is created, attach an Enrollment Flow Wedge using the MeemEnroller Plugin. Leave all configuration options blank except MFA Exemption CO Group, which should be set to the same group as in the MeemEnroller configuration attached to the Initial Enrollment Flow. If the Enrollee successfully establishes the MFA Authenticator, the membership in the exemption group will be removed.

MFA Setup Reminder Splash Page

The MFA Setup Reminder Splash Page is a simple page that can be rendered to remind the Enrollee of the need to set up MFA. The page does not require authentication, as it does not access or display privileged information. The page will render when Enable MFA Setup Reminder Splash Page is enabled, and can be accessed using a URL of the form



If the Enrollee is still exempt (C is greater than 0), a choice will be provided to enroll now or later. If the Enrollee is no longer exempt, only an Enroll Now option will be presented (though of course the Enrollee could simply close the page).

The Splash Page will automatically render during the Initial Enrollment Flow (after the Provision step) when the following conditions are met:

  1. An MFA Exemption CO Group is set.
  2. An MFA Enrollment Flow is configured.
  3. The MFA Setup Reminder Splash Page is enabled.


MEEM provides a simple REST API to obtain information about a CO Person's MFA status. Access to the API is granted to the API User set in the Initial Enrollment Flow MeemEnroller configuration. The API is accessed at the endpoint



On success, a 200 OK response will be generated with a JSON object holding two members:

  "mfa_status": [
      "MeemMfaStatus": {
        "id": 4,
        "meem_enroller_id": 1,
        "co_person_id": 2528,
        "idp_identifier": "https://remote-user.test.idp",
        "mfa_asserted": false,
        "created": "2020-09-16 17:39:00",
        "modified": "2020-09-16 17:39:00",
        "meem_mfa_status_id": null,
        "revision": 0,
        "deleted": false,
        "actor_identifier": "danielbmorningstar"
  "mfa_exempt": "2020-09-19 17:39:00"