Smartstaff
2,091
edits
Changes
m
* __TOC__=Overview='''Multi-Factor Authentication (MFA)''' is a method of authentication in which a user is granted access to your SmartSimple Cloud system only after successfully presenting two or more pieces of evidence to an authentication mechanism. The security impact of MFA is that while a user might lose their authentication device or get tricked into sharing a password, the odds of both happening to a single user are dramatically reduced. Using MFA therefore enhances an organization's security by requiring users to identify themselves with more than their login credentials.
=Overview=SmartSimple Cloud supports two ways of implementing MFA:When using * '''TwoTime-based One-Factor Authentication,Time Password (TOTP) '''each new user can use the Google Authenticator via an authenticator app to obtain one-time passwords , which is more secure and suitable for users with increased access such as global administrators or internal staff* '''Single Use Verification Code '''sent via email or SMS, which is better suited for external users or users who login infrequently '''Note:''' MFA and password reset emails are calculated sent from time non-production environments as of the March 2023 upgrade. If you wish to add role restrictions for access to your backup environment, the setting is located at '''Menu''' icon > '''Global Settings''' > '''Security '''tab > '''System Feature Permissions''' > '''Feature''' tab > '''Restrict Login to Backup Environment to these Roles'''. When testing MFA and/or eventpassword reset emails on non-based algorithmsproduction environments, always use a test user and test email.
Most websites that a user can log into require a username and password=Configuration=To toggle on multi-factor authentication, both "known" by the individual in order to log in. In short, this means that anyone who knows the correct username and password combination for a unique account can log into that account; thus, there is very little that can be done to identify that the individual logging is is actually the individual who owns the account. follow these steps:
The :# Navigate to '''Global Settings''' > '''Security''' > '''Password and Activation Policies''':# Scroll to'''TwoAuthentication Options''' and toggle on '''Enable Multi-Factor Authentication Authentication'''function provides a second factor - this can be something :# Specify the roles that someone has (for example, an access card) require authentication via TOTP and/or some unique property of that person (for exampleVerification Code. If the same role is added to both methods, a fingerprint, or a code sent to a personal mobile device)only TOTP will be used.
The security impact of the '''Two-Factor Authentication <u>NOTE:</u>'''is that while a user may lose an access card or get duped into sharing a password, If you select the odds of both happening to a single user are dramatically reduced. Using '''Two-Factor Authentication Everyone'''therefore enhances an organization's ability option, you do not need to ensure that no one is using illegitimate means to gain accessupdate this setting when new roles are created.
'''Two-Factor Authentication '''is a required component of maintaining [[SmartSimple]]'s SOC2 security status. SmartSimple supports two different '''Two-Factor Authentication '''approaches:
* '''TOTP '''([https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm Time-based One-Time Password]) - this technique uses an authentication app that is installed on a mobile phone
* '''RSA Disconnected Token '''- this technique requires a physical device used to generate a one-time code
<pre>This article deals specifically with the [[File:Authentication Options.png|thumb|none|800px|Authentication options for time-based one-time passwords (TOTP protocol. To learn more about the RSA Disconnected Token protocol ) and its related costs, please contact your account manager. </pre>==Prerequisites==In order to configure '''Two-Factor Authentication, '''you will need to have the following: verification codes via email or SMS]]
* [[Global User Administrator|System Administrator]] access ==Time- your [[User|user]] [[User Role|role]] in your [[SmartSimple]] [[instance]] must be '''System Administrator.'''Based One-Time Password (TOTP) Implementation==* Access to a mobile device and the appropriate Google Authenticator application installed on the device A time-based one- the app time password can be retrieved from Google Play, App Store, etc by searching generated using an authentication device (such as a mobile phone) in order to allow for "Google Authenticator" in the application storean additional security step to authenticate logins.
