Configuring 2 Factor Authentication (2FA)

What is 2FA and how does it work?

Two-factor authentication adds a second level of authentication to an account log-in. When you have to enter only your username and one password, that's considered a single-factor authentication. 2FA requires the user to have two out of three types of credentials before being able to access an account.

There are three basic credentials to authenticate yourself to a system:

1. Something you know. For example a password
2. Something you have. For example a mobile phone, a card or a security token.
3. Something you are. For example your fingerprints, face, eyes or DNA

An example of 2 Factor Authentication is online banking where a person needs to login with a username and password and has then to enter a number from a device or a SMS. 

In case of Straatos, the 2 Factor Authentication relies on the password (something you know) and the Phone with the Google Authenticator app (something you have).

Why 2FA?

Passwords are everywhere. Users use them to access social media accounts, emails, business applications, networks, play games, transfer money and much more.

Usernames and Passwords are valuable to hackers to gain access to your personal data and to steal your data, money and identity. In recent years, password thefts have increased and even large companies have become victims of breaches. Google Research, over the course of March 2016 to March 2017, has identified "788,000 potential victims of off-the-shelf keyloggers; 12.4 million potential victims of phishing kits; and 1.9 billion usernames and passwords exposed via data breaches and traded on blackmarket forums".

In addition, the people at the National Institute of Standards and Technology have found that increaseing the complexity of passwords and forcing the users to change them more frequently does not help to increase the security. In many cases it decreases security as users change passwords only slightly and in predictable ways.

With 2 Factor Authentication, there is an added layer of security. The attacker does not only need to get the users username and password, but also needs to get the hands on the device in order to login to the account. Hence 2 Factor Authentication increases the security of the account.

Enable 2FA verification

There are two ways that 2FA can be enabled. It can be configured on Group or Organisation level to be required that all users use 2FA within that organisation. Alternatively, users can choose themselves to enable 2FA to enhance the security of their account.

1. If 2FA is enforced through a Group Policy, the user is required to setup the 2FA after the initial login. The user is directed to the Edit Profile page and must successfully complete the 2FA configuration before allowed access to Straatos. To learn more about setting up a group or organisation enforced 2FA click here.
2. If 2FA is not enforced, the user can enable 2FA by going to 'Edit Profile'

Enable 2FA

Goto 'Edit Profile' by clicking onto your login Name on the top right (if not automatically directed to the Edit Profile page)

Enable the 2 Factor Authentication by switching it to 'on'

Once enabled, additional configuration fields appear to complete the 2FA setup

Confirm Password

For security, please enter your password for your user name. Note, the password is not immediately checked, but without the valid password, the setup process can not be completed.

Download the app

The Google Authenticator app lets you generate security codes on your phone without needing to receive text messages. If you don't already have the Google Authenticator app, you can download it from the links below:

• Authenticator for iOS
• Authenticator for Android

Create a new time-based code in Google Authenticator App

1. Open the Google Authenticator App
2. If you do not have an existing time-based code setup, your will see the start screen. Press the 'Begin Setup' button
   
3. Tap onto the 'Scan barcode' and point the camera at the Barcode on the Straatos Screen
4. The app will automatically reads the barcode and create a new time-based code similar to the screen below
   

Complete the setup

1. Enter the authenticator code displayed in the app
   
2. If the Authenticator code is verified correctly and the password entered matches, the 2FA configuration fields disappearthen
3. 2FA setup is completed and active.

From now on, every time you log into Straatos, the 2FA is required to log in.

How to login with 2FA

1. Goto the CumulusPro Straatos Login Page
   
2. Type in your username and password. If your login requires 2FA, an additional prompt appears for the Authenticator code.
   
3. Launch your Google Authenticator App on your mobile device
   
4. Type in the 6 digit code that is displayed in the Authenticator app (in the example above 766726)
5. Click on the 'Sign in' button on Straatos login screen

Disable 2FA

2FA can be disabled in the 'Edit Profile' by switching the 'Enable 2 Factor Authentication' to 'off'.

Once it is set to off, 2FA is no longer required to log in.

Reset 2FA

Once 2FA is enabled for a user, the user must use 2FA to login. Without the 2FA code from the Google Authenticator app, the user can not access any areas of Straatos.

There might be cases where the user does not have the Time-based code from the Google Authenticator app, for example

• User deleted the Google Authenticator app
• User lost the phone/phone got stolen
• User deleted the straatos profile in the Google Authenticator app

In this scenario, a Straatos User with Admin Rights can reset the 2FA by disabling it. After the 2FA is disabled, the user can login with the username/password again. In case 2FA is enforced, the user will then be able to setup the 2FA again.

1. Login to Straatos with an Admin User
2. Goto Authentication - Accounts
3. Open the User's Account
4. Disable the 2 Factor Authentication

Enable 2FA enforcement on Group or Organisation Level

Group Level enforcement

1. Login to Straatos
2. Navigate to the Group that requires 2FA
3. Click on 'Group Settings'
4. Switch the 'Enforce 2 Factor authentication' to 'on'

From now on, all users defined at this group level will require 2FA to log in. Users that already exist in the system prior to 2FA being enabled, will require to setup 2FA during the next login.

Organisation Level enforcement

1. Login to Straatos
2. Navigate to the Organisation that requires 2FA
3. Click on 'Organisation Settings'
4. Switch the 'Enforce 2 Factor authentication' to 'on'

From now on, all users defined in this organisation will require 2FA to log in. Users that already exist in the system prior to 2FA being enabled, will require to setup 2FA during the next login.