@itentialopensource/adapter-utils 4.48.5 → 4.48.7

package/lib/connectorRest.js

@@ -47,6 +47,7 @@ let basepath = null;
 let version = null;
 let choosepath = null;
 let authMethod = null;
+let multiStepAuthCalls = null;
 let authField = null;
 let authFormat = null;
 let authLogging = false;
@@ -78,6 +79,7 @@ let sslCAFile = null;
 let sslKeyFile = null;
 let sslCertFile = null;
 let sslCiphers = null;
+let sslPassphrase = null;
 let secureProtocol = null;
 let proxyEnabled = false;
 let proxyHost = null;
@@ -116,6 +118,8 @@ let cacheHHead = null;
 let cacheHSchema = null;
 let cacheHPay = null;
 
+const mfaStepsResults = []; // keeps requested result for each step
+
 /* CONNECTOR ENGINE INTERNAL FUNCTIONS         */
 /** Wait for adapter-mongo to be available.
  * @summary adapter may load before adapter-mongo but it requires UPDATE: test if dbUtil object can connect.
@@ -1083,7 +1087,6 @@ function findExpireInResult(result) {
   const origin = `${id}-connectorRest-findExpireInResult`;
   log.trace(origin);
   let expire = null;
-
   if (!result) {
     return expire;
   }
@@ -1116,884 +1119,932 @@ function findExpireInResult(result) {
  * INTERNAL FUNCTION: makes the request and processes the response
  * for the request to get the token
  */
-function getToken(reqPath, options, tokenSchema, bodyString, callProperties, callback) {
+async function getToken(reqPath, options, tokenSchema, bodyString, callProperties, callback) {
   const origin = `${id}-connectorRest-getToken`;
   log.trace(origin);
 
-  try {
-    // no need for orig path since we handled the stub case
-    const request = {
-      header: options,
-      body: bodyString,
-      origPath: tokenSchema.entitypath
-    };
-
-    // set stub if that is the mode we are in
-    let useStub = false;
-    if (callProperties && Object.hasOwnProperty.call(callProperties, 'stub')) {
-      useStub = callProperties.stub;
-    } else if (stub) {
-      useStub = stub;
-    }
-
-    // if there is a mock result, return that
-    if (useStub && tokenSchema) {
-      // get the data from the mock data file
-      const tokenResp = returnStub(request, tokenSchema, callProperties);
-
-      // if the request failed, return the error
-      if (tokenResp.code < 200 || tokenResp.code > 299) {
-        const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Authenticate', ['Token', tokenResp.code], null, null, null);
-        log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-        return callback(null, errorObj);
-      }
+  const p = new Promise((resolve, reject) => {
+    try {
+      // no need for orig path since we handled the stub case
+      const request = {
+        header: options,
+        body: bodyString,
+        origPath: tokenSchema.entitypath
+      };
 
-      if (!tokenSchema.responseDatatype || tokenSchema.responseDatatype === 'JSON') {
-        tokenResp.response = JSON.parse(tokenResp.response);
+      // set stub if that is the mode we are in
+      let useStub = false;
+      if (callProperties && Object.hasOwnProperty.call(callProperties, 'stub')) {
+        useStub = callProperties.stub;
+      } else if (stub) {
+        useStub = stub;
       }
-      log.debug(`${origin}: ${JSON.stringify(tokenResp.response)}`);
 
-      // return the token from the token schema
-      let translated = null;
-      if (typeof tokenResp.response !== 'string') {
-        translated = transUtilInst.mapFromOutboundEntity(tokenResp.response, tokenSchema.responseSchema);
-      } else {
-        translated = tokenResp.response;
-      }
+      // if there is a mock result, return that
+      if (useStub && tokenSchema) {
+        // get the data from the mock data file
+        const tokenResp = returnStub(request, tokenSchema, callProperties);
 
-      // since this is a stub, make sure we have what we need
-      if (!translated.token) {
-        translated.token = 'garbagetoken';
-      }
-      if (!translated.tokenp2) {
-        translated.tokenp2 = 'garbagetoken';
-      }
+        // if the request failed, return the error
+        if (tokenResp.code < 200 || tokenResp.code > 299) {
+          const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Authenticate', ['Token', tokenResp.code], null, null, null);
+          log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+          return reject(errorObj);
+        }
 
-      // if what we got back is an array, just return the first element
-      // should only have one token!!!
-      if (translated && Array.isArray(translated)) {
-        translated[0].front = tokenSchema.responseSchema.properties.token.front;
-        translated[0].end = tokenSchema.responseSchema.properties.token.end;
-        return callback(translated[0]);
-      }
+        if (!tokenSchema.responseDatatype || tokenSchema.responseDatatype === 'JSON') {
+          tokenResp.response = JSON.parse(tokenResp.response);
+        }
+        log.debug(`${origin}: ${JSON.stringify(tokenResp.response)}`);
 
-      // return the token that we find in the translated object
-      translated.front = tokenSchema.responseSchema.properties.token.front;
-      translated.end = tokenSchema.responseSchema.properties.token.end;
-      return callback(translated);
-    }
+        // return the token from the token schema
+        let translated = null;
+        if (typeof tokenResp.response !== 'string') {
+          translated = transUtilInst.mapFromOutboundEntity(tokenResp.response, tokenSchema.responseSchema);
+        } else {
+          translated = tokenResp.response;
+        }
 
-    if (useStub || reqPath === tokenPath || (tokenSchema && reqPath === tokenSchema.entitypath)) {
-      // do not make the call to return a token if the request is actually
-      // to get a token. Getting a token to get a token -- that should go
-      // direct to make request
-      return callback({ token: 'faketoken', tokenp2: 'faketoken' });
-    }
+        // since this is a stub, make sure we have what we need
+        if (!translated.token) {
+          translated.token = 'garbagetoken';
+        }
+        if (!translated.tokenp2) {
+          translated.tokenp2 = 'garbagetoken';
+        }
 
-    log.debug(`${origin}: OPTIONS: ${JSON.stringify(options)}`);
+        // if what we got back is an array, just return the first element
+        // should only have one token!!!
+        if (translated && Array.isArray(translated)) {
+          translated[0].front = tokenSchema.responseSchema.properties.token.front;
+          translated[0].end = tokenSchema.responseSchema.properties.token.end;
+          return resolve(translated[0]);
+        }
 
-    // request the token
-    return makeRequest(request, tokenSchema, callProperties, null, 0, (result, merror) => {
-      if (merror) {
-        return callback(null, merror);
+        // return the token that we find in the translated object
+        translated.front = tokenSchema.responseSchema.properties.token.front;
+        translated.end = tokenSchema.responseSchema.properties.token.end;
+        return resolve(translated);
       }
 
-      // if the request is a redirect, try to pull token but log a warning
-      let handleTokenRedirect = false;
-      if (result.code >= 300 && result.code <= 308 && numRedirects === 0) {
-        log.warn(`${origin}: Going to attempt to get token from redirect message!`);
-        handleTokenRedirect = true;
+      if (useStub || reqPath === tokenPath || (tokenSchema && reqPath === tokenSchema.entitypath)) {
+        // do not make the call to return a token if the request is actually
+        // to get a token. Getting a token to get a token -- that should go
+        // direct to make request
+        return resolve({ token: 'faketoken', tokenp2: 'faketoken' });
       }
 
-      // if the request failed, return the error
-      if ((result.code < 200 || result.code > 299) && !handleTokenRedirect) {
-        const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Authenticate', ['Token', result.code], null, null, null);
-        log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-        return callback(null, errorObj);
-      }
+      log.debug(`${origin}: OPTIONS: ${JSON.stringify(options)}`);
 
-      if (!tokenSchema) {
-        // if no token schema, can not determine what to return
-        const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Authenticate', ['Token', result.code], null, null, null);
-        log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-        return callback(null, errorObj);
-      }
+      // request the token
+      return makeRequest(request, tokenSchema, callProperties, null, 0, (result, merror) => {
+        if (merror) {
+          return reject(merror);
+        }
 
-      // parse the token out of the result
-      const currResult = {
-        token: null,
-        tokenp2: null,
-        front: tokenSchema.responseSchema.properties.token.front,
-        end: tokenSchema.responseSchema.properties.token.end
-      };
+        // if the request is a redirect, try to pull token but log a warning
+        let handleTokenRedirect = false;
+        if (result.code >= 300 && result.code <= 308 && numRedirects === 0) {
+          log.warn(`${origin}: Going to attempt to get token from redirect message!`);
+          handleTokenRedirect = true;
+        }
 
-      // process primary token from header
-      if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
-        && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'HEADER') {
-        if (!tokenSchema.responseSchema.properties.token.external_name) {
-          const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Get Primary Token', ['Primary Token', result.code], null, null, null);
+        // if the request failed, return the error
+        if ((result.code < 200 || result.code > 299) && !handleTokenRedirect) {
+          const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Authenticate', ['Token', result.code], null, null, null);
+          if (callProperties && callProperties.mfa && callProperties.mfa.successfullResponseCode) { // MFA call
+            if (callProperties.mfa.successfullResponseCode !== result.code) {
+              log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+              return reject(errorObj);
+            }
+          } else { // non-MFA call
+            log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+            return reject(errorObj);
+          }
+        }
+
+        if (!tokenSchema) {
+          // if no token schema, can not determine what to return
+          const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Authenticate', ['Token', result.code], null, null, null);
           log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-          return callback(null, errorObj);
+          return reject(errorObj);
         }
 
-        const exName = tokenSchema.responseSchema.properties.token.external_name.toLowerCase();
-        const headKeys = Object.keys(result.headers);
-        let fullToken = null;
-        let setCookie = null;
+        // parse the token out of the result
+        const currResult = {
+          token: null,
+          tokenp2: null,
+          front: tokenSchema.responseSchema.properties.token.front,
+          end: tokenSchema.responseSchema.properties.token.end
+        };
 