The first step of ===Logging in the implementation process is First Time with TOTP===In order to create this role in your use TOTP effectively, users must first download an authenticator application onto their mobile devices. Popular authentication apps include [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_CA&gl=US&pli=1 Google Authenticator], [SmartSimple]https://www.microsoft.com/en-us/security/mobile-authenticator-app Microsoft Authenticator] , or [[instance]https://play.google.com/store/apps/details?id=com.twofasapp 2FAS]. When logging into the system for the first time after TOTP has been activated on the user's role, the user must first follow these steps:
1===If the Mobile Device Associated with TOTP is Misplaced===<pre>NOTE: If a mobile device associated with TOTP is misplaced, the TOTP must be reset by a Global Administrator or by a user in a role with the permission to reset the TOTP for other user roles. Click on </pre>In the case of a user's device being misplaced, the 9-square menu icon on following steps will allow an internal user in the top right of your page.roles listed above to reset a user's TOTP:
The list of available [[User Role|==Single-Use Verification Code Implementation==A single-use verification code is a uniquely generated number that is sent to the user roles]] in your via an email or SMS text. Since verification codes typically expire within a few minutes, each time the user logs into the system , they will be displayedprompted for their single-use code.
4===Setting up Verification Codes for Email===<pre>Note: If you are using the SMTP Relay with an IP restriction for sending emails, ensure the IP of your environments (backup, testing, production) is in your IP list. Click on the '''+ icon '''on If you need to help with identifying the top left in order to '''Create a New RoleIPs of your environments or have questions, reach out to our support team. '''</pre>
:: [[File:2factor create new The easiest way to set up MFA is through the email that was used for user role.png|500px|border]] 4. The '''New Role '''page will be displayedregistration and login.
:: # Go to '''Menu Icon''' > '''Global Settings''' > '''Security''' tab > '''Password and Activation Policies''' and then scroll down to the section marked '''Authentication Options'''.# Toggle on '''Enable Multi-Factor Authentication'''. You will see additional settings displayed for different authentication methods. # Under the '''Roles with Verification Code via SMS or Email''' setting, you will need to decide which roles need to be authenticated via a verification code sent through the email address used for login. Click the '''Save''' button at the bottom of the page to activate changes.<br /> [[File:2factor new role2022-11-ticket-139210-3.png|500pxthumb|none|800px|borderAdding a specific role for SMS or email verification]]
Fill out ===Logging in with a Verification Code from Email===When a user has been assigned a role that requires a verification code, they can login using the following detailssteps:
* # When the user logs in using their email and password, they will be taken to a page where they can click a button labelled '''Name: Send Code by Email.'''2 Factor Authentication <br /> [[File:2022-11-ticket-139210-4.png|thumb|none|800px| The multi-factor authentication page lets the user choose between receiving the verification code via email or SMS (for clarification of the role purposeif applicable) ]]# They will be prompted to enter a verification code that was sent to their email. <br /> [[File:2022-11-ticket-139210-4a.png|thumb|none|800px| The user will be prompted to enter a verifcation code sent to their email address]]* '''Caption# The user must open their email to copy the verification code. <br /> [[File: '''2 Factor Authentication (as 2022-11-ticket-139210-5.png|thumb|none|800px| A sample email containing a temporary verification code]]# Enter the caption is typically verification code into the same or similar to the field and then click '''NameSubmit''') * '''Descriptionto finish authentication and log in to the system. <br /> [[File: '''TOTP (for clarification of 2022-11-ticket-139210-9.png|thumb|none|800px| Entering the temporary verification code into the role purpose) verification field]]
5===Setting up Verification Codes for SMS===SMS (text messaging) is paid service that must be enabled for you by SmartSimple. In the Contact Support or your account representative for more details. SmartSimple will enable SMS services by going to '''Menu Icon'''Two Factor Authentication > '''field, click into it and select the option Global Settings''' > '''Communications''' tab > Toggle on '''Enable SMS Notification'''Time. Ensure that the target users have an active mobile number filled into this standard field. If the phone number field is empty, users will not be able to receive any SMS messages for login.[[File:2022-based One11-time Password (TOTP)ticket-139210-8.'''png|thumb|none|800px]]
