LSEG Authentication Service Transformation  /  Product Upgrade Workspace






Technology changes to Standalone Eikon Messenger login and authentication




 
As part of our continuous efforts to deliver services of high quality and high availability to our customers, we will be upgrading the technology infrastructure used to login/authenticate into Messenger.

The new identity and access management services will improve performance, resilience and bolster security allowing us to provide new authentication options such as Enhanced Multi-Factor Authentication (MFA), and improvements to the password policy and login options in the future.

To avoid loss of service with your Refinitiv products you need to take action to prepare for the authentication platform change.


Actions you need to take:
  • Mandatory Standalone Eikon Messenger software upgrade to a minimum Refinitiv Workspace Standalone Messenger 1.20
  • Update network configuration

    • The new identity and authentication service is cloud-hosted and does not use static IP addresses.

    Internet & Delivery Direct

    You need to permit the following list of Fully Qualified Domain Names (FQDNs) according to your network delivery method.

    Note: You may have already allowed some of these domains as part of the rebranding changes made in 2021. Any existing whitelisted domains Refinitiv has previously communicated should not be removed.

    FQDN Delivery Protocol/Port Description New domain?
    *.refinitiv.com
    *.refinitiv.net
    *.refinitiv.biz    		 Internet
    Internet or Delivery Direct
    Delivery Direct    		 HTTPS/443 Login Authentication Password Reset No
    https://authenticator.pingone.com/ Internet HTTPS/443 Multi-Factor Ping Authenticator app Yes
    https://idpxnyl3m.pingidentity.com/ Internet HTTPS/443 Multi-Factor Ping Authenticator app Yes

    * Domains listed in the table are wildcard values, where a subdomain may prepend and/or append the listed domain

    **Login authentication is currently via the internet. Delivery Direct as a connectivity option will be introduced by Q2 2023.

    Delivery Direct

    To access new AWS service endpoints, customers using a private network must whitelist the following new IP addresses, which will impact Delivery Direct, FCN and CMC users.

    • 159.43.192.0/23 [AMERS]
    • 159.43.200.0/23 [EMEA]
    • 159.43.208.0/23 [APAC]

    To check if you are ready from a network perspective, click the link below to perform a system test (Windows and Mac):
     
    Please forward this communication to your Information Technology (IT) department for further review.

    We recommend that you review the frequently asked questions for more information and to ensure you are ready for the changes.

    If you have any questions, please contact your Refinitiv Account Team.

    Alternatively, click here to send an email and a representative will get back to you.


     

    Frequently asked questions

    What is happening?

    As part of our commitment to deliver high-quality and highly available services to our customers, we are updating the technology infrastructure used to login to/authenticate yourself on LSEG Workspace. The new identity and access management service will:

    • Improve performance
    • Enhance resilience
    • Bolster security allowing us to:
    • Provide new authentication options such as Enhanced Multi-Factor Authentication (MFA)
    • Make improvements to the password policy and login options in the future

    What benefits will I see?

    This update lays the groundwork for us soon to enable:

    • You to enjoy a truly flexible cross-platform experience with unbroken access between devices
    • Users of our Refinitiv 365 Office add-in to log into LSEG Workspace on their desktop at the same time and on the same machine
    • Users of Workspace Web will no longer require the LSEG Workspace Chrome Extension to share a session with Workspace for desktop and Workspace Microsoft Office add-ins

    When is this happening?

    The update will be phased and will begin in Q1 2023. The following table provides more specific advice for users of different LSEG Workspace products.

    Product User actions
    Desktop (and Office add-in) Ensure that you’re ready to begin this update by the end of Q1 2023. We request that you complete your desktop update by the end of July 2023.
    Mobile You’ll be prompted to update your apps to accommodate a corresponding update to Workspace Mobile during Q2 2023.
    Web and Office Web add-in (Refinitiv 365) Ensure that you’re ready for this change by the end of Q1 2023.
    Refinitiv Messenger Standalone Ensure that you’re ready for this change by the end of Q1 2023.
    Eikon® Messenger Standalone Be prepared to move to the Workspace package during Q1 2023.

    Note: Single Sign-On (SSO) and SDK customers, please see the instructions included in this pack.

    Do I need to do anything to prepare?

    Remember your username and password.

    Usernames will remain the same, and you can log in with your existing credentials after the update. When logging into Workspace through the new authentication platform for the first time, you will be asked to enter both your username and password.

    Note: It is important to make sure you remember your current password or reset it in advance.

    As part of the new password authentication policy, you’ll need to enter your password every time you sign into the product. The ‘Remember me’ option for password retention will no longer be available.

    Required actions for users of specific products and services

    Product and service Date available Action required
    Desktop (and Office add-in) Jan 2023 – Update to v1.20 if you are an internet hosted user
    – Update to v1.22 if you are the Private Network user
    – Update Network configuration
    Standalone Messenger Jan 2023 – Update to v1.20 if you are an internet hosted user
    – Update to v1.22 if you are the Private Network user
    – If you’re logging into Refinitiv Messenger for the first time, you may have to reset your password using the ‘Forgotten your password’ link on the sign-in page
    Web, Web Messenger, Office Web add-in (Refinitiv 365) April 2023 – Update Network configuration – see the Internet and Private Network section
    – No action is required for existing LSEG Workspace Chrome Extension as the session sharing feature will continue to work post migration.
    – If you’re a web user and have the URL for the *.login.cp.thomsonreuters.net login page bookmarked, you’ll need to update your browser bookmark to https://workspace.refinitiv.com/web for internet and https://workspace.extranet.refinitiv.biz/web for private network to ensure you can access the service using the new login page. 
    Mobile Q2 2023 – There is no action required for users with auto-updates enabled.
    – For remaining users, you will be prompted in-app to update to Workspace for iOS Version 1.16 or Workspace for Android 1.3, at the appropriate point in time.
    – Please note, Android users in regions where Google Services are in-accessible will need to update using the dedicated download link as normal. This should be completed at the end of Q2.
    SDK API TBC – You’ll need to validate your authentication flow in SDK after the Workspace Web or Desktop you use is switched to the new authentication platform
    Single Sign-On TBC – Update version 1.22 (or higher) as soon as practical after it has been released (Hosted Internet and Private connection users)
    – Update Network configuration
    – You will receive further information about the timelines for any more required changes at the appropriate time, when you will be guided by an LSEG representative.
    Delivery Direct/Private Network Q2 2023 – Update network configuration – see the Internet and Private Network section

    What updates are required for customers accessing Workspace via internet and private network?