-        // go through and find the token
-        for (let h = 0; h < headKeys.length; h += 1) {
-          if (headKeys[h].toLowerCase() === exName) {
-            fullToken = result.headers[headKeys[h]];
-            currResult.token = result.headers[headKeys[h]];
+        // process primary token from header
+        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
+          && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'HEADER') {
+          if (!tokenSchema.responseSchema.properties.token.external_name) {
+            const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Get Primary Token', ['Primary Token', result.code], null, null, null);
+            log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+            return reject(errorObj);
           }
-          if (headKeys[h].toLowerCase() === 'set-cookie') {
-            setCookie = result.headers[headKeys[h]];
+
+          const exName = tokenSchema.responseSchema.properties.token.external_name.toLowerCase();
+          const headKeys = Object.keys(result.headers);
+          let fullToken = null;
+          let setCookie = null;
+
+          // go through and find the token
+          for (let h = 0; h < headKeys.length; h += 1) {
+            if (headKeys[h].toLowerCase() === exName) {
+              fullToken = result.headers[headKeys[h]];
+              currResult.token = result.headers[headKeys[h]];
+            }
+            if (headKeys[h].toLowerCase() === 'set-cookie') {
+              setCookie = result.headers[headKeys[h]];
+            }
           }
-        }
 
-        // if the token is in the requestToken
-        if (exName === 'requestcookie' && result.requestCookie) {
-          currResult.token = result.requestCookie;
-        }
+          // if the token is in the requestToken
+          if (exName === 'requestcookie' && result.requestCookie) {
+            currResult.token = result.requestCookie;
+          }
 
-        // if the exName field is an array
-        if (exName === 'set-cookie' && fullToken && Array.isArray(fullToken)) {
-          currResult.token = fullToken[0];
-          for (let ex = 1; ex < fullToken.length; ex += 1) {
-            currResult.token += `; ${fullToken[ex]}`;
+          // if the exName field is an array
+          if (exName === 'set-cookie' && fullToken && Array.isArray(fullToken)) {
+            currResult.token = fullToken[0];
+            for (let ex = 1; ex < fullToken.length; ex += 1) {
+              currResult.token += `; ${fullToken[ex]}`;
+            }
           }
-        }
 
-        // if the token has been returned in the cookie
-        if (exName.substring(0, 11) === 'set-cookie.') {
-          const fname = exName.substring(11).toLowerCase();
-          let thisCook = null;
-
-          // if the cookie is an array - usual case
-          if (setCookie && Array.isArray(setCookie)) {
-            // go through the array looking for the defined token field
-            for (let sc = 0; sc < setCookie.length; sc += 1) {
-              // parses the cookie into an object
-              thisCook = cookieHandler.parse(setCookie[sc]);
+          // if the token has been returned in the cookie
+          if (exName.substring(0, 11) === 'set-cookie.') {
+            const fname = exName.substring(11).toLowerCase();
+            let thisCook = null;
+
+            // if the cookie is an array - usual case
+            if (setCookie && Array.isArray(setCookie)) {
+              // go through the array looking for the defined token field
+              for (let sc = 0; sc < setCookie.length; sc += 1) {
+                // parses the cookie into an object
+                thisCook = cookieHandler.parse(setCookie[sc]);
+                const cookKeys = Object.keys(thisCook);
+                let set = false;
+
+                // go through the cookie to find the token
+                for (let h = 0; h < cookKeys.length; h += 1) {
+                  if (cookKeys[h].toLowerCase() === fname) {
+                    currResult.token = thisCook[cookKeys[h]];
+                    set = true;
+                    break;
+                  }
+                }
+                if (set) {
+                  break;
+                }
+              }
+            } else if (setCookie) {
+              // if the cookie is just one string, parse into an object
+              thisCook = cookieHandler.parse(setCookie);
               const cookKeys = Object.keys(thisCook);
-              let set = false;
 
               // go through the cookie to find the token
               for (let h = 0; h < cookKeys.length; h += 1) {
                 if (cookKeys[h].toLowerCase() === fname) {
                   currResult.token = thisCook[cookKeys[h]];
-                  set = true;
                   break;
                 }
               }
-              if (set) {
-                break;
-              }
-            }
-          } else if (setCookie) {
-            // if the cookie is just one string, parse into an object
-            thisCook = cookieHandler.parse(setCookie);
-            const cookKeys = Object.keys(thisCook);
-
-            // go through the cookie to find the token
-            for (let h = 0; h < cookKeys.length; h += 1) {
-              if (cookKeys[h].toLowerCase() === fname) {
-                currResult.token = thisCook[cookKeys[h]];
-                break;
-              }
             }
           }
         }
-      }
 
-      // process second token from header
-      if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
-        && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'HEADER') {
-        if (!tokenSchema.responseSchema.properties.tokenp2.external_name) {
-          const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Get Secondary Token', ['Secondary Token', result.code], null, null, null);
-          log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-          return callback(null, errorObj);
-        }
+        // process second token from header
+        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
+          && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'HEADER') {
+          if (!tokenSchema.responseSchema.properties.tokenp2.external_name) {
+            const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Get Secondary Token', ['Secondary Token', result.code], null, null, null);
+            log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+            return reject(errorObj);
+          }
 
-        const exName = tokenSchema.responseSchema.properties.tokenp2.external_name.toLowerCase();
-        const headKeys = Object.keys(result.headers);
-        let fullToken = null;
-        let setCookie = null;
+          const exName = tokenSchema.responseSchema.properties.tokenp2.external_name.toLowerCase();
+          const headKeys = Object.keys(result.headers);
+          let fullToken = null;
+          let setCookie = null;
 
-        // go through and find the token
-        for (let h = 0; h < headKeys.length; h += 1) {
-          if (headKeys[h].toLowerCase() === exName) {
-            fullToken = result.headers[headKeys[h]];
-            currResult.tokenp2 = result.headers[headKeys[h]];
-          }
-          if (headKeys[h].toLowerCase() === 'set-cookie') {
-            setCookie = result.headers[headKeys[h]];
+          // go through and find the token
+          for (let h = 0; h < headKeys.length; h += 1) {
+            if (headKeys[h].toLowerCase() === exName) {
+              fullToken = result.headers[headKeys[h]];
+              currResult.tokenp2 = result.headers[headKeys[h]];
+            }
+            if (headKeys[h].toLowerCase() === 'set-cookie') {
+              setCookie = result.headers[headKeys[h]];
+            }
           }
-        }
 
-        // if the token is in the requestToken
-        if (exName === 'requestcookie' && result.requestCookie) {
-          currResult.token = result.requestCookie;
-        }
+          // if the token is in the requestToken
+          if (exName === 'requestcookie' && result.requestCookie) {
+            currResult.token = result.requestCookie;
+          }
 
-        // if the exName field is an array
-        if (exName === 'set-cookie' && fullToken && Array.isArray(fullToken)) {
-          currResult.tokenp2 = fullToken[0];
-          for (let ex = 1; ex < fullToken.length; ex += 1) {
-            currResult.tokenp2 += `; ${fullToken[ex]}`;
+          // if the exName field is an array
+          if (exName === 'set-cookie' && fullToken && Array.isArray(fullToken)) {
+            currResult.tokenp2 = fullToken[0];
+            for (let ex = 1; ex < fullToken.length; ex += 1) {
+              currResult.tokenp2 += `; ${fullToken[ex]}`;
+            }
           }
-        }
 
-        // if the token has been returned in the cookie
-        if (exName.substring(0, 11) === 'set-cookie.') {
-          const fname = exName.substring(11).toLowerCase();
-          let thisCook = null;
-
-          // if the cookie is an array - usual case
-          if (setCookie && Array.isArray(setCookie)) {
-            // go through the array looking for the defined token field
-            for (let sc = 0; sc < setCookie.length; sc += 1) {
-              // parses the cookie into an object
-              thisCook = cookieHandler.parse(setCookie[sc]);
+          // if the token has been returned in the cookie
+          if (exName.substring(0, 11) === 'set-cookie.') {
+            const fname = exName.substring(11).toLowerCase();
+            let thisCook = null;
+
+            // if the cookie is an array - usual case
+            if (setCookie && Array.isArray(setCookie)) {
+              // go through the array looking for the defined token field
+              for (let sc = 0; sc < setCookie.length; sc += 1) {
+                // parses the cookie into an object
+                thisCook = cookieHandler.parse(setCookie[sc]);
+                const cookKeys = Object.keys(thisCook);
+                let set = false;
+
+                // go through the cookie to find the token
+                for (let h = 0; h < cookKeys.length; h += 1) {
+                  if (cookKeys[h].toLowerCase() === fname) {
+                    currResult.tokenp2 = thisCook[cookKeys[h]];
+                    set = true;
+                    break;
+                  }
+                }
+                if (set) {
+                  break;
+                }
+              }
+            } else if (setCookie) {
+              // if the cookie is just one string, parse into an object
+              thisCook = cookieHandler.parse(setCookie);
               const cookKeys = Object.keys(thisCook);
-              let set = false;
 
               // go through the cookie to find the token
               for (let h = 0; h < cookKeys.length; h += 1) {
                 if (cookKeys[h].toLowerCase() === fname) {
                   currResult.tokenp2 = thisCook[cookKeys[h]];
-                  set = true;
                   break;
                 }
               }
-              if (set) {
-                break;
-              }
-            }
-          } else if (setCookie) {
-            // if the cookie is just one string, parse into an object
-            thisCook = cookieHandler.parse(setCookie);
-            const cookKeys = Object.keys(thisCook);
-
-            // go through the cookie to find the token
-            for (let h = 0; h < cookKeys.length; h += 1) {
-              if (cookKeys[h].toLowerCase() === fname) {
-                currResult.tokenp2 = thisCook[cookKeys[h]];
-                break;
-              }
             }
           }
         }
-      }
 
-      // process the body
-      // if response is just a string
-      if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'PLAIN') {
-        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
-          && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
-          currResult.token = result.response;
+        // process the body
+        // if response is just a string
+        if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'PLAIN') {
+          if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
+            && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
+            currResult.token = result.response;
 
-          // if we got a stringified string - we can remove the double quotes wrapping it
-          if (currResult.token.substring(0, 1) === '"' && currResult.token.substring(-1, 1) === '"') {
-            currResult.token = currResult.token.substring(1, currResult.token.length - 1);
+            // if we got a stringified string - we can remove the double quotes wrapping it
+            if (currResult.token.substring(0, 1) === '"' && currResult.token.substring(-1, 1) === '"') {
+              currResult.token = currResult.token.substring(1, currResult.token.length - 1);
+            }
           }
-        }
-        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
-          && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
-          currResult.tokenp2 = result.response;
+          if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
+            && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
+            currResult.tokenp2 = result.response;
 