* ===Logging in with a Verification Codes for SMS===# When the user logs in, they will be presented with the option to receive a verification code via email or through SMS. The user can click '''NoteSend Code by Text Message'''. <br /> [[File: If you select 2022-11-ticket-139210-6.png|thumb|none|800px| Users have the '''None '''optionof receiving the code via email or through SMS]]# The user can check their mobile messages, enter the code into the field, this means that and then click '''tSubmit'''here will be no twoto finish authentication and log in to the system. <br /> [[File:2022-11-ticket-139210-factor authentication enabled for this user role7. When someone with this png|thumb|none|800px| Once the verification code has been sent, the user role tries will be prompted to enter the system, they are able to successfully log in by inputting just their correct username and password combo.code into the verification field]]
6==Bypassing Multi-Factor Authentication for Single Sign-On==If multi-factor authentication has been enabled, it can be bypassed for users logging in via single sign-on (SSO). Click the To bypass MFA, go to '''Save Global Settings'''button at > '''Integrations''' tab > '''Single Sign-On''' > Edit an SSO setting > Toggle on '''Bypass Multi-Factor Authentication (MFA) when logging in with Single Sign-On (SSO)'''.[[File:SSO-Bypass-MFA.png|thumb|none|800px| Multi-factor authentication can be bypassed in the bottom of the page.single sign-on settings]]
The page will refresh with ==Setting up a Default Email Address==If you are using SMTP relay and/or have a dedicated instance (your own domain), make sure you have set up the role saved into default email address and that the systemdefault email address matches your domain.Otherwise your default email address should be set to '''donotreply@smartsimplemailer.com'''. Follow these steps to set up a default email address:
To check that # Go to '''Menu''' icon > '''Global Settings''' > '''Communications''' tab# Click '''Email Options and Security'''# Toggle on '''Enable Default From Address'''# Enter your role has been successfully added: desired '''From Address'''# Click '''Save'''
1. Click the '''list icon '''in the top left row of buttons on the '''2 Factor Authentication '''Role page.
:: [[File:Return to user rolesdefault-email.png|90pxthumb|none|border800px|Set up a default email address to help ensure that verification emails do not get blocked by the SMTP relay]]
2. This will bring you to the [[List View Overview=Settings Explained={|list]] of all user roles in the system once more. You should now see the class="wikitable"|-||'''2 Factor Authentication Setting'''role listed.
:: [[File:2factor role.png|600px|border]]'''Description'''
This will bring you to the |-||'''Edit Enable Multi-Factor Authentication'''details for that role.
5. Under the '''General '''tab, scroll down until you see the '''Two-Factor Authentication '''field||Enables MFA for the entire instance but does not have any impact unless user roles are specified.
When the user receives the new password then they navigate to the activation screen.|-||'''Roles with Verification Code via SMS or Email'''
If this is | style="border-color: #;"|Associates one or more roles with authentication proved through either email or an SMS message. The user can choose at the first point of verification to receive an email containing the one-time code or an SMS message containing the user has had a one-time code generated then the screen should include a '''QR Code''' that can . SMS must be scanned using Google Authenticatorenabled by SmartSimple and will incur an additional cost. The actual authentication code is also provided in case there are issues with the use of Google AuthenticatorPlease speak to Support or your account manager for more information.
[[Image:EnableTwoFactor 3.png|800px-|border]]|'''Enable Trusted Device'''
If the user has an existing QA Code then the user can click a button ||This option is used to generate a new code and re-sync or can proceed to the login pagebypass MFA authentication for specific roles on specific devices.
Users will then be prompted to enter the one|-time code after entering their user name and password. <br />[[Image:EnableTwoFactor3.png|800px|border]]'''Trusted Device Expiry'''
==Notes==||* Sets the frequency of the MFA prompt, based on the number of days specified. If both [[Single Sign-On]] and Two-Factor Authentication are in usethe number is set to one, there is a Single Sign-On setting option that the user will control whether or not Two-Factor Authentication be prompted every day for an MFA verification code. If its set to five, then the user will be required when a user authenticates via SSOprompted every five days.
