Matheswaran - Creating two separate websites may not work well since both sit under the same domain but use different web profiles and sites. That setup gives you no real control and introduces unnecessary security complexity.

It’s better to stay with a single web domain and handle MFA within the normal login flow. In other words, once the user’s credentials are verified (%PSAuthResult = True), you can trigger the MFA process directly from Signon PeopleCode by redirecting to your custom MFA page using SetAuthenticationResult

by passing &resultdoc. Make sure you look at signonresultdoctext.html

     SetAuthenticationResult( True, &user, &resultDoc, False, 0);

The caveat with this approach is that it isn’t true MFA. Once credentials are accepted and the user is routed to the MFA page, a simple browser refresh or using the deep link in a new tab could bypass the MFA check. It can also interfere with tools like ExcelToCI or 3-tier App Designer.From a security standpoint, it’s better to place MFA at the proxy layer and since you already have F5, that’s the ideal place to implement it. F5 can integrate directly with Microsoft Entra ID (Azure AD) and use the Microsoft Authenticator app, which is where most organizations are heading.

What you’re attempting is the older, application-level MFA pattern, and while it works technically with flaw, it’s not considered a best practice under current enterprise security standards.

-Velu

Hi – I’ve set this up for a few clients and it’s been working well. In our case, PIA login runs through Entra ID with header-based authentication, while ExcelToCI still uses LDAP.

The document I shared earlier comes directly from Microsoft. I’m not sure what you meant by “file size limits,” but essentially the setup just needs a proxy in front of the web server to insert the username header. The Signon PeopleCode then reads that header and authenticates the user.

The first document is fairly high-level, so I’m also sharing another, more detailed one from Microsoft. Hence asked op to send a DM to guide him further.

-Velu

This new PeopleTools document explains the best practices for how Cobol src files should be compiled/deployed after applying Tax Updates.

Doc ID 3101884.1. https://bit.ly/3W83vXw