-          // if we got a stringified string - we can remove the double quotes wrapping it
-          if (currResult.token.substring(0, 1) === '"' && currResult.token.substring(-1, 1) === '"') {
-            currResult.token = currResult.token.substring(1, currResult.token.length - 1);
+            // if we got a stringified string - we can remove the double quotes wrapping it
+            if (currResult.token.substring(0, 1) === '"' && currResult.token.substring(-1, 1) === '"') {
+              currResult.token = currResult.token.substring(1, currResult.token.length - 1);
+            }
           }
-        }
 
-        // return the string as there is no other processing needed
-        return callback(currResult);
-      }
-      if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'XML') {
-        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
-          && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
-          currResult.token = result.response;
-        }
-        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
-          && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
-          currResult.tokenp2 = result.response;
+          // return the string as there is no other processing needed
+          return resolve(currResult);
         }
+        if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'XML') {
+          if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
+            && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
+            currResult.token = result.response;
+          }
+          if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
+            && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
+            currResult.tokenp2 = result.response;
+          }
 
-        // return the xml as there is no other processing needed
-        return callback(currResult);
-      }
+          // return the xml as there is no other processing needed
+          return resolve(currResult);
+        }
 
-      // if response can be put into a JSON object
-      let tempResult = null;
-      if (result.response) {
-        if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'XML2JSON') {
-          try {
-            const parser = new xml2js.Parser({ explicitArray: false, attrkey: '_attr' });
-            parser.parseString(result.response, (error, presult) => {
-              if (error) {
-                log.warn(`${origin}: Unable to parse xml to json ${error}`);
-                return callback(parser.toJson(presult));
+        // if response can be put into a JSON object
+        let tempResult = null;
+        if (result.response) {
+          if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'XML2JSON') {
+            try {
+              const parser = new xml2js.Parser({ explicitArray: false, attrkey: '_attr' });
+              parser.parseString(result.response, (error, presult) => {
+                if (error) {
+                  log.warn(`${origin}: Unable to parse xml to json ${error}`);
+                  return resolve(parser.toJson(presult));
+                }
+                tempResult = presult;
+              });
+            } catch (ex) {
+              log.warn(`${origin}: Unable to get json from xml ${ex}`);
+              if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
+                && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
+                currResult.token = result.response;
+              }
+              if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
+                && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
+                currResult.tokenp2 = result.response;
               }
-              tempResult = presult;
-            });
-          } catch (ex) {
-            log.warn(`${origin}: Unable to get json from xml ${ex}`);
-            if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
-              && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
-              currResult.token = result.response;
             }
-            if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
-              && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
-              currResult.tokenp2 = result.response;
+          }
+          if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'URLENCODE') {
+            tempResult = querystring.parse(result.response.trim());
+          } else {
+            try {
+              tempResult = JSON.parse(result.response.trim());
+            } catch (exc) {
+              log.warn(exc);
             }
           }
         }
-        if (Object.hasOwnProperty.call(tokenSchema, 'responseDatatype') && tokenSchema.responseDatatype.toUpperCase() === 'URLENCODE') {
-          tempResult = querystring.parse(result.response.trim());
-        } else {
-          try {
-            tempResult = JSON.parse(result.response.trim());
-          } catch (exc) {
-            log.warn(exc);
-          }
+
+        // at this point if there is nothing in tempResult nothing further to do
+        if (!tempResult) {
+          return resolve(currResult);
         }
-      }
 
-      // at this point if there is nothing in tempResult nothing further to do
-      if (!tempResult) {
-        return callback(currResult);
-      }
+        // need to see if there is a response key
+        if (tokenSchema.responseObjects) {
+          let tKey = null;
 
-      // need to see if there is a response key
-      if (tokenSchema.responseObjects) {
-        let tKey = null;
+          // it should be an array - then take the first element of array
+          if (Array.isArray(tokenSchema.responseObjects)) {
+            if (tokenSchema.responseObjects[0].key) {
+              tKey = tokenSchema.responseObjects[0].key;
+            }
+          } else if (tokenSchema.responseObjects.key) {
+            tKey = tokenSchema.responseObjects.key;
+          }
 
-        // it should be an array - then take the first element of array
-        if (Array.isArray(tokenSchema.responseObjects)) {
-          if (tokenSchema.responseObjects[0].key) {
-            tKey = tokenSchema.responseObjects[0].key;
+          // if we found a key, use it
+          if (tKey) {
+            tempResult = jsonQuery(tKey, { data: tempResult }).value;
           }
-        } else if (tokenSchema.responseObjects.key) {
-          tKey = tokenSchema.responseObjects.key;
         }
 
-        // if we found a key, use it
-        if (tKey) {
-          tempResult = jsonQuery(tKey, { data: tempResult }).value;
+        // the token should not be an array so if it is, return the 0 item.
+        if (Array.isArray(tempResult)) {
+          tempResult = tempResult[0];
         }
-      }
 
-      // the token should not be an array so if it is, return the 0 item.
-      if (Array.isArray(tempResult)) {
-        tempResult = tempResult[0];
-      }
-
-      // return the token from the token schema
-      let translated = transUtilInst.mapFromOutboundEntity(tempResult, tokenSchema.responseSchema);
+        // return the token from the token schema
+        let translated = transUtilInst.mapFromOutboundEntity(tempResult, tokenSchema.responseSchema);
 
-      // if what we got back is an array, just return the first element
-      // should only have one token!!!
-      if (translated && Array.isArray(translated)) {
-        translated = translated[0];
-      }
+        // if what we got back is an array, just return the first element
+        // should only have one token!!!
+        if (translated && Array.isArray(translated)) {
+          translated = translated[0];
+        }
 
-      if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
-        && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
-        currResult.token = translated.token;
-      }
-      if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
-        && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
-        currResult.tokenp2 = translated.tokenp2;
-      }
+        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.token
+          && tokenSchema.responseSchema.properties.token.placement && tokenSchema.responseSchema.properties.token.placement.toUpperCase() === 'BODY') {
+          currResult.token = translated.token;
+        }
+        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.tokenp2
+          && tokenSchema.responseSchema.properties.tokenp2.placement && tokenSchema.responseSchema.properties.tokenp2.placement.toUpperCase() === 'BODY') {
+          currResult.tokenp2 = translated.tokenp2;
+        }
+        if (tokenSchema.responseSchema && tokenSchema.responseSchema.properties && tokenSchema.responseSchema.properties.expires
+          && tokenSchema.responseSchema.properties.expires.placement && tokenSchema.responseSchema.properties.expires.placement.toUpperCase() === 'BODY') {
+          currResult.expires = translated.expires;
+        }
+        // return the token that we find in the translated object
+        return resolve(currResult);
+      });
+    } catch (e) {
+      // handle any exception
+      const errorObj = transUtilInst.checkAndReturn(e, origin, 'Issue retrieving a token');
+      return reject(errorObj);
+    }
+  });
 
-      // return the token that we find in the translated object
-      return callback(currResult);
-    });
-  } catch (e) {
-    // handle any exception
-    const errorObj = transUtilInst.checkAndReturn(e, origin, 'Issue retrieving a token');
-    return callback(null, errorObj);
+  if (typeof callback === 'function') {
+    return p.then((result) => callback(result)).catch((error) => callback(null, error));
   }
+  return p;
 }
 
 /*
  * INTERNAL FUNCTION: prepares a request to get a token from the system
  */
-function buildTokenRequest(reqPath, reqBody, callProperties, callback) {
+async function buildTokenRequest(reqPath, reqBody, callProperties, callback) {
   const origin = `${id}-connectorRest-buildTokenRequest`;
   log.trace(origin);
 
-  try {
-    // Get the entity schema from the file system
-    return propUtilInst.getEntitySchema('.system', 'getToken', choosepath, this.dbUtil, (tokenSchema, healthError) => {
-      if (healthError || !tokenSchema || Object.keys(tokenSchema).length === 0) {
-        log.debug(`${origin}: Using adapter properties for token information`);
-        tokenSchema = null;
-      } else {
-        log.debug(`${origin}: Using action and schema for token information`);
-      }
-
-      // prepare the additional headers we received
-      let thisAHdata = null;
-
-      if (tokenSchema) {
-        thisAHdata = transUtilInst.mergeObjects(thisAHdata, tokenSchema.headers);
-      }
-      if (globalRequest) {
-        thisAHdata = transUtilInst.mergeObjects(thisAHdata, globalRequest.addlHeaders);
-      }
+  const promise = new Promise((resolve, reject) => {
+    try {
+      let entity = 'getToken';
+      if (callProperties && callProperties.mfa) {
+        entity = callProperties.mfa.stepAtionName;
+      }
+      // Get the entity schema from the file system
+      return propUtilInst.getEntitySchema('.system', entity, choosepath, this.dbUtil, async (tokenSchema, healthError) => {
+        if (healthError || !tokenSchema || Object.keys(tokenSchema).length === 0) {
+          log.debug(`${origin}: Using adapter properties for token information`);
+          tokenSchema = null;
+        } else {
+          log.debug(`${origin}: Using action and schema for token information`);
+        }
 
-      // set up the right credentials - passed in overrides default
-      let useUser = username;
-      let usePass = password;
+        // prepare the additional headers we received
+        let thisAHdata = null;
 
-      if (callProperties && callProperties.authentication && callProperties.authentication.username) {
-        useUser = callProperties.authentication.username;
-      }
-      if (callProperties && callProperties.authentication && callProperties.authentication.password) {
-        usePass = callProperties.authentication.password;
-      }
+        if (tokenSchema) {
+          thisAHdata = transUtilInst.mergeObjects(thisAHdata, tokenSchema.headers);
+        }
+        if (globalRequest) {
+          thisAHdata = transUtilInst.mergeObjects(thisAHdata, globalRequest.addlHeaders);
+        }
 
-      // if no header data passed in create empty - will add data below
-      if (!thisAHdata) {
-        thisAHdata = {};
-      } else {
-        const hKeys = Object.keys(thisAHdata);
+        // set up the right credentials - passed in overrides default
+        let useUser = username;
+        let usePass = password;
 
-        for (let h = 0; h < hKeys.length; h += 1) {
-          let tempStr = thisAHdata[hKeys[h]];
+        if (callProperties && callProperties.authentication && callProperties.authentication.username) {
+          useUser = callProperties.authentication.username;
+        }
+        if (callProperties && callProperties.authentication && callProperties.authentication.password) {
+          usePass = callProperties.authentication.password;
+        }
 