==See Also==* [[User Role]]s|}
→Overview
==Configuring a Role to Use Two=Setting up TOTP Multi-Factor Authenticationfor Specific Roles===:# In your SmartSimple instance (logged in as Global Admin), go to'''Menu Icon'Two-Factor Authentication '' > '''Global Settings'''is configured by .<br /> [[User RoleFile:GlobalSettings5.png|thumb|none|800px|The <strong>Global Settings</strong> link under the main menu]]. For best practice:# Go to the Security tab > '''Password and Activation Policies > '''Under “Authentication Options”, it is recommended to specifically create toggle on '''TwoEnable Multi-Factor Authentication Authentication (MFA)'''as a new role and add it to .:# In the existing users. While setting '''TwoRoles with Time-Factor Authentication Based One-Time Password (TOTP),'''can be added include the roles that you want to an existing role, it is not recommended because it will become more complex to manageenable multi-factor authentication for. <br />For roles that have this feature enabled, the use of :# Toggle on '''Two-Factor Authentication Enable Trusted Device'''becomes mandatoryif you would like users to be able to bypass entering a code for a time period after the code has been successfully entered. This involves a drastic change in user experienceIf enabled, so SmartSimple recommends that this action be rolled out also enter the time period until the authentication bypass expires.:# Scroll to users in small groups at the beginning bottom of the processpage and click '''Save'''.
:# If user has TOTP enabled on their account, they will be presented with the following screen the next time they log in: <br /> [[File:MFASetupTOTP.png|thumb|none|800px|TOTP setup page with instructions]]:# Follow the steps below in order instructions listed on the screen. Start by installing an authenticator app on your mobile device. :# On your mobile device, open the authenticator app and select the option to configure add a new device or scan a QR code. Each app will have different actions. <br /> [[User RoleFile:ScanQR.jpg|thumb|none|user role800px| Interface for Google Authenticator]] to :# The app may prompt you for a QR code or a secret key. Back on your SmartSimple MFA setup page, click the button labeled '''Show TOTP Key and QR Code''Two'. This will reveal the QR and secret key used with an authentication app. <br /> [[File:QRandSecretCodeScreen.png|thumb|none|800px|<strong>TOTP QR Code</strong> and <strong>TOTP Secret Key</strong> revealed]]:# Use the mobile app to scan the QR code or manually enter the secret key into the app. Once complete, a new device will be added to your list in the app. :# The mobile app will generate a time-Factor Authenticationbased verification code. Enter this code into the field labelled '''Enter Verification Code''' on the setup page. :# Click '''Submit. '''
:# Navigate to the user's profile who wishes to have TOTP credentials reset.: {{Icon-Menu}} 2. Under # From the heading '''Configuration, Actions'''select dropdown, select '''Edit Roles and SecurityAccess'''.:# In the following modal window, select the button labeled '''Reset TOTP'''. <br /> [[File:ResetButton.png|thumb|none|800px]]:# The user may now login as normal, following the prompts on the subsequent '''Set Up Multi-Factor Authentication''' screen.
===Determining Which Roles Can Reset TOTP===:: # In your SmartSimple instance (logged in as a '''Global Administrator''') in the '''Main Menu''', select '''Global Settings'''.<br /> [[File:2factor rolesGlobalSettings5.png|220pxthumb|none|800px|borderThe <strong>Global Settings</strong> link under the main menu]]3:# Navigate to the '''Users''' tab and click '''Roles'''. Click :# '''Edit''' the role that you would like to grant the ability to reset TOTP on behalf of other users. For security best practice, this role should be an internal role only.:# Select the '''Permissions''' tab.:# In the first hyperlink labelled field '''User Rolesthis role can reset TOTP for''', select the other roles that this role can reset TOTP on behalf of.<br /> [[File:RolesTOTPReset.png|thumb|none|800px]]:# Click '''Save'''.
|-
||
'''Roles with Time-based One-time Password (TOTP)'''
||
Associates one or more roles with authentication proven through an authenticator app such as Google or Microsoft Authenticator.
=See Also=
:* [[User Role]]s
[[Category:Security]]