    The new identity and authentication service is cloud-hosted and does not use static IP addresses.

    Internet & Delivery Direct

    You need to permit the following list of Fully Qualified Domain Names (FQDNs) according to your network delivery method.

    Note: You may have already allowed some of these domains as part of the rebranding changes made in 2021. Any existing whitelisted domains Refinitiv has previously communicated should not be removed.

    FQDN Delivery Protocol/Port Description New domain?
    *.refinitiv.com
    *.refinitiv.net
    *.refinitiv.biz    		 Internet
    Internet or Delivery Direct
    Delivery Direct    		 HTTPS/443 Login Authentication Password Reset No
    https://authenticator.pingone.com/ Internet HTTPS/443 Multi-Factor Ping Authenticator app Yes
    https://idpxnyl3m.pingidentity.com/ Internet HTTPS/443 Multi-Factor Ping Authenticator app Yes

    * Domains listed in the table are wildcard values, where a subdomain may prepend and/or append the listed domain

    **Login authentication is currently via the internet. Delivery Direct as a connectivity option will be introduced by Q2 2023.

    Delivery Direct

    To access new AWS service endpoints, customers using a private network must whitelist the following new IP addresses, which will impact Delivery Direct, FCN and CMC users.

    • 159.43.192.0/23 [AMERS]
    • 159.43.200.0/23 [EMEA]
    • 159.43.208.0/23 [APAC]

    What changes are required for Single Sign On?

    Currently the Single Sign - On (SSO) service is hosted by ForgeRock, but in the future a new system hosted by Ping Identity® will act as the SSO solution for secure access to London Stock Exchange (LSEG) systems for customers.

    The current SSO set-up supports the Identity Provider (IDP) initiated login flow. In the future we will support, by default, the Service Provider (SDP) initiated flow.

    When can I test the new service?

    Please use the following testing tools.

    1. To run a comprehensive check of your network readiness for CIAM platform you can use the standalone system test (for both Windows and Mac) click on this link: https://emea1-apps.platform.refinitiv.com/Apps/ProductSystemTest/

    2. Click on the url: Validation tool (refinitiv.com) enter you valid Workspace login credentials. This simple test checks if your login credentials are correctly reflected in the CIAM authentication platform and if your network can access the basic CIAM login domain. PLEASE NOTE TO USE IT FOR INTERNET ONLY CONNECTION

    What is the new password policy?

    We’ll communicate details on password requirements separately. We’ll also provide on-screen prompts when you’re logging in for the first time with the new hyperlink.

    Can I still change my password?

    Yes, you’ll be able to change your password using the same options available today. These include:

    • Using the ‘Forgotten password’ link on the login page
    • Going to the LSEG Workspace Password settings, available here: LSEG Workspace > Profile Menu > Password Settings
    • Contacting the Help Desk via the My.Refinitiv.com help portal

    What will the new login page look like?

    1) We’ve removed the ‘Cancel’ button. To provide our users with an up to date user experience, we have moved the Cancel button as it does not perform any relevant function. For example, a user that is logging in via a desktop browser can either end their actions by closing their browser or navigate back using their browser back button.

    2) We’ve removed the ‘Sign me in automatically’ functionality and replaced it with ‘Remember my username’ functionality. This is to keep our users and company safe from bad actors, by incorporating the latest security standards into our platforms.

    3) We’ve implemented a ‘Remember my username’ functionality, which saves time when logging in. The user simply needs to click the check box and their username will be prepopulated on subsequent logins.

    4) We’ve implemented an ‘x’ button in the top right hand corner for installed applications where the browser back button is not available. When a user opens an installed application then decides to discontinue their login journey, the ‘x’ button closes the login screen.

    Note: Remember to update your bookmarks with the new hyperlink. The new login page will look like this:

    Will other products be impacted by this change?

    Yes, other products will eventually be impacted. You’ll receive instructions about what to do at the appropriate time.

    If I upgrade from Eikon Messenger to Refinitiv Messenger, is the history preserved?

    All my conversations, chat groups, and contacts going to be preserved.

    What is the impact on Refinitiv Messenger Compliance(RMC) when moving from Eikon Standalone Messenger to Workspace messenger? i.e., if customers have RMC setup and active on Eikon Standalone Messenger, is that seamlessly transferred and continued after the upgrade to Refinitiv Messenger.

    There is no impact on Refinitiv Messenger Compliance.

    If a customer uses Eikon Standalone Messenger accessing it ONLY via web browser or mobile do they need to take any action?

    Only customers signing into Eikon Messenger Standalone installed software are in scope for 1.20 upgrade. Users who access via web only are not impacted as long as they sign in via web browser URL only.

    Will my password stay the same if I’m running Workspace alongside FX Trading?

    Yes, the password will remain the same for both products.

     
    Additional resources
     

    Ask a question

    We aim to deliver a world-class customer onboarding experience for LSEG solutions by knowing our customers, engaging proactively, and ensuring swift and accurate delivery of our products and services. If you have questions, we are here to help.