-          // replace username variable
-          if (tempStr.indexOf('{username}') >= 0) {
-            tempStr = tempStr.replace('{username}', useUser);
-          }
-          // replace password variable
-          if (tempStr.indexOf('{password}') >= 0) {
-            tempStr = tempStr.replace('{password}', usePass);
-          }
-          thisAHdata[hKeys[h]] = tempStr;
+        // if no header data passed in create empty - will add data below
+        if (!thisAHdata) {
+          thisAHdata = {};
+        } else {
+          const hKeys = Object.keys(thisAHdata);
 
-          // handle any base64 encoding required on the authStr
-          if (thisAHdata[hKeys[h]].indexOf('{b64}') >= 0) {
-            // get the range to be encoded
-            const sIndex = thisAHdata[hKeys[h]].indexOf('{b64}');
-            const eIndex = thisAHdata[hKeys[h]].indexOf('{/b64}');
+          for (let h = 0; h < hKeys.length; h += 1) {
+            let tempStr = thisAHdata[hKeys[h]];
 
-            // if start but no end - return an error
-            if (sIndex >= 0 && eIndex < sIndex + 5) {
-              const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Encode', [thisAHdata[hKeys[h]]], null, null, null);
-              log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-              return callback(null, errorObj);
+            // replace username variable
+            if (tempStr.indexOf('{username}') >= 0) {
+              tempStr = tempStr.replace('{username}', useUser);
             }
+            // replace password variable
+            if (tempStr.indexOf('{password}') >= 0) {
+              tempStr = tempStr.replace('{password}', usePass);
+            }
+            thisAHdata[hKeys[h]] = tempStr;
+
+            // handle any base64 encoding required on the authStr
+            if (thisAHdata[hKeys[h]].indexOf('{b64}') >= 0) {
+              // get the range to be encoded
+              const sIndex = thisAHdata[hKeys[h]].indexOf('{b64}');
+              const eIndex = thisAHdata[hKeys[h]].indexOf('{/b64}');
+
+              // if start but no end - return an error
+              if (sIndex >= 0 && eIndex < sIndex + 5) {
+                const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Encode', [thisAHdata[hKeys[h]]], null, null, null);
+                log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+                return reject(errorObj);
+              }
 
-            // get the string to be encoded
-            const bufString = thisAHdata[hKeys[h]].substring(sIndex + 5, eIndex);
+              // get the string to be encoded
+              const bufString = thisAHdata[hKeys[h]].substring(sIndex + 5, eIndex);
 
-            // encode the string
-            const encString = Buffer.from(bufString).toString('base64');
-            let tempAuthStr = '';
+              // encode the string
+              const encString = Buffer.from(bufString).toString('base64');
+              let tempAuthStr = '';
 
-            // build the new auth field with the encoded string
-            if (sIndex > 0) {
-              // add the start of the string that did not need encoding
-              tempAuthStr = thisAHdata[hKeys[h]].substring(0, sIndex);
-            }
-            // add the encoded string
-            tempAuthStr += encString;
-            if (eIndex + 5 < thisAHdata[hKeys[h]].length) {
-              // add the end of the string that did not need encoding
-              tempAuthStr += thisAHdata[hKeys[h]].substring(eIndex + 6);
-            }
+              // build the new auth field with the encoded string
+              if (sIndex > 0) {
+                // add the start of the string that did not need encoding
+                tempAuthStr = thisAHdata[hKeys[h]].substring(0, sIndex);
+              }
+              // add the encoded string
+              tempAuthStr += encString;
+              if (eIndex + 5 < thisAHdata[hKeys[h]].length) {
+                // add the end of the string that did not need encoding
+                tempAuthStr += thisAHdata[hKeys[h]].substring(eIndex + 6);
+              }
 
-            // put the temp string into the auth string we will add to the request
-            thisAHdata[hKeys[h]] = tempAuthStr;
+              // put the temp string into the auth string we will add to the request
+              thisAHdata[hKeys[h]] = tempAuthStr;
+            }
           }
         }
-      }
 
-      // set the Content Type headers based on the type of request data for the call
-      if (thisAHdata['Content-Type'] === undefined || thisAHdata['Content-Type'] === null) {
-        if (tokenSchema && tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'PLAIN') {
-          // add the Plain headers if they were not set already
-          thisAHdata['Content-Type'] = 'text/plain';
-        } else if (tokenSchema && tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'XML') {
-          // add the XML headers if they were not set already
-          thisAHdata['Content-Type'] = 'application/xml';
-        } else if (tokenSchema && tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'URLENCODE') {
-          // add the URLENCODE headers if they were not set already
-          thisAHdata['Content-Type'] = 'application/x-www-form-urlencoded';
-        } else {
-          // add the JSON headers if they were not set already
-          thisAHdata['Content-Type'] = 'application/json';
+        // set the Content Type headers based on the type of request data for the call
+        if (thisAHdata['Content-Type'] === undefined || thisAHdata['Content-Type'] === null) {
+          if (tokenSchema && tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'PLAIN') {
+            // add the Plain headers if they were not set already
+            thisAHdata['Content-Type'] = 'text/plain';
+          } else if (tokenSchema && tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'XML') {
+            // add the XML headers if they were not set already
+            thisAHdata['Content-Type'] = 'application/xml';
+          } else if (tokenSchema && tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'URLENCODE') {
+            // add the URLENCODE headers if they were not set already
+            thisAHdata['Content-Type'] = 'application/x-www-form-urlencoded';
+          } else {
+            // add the JSON headers if they were not set already
+            thisAHdata['Content-Type'] = 'application/json';
+          }
         }
-      }
-      // set the Accept headers based on the type of response data for the call
-      if (thisAHdata.Accept === undefined || thisAHdata.Accept === null) {
-        if (tokenSchema && tokenSchema.responseDatatype && tokenSchema.responseDatatype.toUpperCase() === 'PLAIN') {
-          // add the Plain headers if they were not set already
-          thisAHdata.Accept = 'text/plain';
-        } else if (tokenSchema && tokenSchema.responseDatatype && tokenSchema.responseDatatype.toUpperCase() === 'XML') {
-          // add the XML headers if they were not set already
-          thisAHdata.Accept = 'application/xml';
-        } else if (tokenSchema && tokenSchema.responseDatatype && tokenSchema.responseDatatype.toUpperCase() === 'URLENCODE') {
-          // add the URLENCODE headers if they were not set already
-          thisAHdata.Accept = 'application/x-www-form-urlencoded';
-        } else {
-          // add the JSON headers if they were not set already
-          thisAHdata.Accept = 'application/json';
+        // set the Accept headers based on the type of response data for the call
+        if (thisAHdata.Accept === undefined || thisAHdata.Accept === null) {
+          if (tokenSchema && tokenSchema.responseDatatype && tokenSchema.responseDatatype.toUpperCase() === 'PLAIN') {
+            // add the Plain headers if they were not set already
+            thisAHdata.Accept = 'text/plain';
+          } else if (tokenSchema && tokenSchema.responseDatatype && tokenSchema.responseDatatype.toUpperCase() === 'XML') {
+            // add the XML headers if they were not set already
+            thisAHdata.Accept = 'application/xml';
+          } else if (tokenSchema && tokenSchema.responseDatatype && tokenSchema.responseDatatype.toUpperCase() === 'URLENCODE') {
+            // add the URLENCODE headers if they were not set already
+            thisAHdata.Accept = 'application/x-www-form-urlencoded';
+          } else {
+            // add the JSON headers if they were not set already
+            thisAHdata.Accept = 'application/json';
+          }
         }
-      }
-
-      if (thisAHdata.Accept === '') {
-        delete thisAHdata.Accept;
-      }
-      if (thisAHdata['Content-Type'] === '') {
-        delete thisAHdata['Content-Type'];
-      }
-
-      // set up the options for the call to get incidents - default is all
-      const options = {
-        hostname: host,
-        port,
-        path: tokenPath,
-        method: 'POST',
-        headers: thisAHdata
-      };
-
-      // passed in properties override defaults
-      if (callProperties && callProperties.host) {
-        options.hostname = callProperties.host;
-      }
-      if (callProperties && callProperties.port) {
-        options.port = callProperties.port;
-      }
 
-      // specific token properties override everything (Single Sign On System)
-      if (sso && sso.host) {
-        options.hostname = sso.host;
-      }
-      if (sso && sso.port) {
-        options.port = sso.port;
-      }
-      if (sso && sso.protocol) {
-        // need to put protocol in token schema
-        if (!tokenSchema) {
-          tokenSchema = {
-            sso: {
-              protocol: sso.protocol
-            }
-          };
-        } else if (tokenSchema && !tokenSchema.sso) {
-          tokenSchema.sso = {
-            protocol: sso.protocol
-          };
-        } else if (tokenSchema && tokenSchema.sso && !tokenSchema.sso.protocol) {
-          tokenSchema.sso.protocol = sso.protocol;
+        if (thisAHdata.Accept === '') {
+          delete thisAHdata.Accept;
+        }
+        if (thisAHdata['Content-Type'] === '') {
+          delete thisAHdata['Content-Type'];
         }
-      }
-      if (tokenSchema && tokenSchema.sso && tokenSchema.sso.host) {
-        options.hostname = tokenSchema.sso.host;
-      }
-      if (tokenSchema && tokenSchema.sso && tokenSchema.sso.port) {
-        options.port = tokenSchema.sso.port;
-      }
 
-      // If there is a token schema, need to take the data from there
-      if (tokenSchema) {
-        options.path = tokenSchema.entitypath;
-        options.method = tokenSchema.method;
-      }
+        // set up the options for the call to get incidents - default is all
+        const options = {
+          hostname: host,
+          port,
+          path: tokenPath,
+          method: 'POST',
+          headers: thisAHdata
+        };
 
-      // if the path has a base path parameter in it, need to replace it
-      let bpathStr = '{base_path}';
-      if (options.path.indexOf(bpathStr) >= 0) {
-        // be able to support this if the base path has a slash before it or not
-        if (options.path.indexOf('/{base_path}') >= 0) {
-          bpathStr = '/{base_path}';
+        // passed in properties override defaults
+        if (callProperties && callProperties.host) {
+          options.hostname = callProperties.host;
+        }
+        if (callProperties && callProperties.port) {
+          options.port = callProperties.port;
         }
 
-        // replace with base path if we have one, otherwise remove base path
-        if (callProperties && callProperties.base_path) {
-          // if no leading /, insert one
-          if (callProperties.base_path.indexOf('/') !== 0) {
-            options.path = options.path.replace(bpathStr, `/${callProperties.base_path}`);
-          } else {
-            options.path = options.path.replace(bpathStr, callProperties.base_path);
-          }
-        } else if (basepath) {
-          // if no leading /, insert one
-          if (basepath.indexOf('/') !== 0) {
-            options.path = options.path.replace(bpathStr, `/${basepath}`);
-          } else {
-            options.path = options.path.replace(bpathStr, basepath);
+        // specific token properties override everything (Single Sign On System)
+        if (sso && sso.host) {
+          options.hostname = sso.host;
+        }
+        if (sso && sso.port) {
+          options.port = sso.port;
+        }
+        if (sso && sso.protocol) {
+          // need to put protocol in token schema
+          if (!tokenSchema) {
+            tokenSchema = {
+              sso: {
+                protocol: sso.protocol
+              }
+            };
+          } else if (tokenSchema && !tokenSchema.sso) {
+            tokenSchema.sso = {
+              protocol: sso.protocol
+            };
+          } else if (tokenSchema && tokenSchema.sso && !tokenSchema.sso.protocol) {
+            tokenSchema.sso.protocol = sso.protocol;
           }
-        } else {
-          options.path = options.path.replace(bpathStr, '');
         }
-      }
-
-      // if the path has a version parameter in it, need to replace it
-      let versStr = '{version}';
-      if (options.path.indexOf(versStr) >= 0) {
-        // be able to support this if the version has a slash before it or not
-        if (options.path.indexOf('/{version}') >= 0) {
-          versStr = '/{version}';
+        if (tokenSchema && tokenSchema.sso && tokenSchema.sso.host) {
+          options.hostname = tokenSchema.sso.host;
+        }
+        if (tokenSchema && tokenSchema.sso && tokenSchema.sso.port) {
+          options.port = tokenSchema.sso.port;
         }
 
-        // replace with version if we have one, otherwise remove version
-        if (callProperties && callProperties.version) {
-          options.path = options.path.replace(versStr, `/${encodeURIComponent(callProperties.version)}`);
-        } else if (version) {
-          options.path = options.path.replace(versStr, `/${encodeURIComponent(version)}`);
-        } else {
-          options.path = options.path.replace(versStr, '');
+        // If there is a token schema, need to take the data from there
+        if (tokenSchema) {
+          options.path = tokenSchema.entitypath;
+          options.method = tokenSchema.method;
         }
-      }
 
-      // if there are URI path variables that have been provided, need to add
-      // them to the path
-      if (reqBody && reqBody.uriPathVars && reqBody.uriPathVars.length > 0) {
-        for (let p = 0; p < reqBody.uriPathVars.length; p += 1) {
-          const vnum = p + 1;
-          const holder = `pathv${vnum.toString()}`;
-          const hindex = options.path.indexOf(holder);
-
-          // if path variable is in the url, replace it!!!
-          if (hindex >= 0 && reqBody.uriPathVars[p] !== null && reqBody.uriPathVars[p] !== '') {
-            // with the provided id
-            let idString = '';
-
-            // check if the current URI path ends with a slash (may require
-            // slash at end)
-            if (options.path[hindex - 2] === '/' || options.path[hindex - 2] === ':') {
-              // ends with a slash need to add slash to end
-              idString = encodeURIComponent(reqBody.uriPathVars[p]);
+        // if the path has a base path parameter in it, need to replace it
+        let bpathStr = '{base_path}';
+        if (options.path.indexOf(bpathStr) >= 0) {
+          // be able to support this if the base path has a slash before it or not
+          if (options.path.indexOf('/{base_path}') >= 0) {
+            bpathStr = '/{base_path}';
+          }
+
+          // replace with base path if we have one, otherwise remove base path
+          if (callProperties && callProperties.base_path) {
+            // if no leading /, insert one
+            if (callProperties.base_path.indexOf('/') !== 0) {
+              options.path = options.path.replace(bpathStr, `/${callProperties.base_path}`);
             } else {
-              // otherwise add / to start
-              idString = '/';
-              idString += encodeURIComponent(reqBody.uriPathVars[p]);
+              options.path = options.path.replace(bpathStr, callProperties.base_path);
             }
+          } else if (basepath) {
+            // if no leading /, insert one
+            if (basepath.indexOf('/') !== 0) {
+              options.path = options.path.replace(bpathStr, `/${basepath}`);
+            } else {
+              options.path = options.path.replace(bpathStr, basepath);
+            }
+          } else {
+            options.path = options.path.replace(bpathStr, '');
+          }
+        }
+
+        // if the path has a version parameter in it, need to replace it
+        let versStr = '{version}';
+        if (options.path.indexOf(versStr) >= 0) {
+          // be able to support this if the version has a slash before it or not
+          if (options.path.indexOf('/{version}') >= 0) {
+            versStr = '/{version}';
+          }
 
-            // replace the id in url with the id string
-            options.path = options.path.replace(`{${holder}}`, idString);
+          // replace with version if we have one, otherwise remove version
+          if (callProperties && callProperties.version) {
+            options.path = options.path.replace(versStr, `/${encodeURIComponent(callProperties.version)}`);
+          } else if (version) {
+            options.path = options.path.replace(versStr, `/${encodeURIComponent(version)}`);
+          } else {
+            options.path = options.path.replace(versStr, '');
           }
         }
-      }
 
-      // need to remove all of the remaining path holders from the URI
-      while (options.path.indexOf('{pathv') >= 0) {
-        let sIndex = options.path.indexOf('{pathv');
-        const eIndex = options.path.indexOf('}', sIndex);
+        // if there are URI path variables that have been provided, need to add
+        // them to the path
+        if (reqBody && reqBody.uriPathVars && reqBody.uriPathVars.length > 0) {
+          for (let p = 0; p < reqBody.uriPathVars.length; p += 1) {
+            const vnum = p + 1;
+            const holder = `pathv${vnum.toString()}`;
+            const hindex = options.path.indexOf(holder);
+
+            // if path variable is in the url, replace it!!!
+            if (hindex >= 0 && reqBody.uriPathVars[p] !== null && reqBody.uriPathVars[p] !== '') {
+              // with the provided id
+              let idString = '';
+
+              // check if the current URI path ends with a slash (may require
+              // slash at end)
+              if (options.path[hindex - 2] === '/' || options.path[hindex - 2] === ':') {
+                // ends with a slash need to add slash to end
+                idString = encodeURIComponent(reqBody.uriPathVars[p]);
+              } else {
+                // otherwise add / to start
+                idString = '/';
+                idString += encodeURIComponent(reqBody.uriPathVars[p]);
+              }
 
-        // if there is a / before the {pathv} need to remove it
-        if (options.path[sIndex - 1] === '/' || options.path[sIndex - 1] === ':') {
-          sIndex -= 1;
+              // replace the id in url with the id string
+              options.path = options.path.replace(`{${holder}}`, idString);
+            }
+          }
         }
 
-        if (sIndex > 0) {
-          // add the start of the path
-          let tempStr = options.path.substring(0, sIndex);
+        // need to remove all of the remaining path holders from the URI
+        while (options.path.indexOf('{pathv') >= 0) {
+          let sIndex = options.path.indexOf('{pathv');
+          const eIndex = options.path.indexOf('}', sIndex);
 
-          if (eIndex < options.path.length) {
-            // add the end of the path
-            tempStr += options.path.substring(eIndex + 1);
+          // if there is a / before the {pathv} need to remove it
+          if (options.path[sIndex - 1] === '/' || options.path[sIndex - 1] === ':') {
+            sIndex -= 1;
           }
 
-          options.path = tempStr;
-        } else if (eIndex > 0 && eIndex < options.path.length) {
-          // add the end of the path
-          options.path = options.path.substring(eIndex + 1);
-        } else {
-          // should not get here - there is some issue in the uripath - missing
-          // an end or the path is just {pathv#}
-          // add the specific pieces of the error object
-          const errorObj = this.transUtil.formatErrorObject(origin, 'Invalid Action File', ['missing entity path', '.system/getToken'], null, null, null);
-          log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-          return callback(null, errorObj);
+          if (sIndex > 0) {
+            // add the start of the path
+            let tempStr = options.path.substring(0, sIndex);
+
+            if (eIndex < options.path.length) {
+              // add the end of the path
+              tempStr += options.path.substring(eIndex + 1);
+            }
+
+            options.path = tempStr;
+          } else if (eIndex > 0 && eIndex < options.path.length) {
+            // add the end of the path
+            options.path = options.path.substring(eIndex + 1);
+          } else {
+            // should not get here - there is some issue in the uripath - missing
+            // an end or the path is just {pathv#}
+            // add the specific pieces of the error object
+            const errorObj = this.transUtil.formatErrorObject(origin, 'Invalid Action File', ['missing entity path', '.system/getToken'], null, null, null);
+            log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+            return reject(errorObj);
+          }
         }
-      }
 
-      // only add global options if there are global options to add
-      if (globalRequest && globalRequest.uriOptions
-        && Object.keys(globalRequest.uriOptions).length > 0) {
-        const optionString = querystring.stringify(globalRequest.uriOptions);
+        // only add global options if there are global options to add
+        if (globalRequest && globalRequest.uriOptions
+          && Object.keys(globalRequest.uriOptions).length > 0) {
+          const optionString = querystring.stringify(globalRequest.uriOptions);
 
-        // if no query paramters yet - start with ?
-        if (options.path.indexOf('?') < 0) {
-          options.path += `?${optionString}`;
-        } else {
-          // if already have query parameters, add on to end
-          options.path += `&${optionString}`;
+          // if no query paramters yet - start with ?
+          if (options.path.indexOf('?') < 0) {
+            options.path += `?${optionString}`;
+          } else {
+            // if already have query parameters, add on to end
+            options.path += `&${optionString}`;
+          }
         }
-      }
 
-      // remove the path vars from the reqBody
-      const actReqBody = Object.assign({}, reqBody);
-      if (actReqBody && actReqBody.uriPathVars) {
-        delete actReqBody.uriPathVars;
-      }
+        // remove the path vars from the reqBody
+        const actReqBody = Object.assign({}, reqBody);
+        if (actReqBody && actReqBody.uriPathVars) {
+          delete actReqBody.uriPathVars;
+        }
 
-      // if ssl enabled add the options for ssl
-      if (callProperties && callProperties.ssl && Object.hasOwnProperty.call(callProperties.ssl, 'enabled')) {
-        if (callProperties.ssl.enabled) {
-          if (callProperties.ssl.accept_invalid_cert) {
+        // if ssl enabled add the options for ssl
+        if (callProperties && callProperties.ssl && Object.hasOwnProperty.call(callProperties.ssl, 'enabled')) {
+          if (callProperties.ssl.enabled) {
+            if (callProperties.ssl.accept_invalid_cert) {
+              // if we are accepting invalid certificates (ok for lab not so much production)
+              options.rejectUnauthorized = false;
+            } else {
+              // if we are not accepting invalid certs, need the ca file in the options
+              try {
+                options.rejectUnauthorized = true;
+                options.ca = [fs.readFileSync(callProperties.ssl.ca_file)];
+              } catch (e) {
+                const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [callProperties.ssl.ca_file], null, null, null);
+                log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+                return reject(errorObj);
+              }
+            }
+
+            if (callProperties.ssl.ciphers) {
+              options.ciphers = callProperties.ssl.ciphers;
+            }
+            if (callProperties.ssl.secure_protocol) {
+              options.secureProtocol = callProperties.ssl.secure_protocol;
+            }
+
+            log.info(`${origin}: Connector SSL connections enabled`);
+          }
+        } else if (sslEnabled) {
+          if (sslAcceptInvalid) {
             // if we are accepting invalid certificates (ok for lab not so much production)
             options.rejectUnauthorized = false;
           } else {
             // if we are not accepting invalid certs, need the ca file in the options
             try {
               options.rejectUnauthorized = true;
-              options.ca = [fs.readFileSync(callProperties.ssl.ca_file)];
+              options.ca = [fs.readFileSync(sslCAFile)];
             } catch (e) {
-              const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [callProperties.ssl.ca_file], null, null, null);
+              const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [sslCAFile], null, null, null);
               log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-              return callback(null, errorObj);
+              return reject(errorObj);
+            }
+            // if there is a cert file, try to read in a cert file in the options
+            if (sslCertFile) {
+              try {
+                options.cert = [fs.readFileSync(sslCertFile)];
+              } catch (e) {
+                const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [sslCertFile], null, null, null);
+                log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+                return reject(errorObj);
+              }
+            }
+            // if there is a key file, try to read in a key file in the options
+            if (sslKeyFile) {
+              try {
+                options.key = [fs.readFileSync(sslKeyFile)];
+              } catch (e) {
+                const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [sslKeyFile], null, null, null);
+                log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+                return reject(errorObj);
+              }
             }
           }
 
-          if (callProperties.ssl.ciphers) {
-            options.ciphers = callProperties.ssl.ciphers;
-          }
-          if (callProperties.ssl.secure_protocol) {
-            options.secureProtocol = callProperties.ssl.secure_protocol;
-          }
-
-          log.info(`${origin}: Connector SSL connections enabled`);
-        }
-      } else if (sslEnabled) {
-        if (sslAcceptInvalid) {
-          // if we are accepting invalid certificates (ok for lab not so much production)
-          options.rejectUnauthorized = false;
-        } else {
-          // if we are not accepting invalid certs, need the ca file in the options
-          try {
-            options.rejectUnauthorized = true;
-            options.ca = [fs.readFileSync(sslCAFile)];
-          } catch (e) {
-            const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [sslCAFile], null, null, null);
-            log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-            return callback(null, errorObj);
+          if (sslCiphers) {
+            options.ciphers = sslCiphers;
           }
-          // if there is a cert file, try to read in a cert file in the options
-          if (sslCertFile) {
-            try {
-              options.cert = [fs.readFileSync(sslCertFile)];
-            } catch (e) {
-              const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [sslCertFile], null, null, null);
-              log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-              return callback(null, errorObj);
-            }
+          if (sslPassphrase) {
+            options.passphrase = sslPassphrase;
           }
-          // if there is a key file, try to read in a key file in the options
-          if (sslKeyFile) {
-            try {
-              options.key = [fs.readFileSync(sslKeyFile)];
-            } catch (e) {
-              const errorObj = this.transUtil.formatErrorObject(origin, 'Missing File', [sslKeyFile], null, null, null);
-              log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
-              return callback(null, errorObj);
-            }
+          if (secureProtocol) {
+            options.secureProtocol = secureProtocol;
           }
-        }
 
-        if (sslCiphers) {
-          options.ciphers = sslCiphers;
-        }
-        if (secureProtocol) {
-          options.secureProtocol = secureProtocol;
+          log.info(`${origin}: Connector SSL connections enabled`);
         }
 
-        log.info(`${origin}: Connector SSL connections enabled`);
-      }
+        const reqData = {};
+        let bodyString = null;
+
+        // if we have been passed a schema and the Authorization is in a header
+        // COMMENTED OUT AND HANDLED IN IF BELOW - take stuff out of body on line 1930
+        // if (tokenSchema && tokenSchema.headers && tokenSchema.headers.Authorization) {
+        //   // request the token
+        //   options.headers['Content-length'] = 0;
+        //   return getToken(reqPath, options, tokenSchema, '', callProperties, callback);
+        // }
+        if (tokenSchema) {
+          // if this is a get, need to put the username on the url
+          if (options.path.indexOf('/{username}') >= 0) {
+            options.path = options.path.replace('/{username}', useUser);
+          } else {
+            options.path = options.path.replace('{username}', useUser);
+          }
 
-      const reqData = {};
-      let bodyString = null;
-
-      // if we have been passed a schema and the Authorization is in a header
-      // COMMENTED OUT AND HANDLED IN IF BELOW - take stuff out of body on line 1930
-      // if (tokenSchema && tokenSchema.headers && tokenSchema.headers.Authorization) {
-      //   // request the token
-      //   options.headers['Content-length'] = 0;
-      //   return getToken(reqPath, options, tokenSchema, '', callProperties, callback);
-      // }
-      if (tokenSchema) {
-        // if this is a get, need to put the username on the url
-        if (options.path.indexOf('/{username}') >= 0) {
-          options.path = options.path.replace('/{username}', useUser);
-        } else {
-          options.path = options.path.replace('{username}', useUser);
-        }
+          // if this is a get, need to put the password on the url
+          if (options.path.indexOf('/{password}') >= 0) {
+            options.path = options.path.replace('/{password}', usePass);
+          } else {
+            options.path = options.path.replace('{password}', usePass);
+          }
 
-        // if this is a get, need to put the password on the url
-        if (options.path.indexOf('/{password}') >= 0) {
-          options.path = options.path.replace('/{password}', usePass);
-        } else {
-          options.path = options.path.replace('{password}', usePass);
-        }
+          // if this is not a get, need to add the info to the request
+          let creds = {};
+          if (options.method !== 'GET') {
+            if (authMethod === 'multi_step_authentication') {
+              const { stepBody, stepHeaders } = callProperties.mfa;
+              Object.assign(creds, stepBody);
+              Object.assign(options.headers, stepHeaders);
+            } else {
+              creds = {
+                username: useUser,
+                password: usePass
+              };
+              if (clientId) {
+                creds.client_id = clientId;
+              }
+              if (clientSecret) {
+                creds.client_secret = clientSecret;
+              }
+              if (grantType) {
+                creds.grant_type = grantType;
+              }
+              if (callProperties && callProperties.authentication && callProperties.authentication.client_id) {
+                creds.client_id = callProperties.authentication.client_id;
+              }
+              if (callProperties && callProperties.authentication && callProperties.authentication.client_secret) {
+                creds.client_secret = callProperties.authentication.client_secret;
+              }
+              if (callProperties && callProperties.authentication && callProperties.authentication.grant_type) {
+                creds.grant_type = callProperties.authentication.grant_type;
+              }
 
-        // if this is not a get, need to add the info to the request
-        if (options.method !== 'GET') {
-          let creds = {
-            username: useUser,
-            password: usePass
-          };
-          if (clientId) {
-            creds.client_id = clientId;
-          }
-          if (clientSecret) {
-            creds.client_secret = clientSecret;
-          }
-          if (grantType) {
-            creds.grant_type = grantType;
-          }
-          if (callProperties && callProperties.authentication && callProperties.authentication.client_id) {
-            creds.client_id = callProperties.authentication.client_id;
-          }
-          if (callProperties && callProperties.authentication && callProperties.authentication.client_secret) {
-            creds.client_secret = callProperties.authentication.client_secret;
-          }
-          if (callProperties && callProperties.authentication && callProperties.authentication.grant_type) {
-            creds.grant_type = callProperties.authentication.grant_type;
-          }
+              // if there is body data to add to the token request body
+              creds = transUtilInst.mergeObjects(actReqBody, creds);
 
-          // if there is body data to add to the token request body
-          creds = transUtilInst.mergeObjects(actReqBody, creds);
+              if (globalRequest) {
+                creds = transUtilInst.mergeObjects(creds, globalRequest.authData);
+              }
 
-          if (globalRequest) {
-            creds = transUtilInst.mergeObjects(creds, globalRequest.authData);
-          }
+              // if there is body data to add to the token request body
+              if (actReqBody) {
+                const bodyKey = Object.keys(actReqBody);
 
-          // if there is body data to add to the token request body
-          if (actReqBody) {
-            const bodyKey = Object.keys(actReqBody);
+                for (let k = 0; k < bodyKey.length; k += 1) {
+                  creds[bodyKey[k]] = actReqBody[bodyKey[k]];
+                }
+              }
 
-            for (let k = 0; k < bodyKey.length; k += 1) {
-              creds[bodyKey[k]] = actReqBody[bodyKey[k]];
+              if (tokenSchema.headers && tokenSchema.headers.Authorization) {
+                // remove the username and password from the creds
+                delete creds.username;
+                delete creds.password;
+              }
             }
-          }
 
-          if (tokenSchema.headers && tokenSchema.headers.Authorization) {
-            // remove the username and password from the creds
-            delete creds.username;
-            delete creds.password;
-          }
+            // map the data we received to an Entity - will get back the defaults
+            const tokenEntity = transUtilInst.mapToOutboundEntity(creds, tokenSchema.requestSchema);
+            bodyString = tokenEntity;
 
-          // map the data we received to an Entity - will get back the defaults
-          const tokenEntity = transUtilInst.mapToOutboundEntity(creds, tokenSchema.requestSchema);
-          bodyString = tokenEntity;
-
-          // if it is JSON or URLENCODE need to put body into right format
-          if (!tokenSchema.requestDatatype || tokenSchema.requestDatatype.toUpperCase() === 'JSON' || tokenSchema.requestDatatype.toUpperCase() === 'FORM') {
-            bodyString = JSON.stringify(tokenEntity);
-          } else if (tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'URLENCODE') {
-            bodyString = querystring.stringify(tokenEntity);
-          } else if (tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'URLQUERY') {
-            // if the datatype is URLQUERY need to put into the query on the request
-            if (authQueryEncode != null) {
-              if (authQueryEncode === true) {
+            // if it is JSON or URLENCODE need to put body into right format
+            if (!tokenSchema.requestDatatype || tokenSchema.requestDatatype.toUpperCase() === 'JSON' || tokenSchema.requestDatatype.toUpperCase() === 'FORM') {
+              bodyString = JSON.stringify(tokenEntity);
+            } else if (tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'URLENCODE') {
+              bodyString = querystring.stringify(tokenEntity);
+            } else if (tokenSchema.requestDatatype && tokenSchema.requestDatatype.toUpperCase() === 'URLQUERY') {
+              // if the datatype is URLQUERY need to put into the query on the request
+              if (authQueryEncode != null) {
+                if (authQueryEncode === true) {
+                  bodyString = querystring.stringify(tokenEntity);
+                } else {
+                  bodyString = '';
+                  // if not encoding we need to build
+                  const qkeys = Object.keys(tokenEntity);
+                  // add each query parameter and its value
+                  for (let k = 0; k < qkeys.length; k += 1) {
+                    // need to add separator for everything after the first one
+                    if (k > 0) {
+                      bodyString += '&';
+                    }
+                    // adds key=value
+                    bodyString += `${qkeys[k]}=${tokenEntity[qkeys[k]]}`;
+                  }
+                }
+              } else if (encodeUri === true) {
                 bodyString = querystring.stringify(tokenEntity);
               } else {
                 bodyString = '';
@@ -2009,60 +2060,58 @@ function buildTokenRequest(reqPath, reqBody, callProperties, callback) {
                   bodyString += `${qkeys[k]}=${tokenEntity[qkeys[k]]}`;
                 }
               }
-            } else if (encodeUri === true) {
-              bodyString = querystring.stringify(tokenEntity);
-            } else {
-              bodyString = '';
-              // if not encoding we need to build
-              const qkeys = Object.keys(tokenEntity);
-              // add each query parameter and its value
-              for (let k = 0; k < qkeys.length; k += 1) {
-                // need to add separator for everything after the first one
-                if (k > 0) {
-                  bodyString += '&';
-                }
-                // adds key=value
-                bodyString += `${qkeys[k]}=${tokenEntity[qkeys[k]]}`;
+
+              // append to the path
+              if (options.path.indexOf('?') < 0) {
+                options.path = `${options.path}?${bodyString}`;
+              } else {
+                options.path = `${options.path}&${bodyString}`;
               }
+              bodyString = '';
             }
-
-            // append to the path
-            if (options.path.indexOf('?') < 0) {
-              options.path = `${options.path}?${bodyString}`;
-            } else {
-              options.path = `${options.path}&${bodyString}`;
+            // if there is a body, set the content length of the body and add it to
+            // the header
+            if (Object.keys(tokenEntity).length > 0 || tokenSchema.sendEmpty) {
+              options.headers['Content-length'] = Buffer.byteLength(bodyString);
             }
-            bodyString = '';
-          }
 
-          // if there is a body, set the content length of the body and add it to
-          // the header
-          if (Object.keys(tokenEntity).length > 0 || tokenSchema.sendEmpty) {
-            options.headers['Content-length'] = Buffer.byteLength(bodyString);
+            // request the token
+            await getToken(reqPath, options, tokenSchema, bodyString, callProperties).then((result) => {
+              resolve(result);
+            }).catch((error) => {
+              reject(error);
+            });
+            return;
           }
-
-          // request the token
-          return getToken(reqPath, options, tokenSchema, bodyString, callProperties, callback);
+        } else {
+          // set the user and password for the token request
+          reqData[tokenUserField] = useUser;
+          reqData[tokenPwdField] = usePass;
+          bodyString = reqData;
+
+          // since not a get call, convert reqData to a string and add length
+          bodyString = JSON.stringify(reqData);
+          options.headers['Content-length'] = Buffer.byteLength(bodyString);
         }
-      } else {
-        // set the user and password for the token request
-        reqData[tokenUserField] = useUser;
-        reqData[tokenPwdField] = usePass;
-        bodyString = reqData;
 
-        // since not a get call, convert reqData to a string and add length
-        bodyString = JSON.stringify(reqData);
-        options.headers['Content-length'] = Buffer.byteLength(bodyString);
-      }
+        // request the token
+        await getToken(reqPath, options, tokenSchema, bodyString, callProperties).then((result) => {
+          resolve(result);
+        }).catch((error) => {
+          reject(error);
+        });
+      });
+    } catch (e) {
+      // handle any exception
+      const errorObj = transUtilInst.checkAndReturn(e, origin, 'Issue requesting token');
+      return reject(errorObj);
+    }
+  });
 
-      // request the token
-      return getToken(reqPath, options, tokenSchema, bodyString, callProperties, callback);
-    });
-  } catch (e) {
-    // handle any exception
-    const errorObj = transUtilInst.checkAndReturn(e, origin, 'Issue requesting token');
-    return callback(null, errorObj);
+  if (typeof callback === 'function') {
+    return promise.then((result) => callback(result)).catch((error) => callback(null, error));
   }
+  return promise;
 }
 
 /*
@@ -2409,6 +2458,264 @@ function addAuthToRequest(request, authStrs, callProperties, callback) {
   }
 }
 
+/*  */
+function buildAuthDataMfa(finalTokens, callProperties) {
+  const authStrs = [];
+  if (callProperties && callProperties.authentication && callProperties.authentication.auth_field_format) {
+    if (Array.isArray(callProperties.authentication.auth_field_format)) {
+      for (let a = 0; a < callProperties.authentication.auth_field_format.length; a += 1) {
+        let authStr = callProperties.authentication.auth_field_format[a].replace('{token}', finalTokens.token);
+        authStr = authStr.replace('{tokenp2}', finalTokens.tokenp2);
+        authStrs.push(authStr);
+      }
+    } else {
+      let authStr = callProperties.authentication.auth_field_format.replace('{token}', finalTokens.token);
+      authStr = authStr.replace('{tokenp2}', finalTokens.tokenp2);
+      authStrs.push(authStr);
+    }
+  } else {
+    for (let a = 0; a < authFormat.length; a += 1) {
+      let authStr = authFormat[a].replace('{token}', finalTokens.token);
+      authStr = authStr.replace('{tokenp2}', finalTokens.tokenp2);
+      // if authFormat needs referenced value from previous steps (e.g., Bearer {getSession.responseFields.session})
+      if (!authFormat[a].includes('{token}') && !authFormat[a].includes('{tokenp2}')) {
+        const matching = searchTextInCurlyBraces(authStr);
+        let propertyValue = authFormat[a];
+        if (matching) {
+          const matchedText = matching[0];
+          propertyValue = matching[1];
+          const resolvedValue = getReferencedMfaValue(propertyValue);
+          authStr = authStr.replace(matchedText, resolvedValue);
+        }
+      }
+      authStrs.push(authStr);
+    }
+  }
+  return authStrs;
+}
+
+/*  */
+const searchTextInCurlyBraces = (text) => {
+  const rxp = /{([^}]+)}/g;
+  const matching = rxp.exec(text);
+  return matching;
+};
+
+/*  */
+function buildMfaHeader(prop, mfaStepConfiguration, callProperties) {
+  const origin = `${id}-connectorRest-buildMfaHeader`;
+  log.trace(origin);
+  const fullPropertyValue = mfaStepConfiguration.requestFields[prop];
+  // Check if fullPropertyValue has reference in curly braces (e.g., Bearer {getSession.responseFields.session})
+  let propertyValue = fullPropertyValue;
+  const matching = searchTextInCurlyBraces(fullPropertyValue);
+  const headerName = prop.split('.')[1];
+  if (matching) {
+    const matchedText = matching[0];
+    propertyValue = matching[1];
+    const resolvedValue = getReferencedMfaValue(propertyValue);
+    callProperties.mfa.stepHeaders[headerName] = fullPropertyValue.replace(matchedText, resolvedValue);
+  } else {
+    callProperties.mfa.stepHeaders[headerName] = mfaStepConfiguration.requestFields[prop];
+  }
+}
+
+/*  */
+function buildMfaBody(prop, mfaStepConfiguration, callProperties) {
+  const origin = `${id}-connectorRest-buildMfaBody`;
+  log.trace(origin);
+  const fullPropertyValue = mfaStepConfiguration.requestFields[prop];
+  // Check if fullPropertyValue has reference in curly braces (e.g., {getSubToken.responseFields.token})
+  let propertyValue = fullPropertyValue;
+  const matching = searchTextInCurlyBraces(fullPropertyValue);
+  if (matching) {
+    const matchedText = matching[0];
+    propertyValue = matching[1];
+    const resolvedValue = getReferencedMfaValue(propertyValue);
+    callProperties.mfa.stepBody[prop] = fullPropertyValue.replace(matchedText, resolvedValue);
+  } else {
+    callProperties.mfa.stepBody[prop] = mfaStepConfiguration.requestFields[prop];
+  }
+}
+/*  */
+function getReferencedMfaValue(propertyValue) {
+  const origin = `${id}-connectorRest-getReferencedMfaValue`;
+  log.trace(origin);
+  let stepRequestField = null;
+  // e.g. prop value is: 'getSession.responseFields.session'
+  const referencedStepName = propertyValue.split('.')[0]; // getSession
+  const referencedPropertyName = propertyValue.split('.')[2]; // session
+  const referencedMfaCallConfig = multiStepAuthCalls.find((item) => item.name === referencedStepName);
+  const referencedMfaCallResult = mfaStepsResults.find((item) => item.name === referencedStepName);
+  if (referencedMfaCallConfig.responseFields[referencedPropertyName]) {
+    stepRequestField = referencedMfaCallResult.result[referencedPropertyName];
+  }
+  return stepRequestField;
+}
+
+/*  */
+function buildMfaStepData(step, callProperties) {
+  const origin = `${id}-connectorRest-buildMfaStepData`;
+  log.trace(origin);
+  const mfaStepConfiguration = multiStepAuthCalls[step];
+  callProperties.mfa.stepBody = {};
+  callProperties.mfa.stepHeaders = {};
+  if (mfaStepConfiguration.requestFields) {
+    Object.keys(mfaStepConfiguration.requestFields).forEach((prop) => {
+      if (prop.startsWith('header')) {
+        buildMfaHeader(prop, mfaStepConfiguration, callProperties);
+      } else {
+        buildMfaBody(prop, mfaStepConfiguration, callProperties);
+      }
+    });
+  }
+}
+
+/*  */
+async function translateMfaStepResult(step, stepResult, callProperties) {
+  const origin = `${id}-connectorRest-translateMfaStepResult`;
+  const mfaStepConfiguration = multiStepAuthCalls[step];
+  const entity = callProperties.mfa.stepAtionName;
+  // define the fields that are not mapped to its external name but keep its name
+  // needed as 'expires' handling is hardcoded in findExpireInResult()
+  const immutableFields = ['expires'];
+  return new Promise((resolve, reject) => {
+    // Get the entity schema from the file system
+    propUtilInst.getEntitySchema('.system', entity, choosepath, this.dbUtil, async (tokenSchema, healthError) => {
+      if (healthError) return reject(healthError);
+      const allProperties = Object.keys(tokenSchema.responseSchema.properties);
+      allProperties.forEach((prop) => {
+        if (Object.prototype.hasOwnProperty.call(stepResult, prop)) {
+          const externalName = tokenSchema.responseSchema.properties[prop].external_name;
+          if (!stepResult[prop]) {
+            log.error(`No step-${step + 1} result for responseSchema (prop=>external_name): (${prop}=>${externalName}) found in step response`);
+            return reject(new Error(`Response schema for step-${step + 1} misconfiguration`));
+          }
+          // map response schema attribute name to MFA configured response field name
+          let responseFieldName = Object.keys(mfaStepConfiguration.responseFields).find((key) => mfaStepConfiguration.responseFields[key] === externalName);
+          if (!responseFieldName) {
+            log.warn(`${origin}-Unable to map property: '${prop}' to external name: '${externalName}'. Check your mfa step ${step} configuration`);
+            responseFieldName = prop;
+          }
+          if (!responseFieldName) {
+            log.warn(`${origin}-Unable to map property: '${prop}'. Check your mfa step ${step} configuration`);
+          }
+          stepResult[responseFieldName] = stepResult[prop];
+          // remove original property from response after mapping
+          if (prop !== externalName && responseFieldName !== prop && immutableFields.indexOf(prop) === -1) delete stepResult[prop];
+        }
+      });
+      return resolve(stepResult);
+    });
+  });
+}
+
+/* Promisification of called callback-based function */
+function getCachedMfaToken(cachedTokenIdentifier, invalidToken) {
+  const origin = `${id}-connectorRest-getCachedMfaToken`;
+  log.trace(origin);
+
+  return new Promise((resolve, reject) => {
+    validToken(id, cachedTokenIdentifier, invalidToken, (retToken, verror) => {
+      if (verror) {
+        reject(verror);
+      } else {
+        resolve(retToken);
+      }
+    });
+  });
+}
+
+/* Promisification of called callback-based function */
+function cacheMfaToken(cachedTokenIdentifier, token) {
+  const origin = `${id}-connectorRest-cacheMfaToken`;
+  log.trace(origin);
+
+  let timeout = tokenTimeout;
+  // if we should use the timeout from the token request
+  if (timeout === 0) {
+    timeout = findExpireInResult(token);
+  } else {
+    // otherwise add the timeout to the current time
+    timeout += new Date().getTime();
+  }
+  return new Promise((resolve, reject) => {
+    addTokenItem(id, cachedTokenIdentifier, token, timeout, (addedtoken, error) => {
+      if (error) {
+        reject(error);
+      } else {
+        resolve(addedtoken);
+      }
+    });
+  });
+}
+
+/*  */
+async function getMfaFinalTokens(request, callProperties, invalidToken) {
+  const origin = `${id}-connectorRest-getMfaFinalTokens`;
+  let finalTokens = null; // final authentication token of the last step
+  let stepToken = null; // result of given step request
+  // token locked function
+  const f = async () => {
+    // retrieve token from cache and return it if still valid
+    // adapter's Id and 1st item of MFA config is used as token identifier in cache
+    const cachedTokenIdentifier = multiStepAuthCalls[0];
+    const cachedToken = await getCachedMfaToken(cachedTokenIdentifier, invalidToken)
+      .catch((error) => {
+        log.error(error);
+        throw error;
+      });
+    if (cachedToken) {
+      log.debug(`${origin}-returning cached MFA token`);
+      finalTokens = cachedToken;
+      return;
+    } mfaStepsResults.length = 0;
+    // no cached token found, trigger auth steps to obtain new token
+    for (let step = 0; step < multiStepAuthCalls.length; step += 1) {
+      const stepAtionName = `MFA_Step_${step + 1}`;
+      log.debug(`${origin}-Executing MFA step-${step + 1}, action: ${stepAtionName}`);
+      if (!callProperties) {
+        callProperties = {};
+      }
+      callProperties.mfa = { stepAtionName };
+      if (multiStepAuthCalls[step].successfullResponseCode) {
+        callProperties.mfa.successfullResponseCode = multiStepAuthCalls[step].successfullResponseCode;
+      }
+      buildMfaStepData(step, callProperties);
+      stepToken = await buildTokenRequest(request.header.path, request.authData, callProperties).catch((error) => { // eslint-disable-line no-await-in-loop
+        log.error(error);
+        throw error;
+      });
+      log.debug(`${origin}-MFA result for step-${step + 1}, stepToken: ${JSON.stringify(stepToken)}`);
+      // one of steps failing results in whole authentication chain failure
+      if (!stepToken) {
+        finalTokens = null;
+        break;
+      }
+      const translatedStepResult = await translateMfaStepResult(step, stepToken, callProperties) // eslint-disable-line no-await-in-loop
+        .catch((error) => {
+          log.error(error);
+          throw error;
+        });
+      mfaStepsResults.push({
+        name: multiStepAuthCalls[step].name,
+        result: translatedStepResult
+      });
+      // result of last MFA step request shall contain the final token used to authenticate subsequent requests
+      finalTokens = stepToken;
+    }
+
+    // save final MFA token to cache for reuse in subsequent requests
+    if (finalTokens) {
+      await cacheMfaToken(cachedTokenIdentifier, finalTokens).catch((error) => log.error(error));
+    }
+  };
+  // Aquire token lock across all MFA steps,
+  // release it when final token is obtained or one of the steps fails
+  await tlock.acquire(tokenlock, f);
+
+  return finalTokens;
+}
 /*
  * INTERNAL FUNCTION: requestAuthenticate determines the authentication for System,
  * and takes appropriate action to authenticate and then makes the request
@@ -2429,6 +2736,34 @@ function requestAuthenticate(request, entitySchema, invalidToken, callProperties
       usePass = callProperties.authentication.password;
     }
 
+    if (authMethod === 'multi_step_authentication') {
+      // set MFA configuration out of adapter's configuration
+      multiStepAuthCalls = props.authentication.multiStepAuthCalls;
+      return getMfaFinalTokens(request, callProperties, invalidToken).then((finalTokens) => {
+        if (!finalTokens) {
+          const errorObj = transUtilInst.formatErrorObject(origin, 'Unable To Get Token', [useUser], null, null, null);
+          log.error(`${origin}: ${errorObj.IAPerror.displayString}`);
+          return callback(null, errorObj);
+        }
+
+        const authStrs = buildAuthDataMfa(finalTokens, callProperties);
+
+        return addAuthToRequest(request, authStrs, callProperties, (authReq, aerror) => {
+          if (aerror) {
+            return callback(aerror);
+          }
+
+          request.tokenUsed = authReq.token;
+
+          // actually make the request now that the authentication has been added
+          return makeRequest(request, entitySchema, callProperties, null, 0, callback);
+        });
+      }).catch((error) => {
+        log.error(`${origin}-${JSON.stringify(error)}`);
+        return callback(null, error);
+      });
+    }
+
     if (authMethod === 'request_token') {
       // are we working with reusing tokens until they expire?
       if (tokenTimeout >= 0) {
@@ -3403,6 +3738,10 @@ class ConnectorRest {
         authMethod = props.authentication.auth_method;
       }
 
+      if (Array.isArray(props.authentication.multiStepAuthCalls)) {
+        multiStepAuthCalls = props.authentication.multiStepAuthCalls;
+      }
+
       // set the username (required - default is null)
       if (typeof props.authentication.username === 'string') {
         username = props.authentication.username;
@@ -3662,6 +4001,11 @@ class ConnectorRest {
         sslCiphers = props.ssl.ciphers;
       }
 
+      // set the ssl passphrase (optional - default is null)
+      if (typeof props.ssl.passphrase === 'string') {
+        sslPassphrase = props.ssl.passphrase;
+      }
+
       // set the ssl ciphers (optional - default is null)
       if (typeof props.ssl.secure_protocol === 'string') {
         secureProtocol = props.ssl.secure_protocol;
@@ -3949,6 +4293,9 @@ class ConnectorRest {
         if (sslCiphers) {
           options.ciphers = sslCiphers;
         }
+        if (sslPassphrase) {
+          options.passphrase = sslPassphrase;
+        }
         if (secureProtocol) {
           options.secureProtocol = secureProtocol;
         }
@@ -4133,6 +4480,9 @@ class ConnectorRest {
         if (sslCiphers) {
           options.ciphers = sslCiphers;
         }
+        if (sslPassphrase) {
+          options.passphrase = sslPassphrase;
+        }
         if (secureProtocol) {
           options.secureProtocol = secureProtocol;
         }