Two-Factor Auth Configuration
In order to improve user security in the system, some clients and/or servers will have a form of two-factor authentication imposed upon login. The two-factor auth process will rely on the Google Authenticator app, which the user attempting to login will need to download to the device.
Here’s a link to the app in the Apple App Store: https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8
Here’s a link to the app in the Google Play Store:
NOTE: If two-factor auth is enabled for the entire server, then it cannot be overridden at a customer level. This means ALL users will be required to login via two-factor auth regardless of the customer settings. It is currently an engineering task to disable enforcement of two-factor at the server level.
NOTE: If enabling two-factor auth for a specific customer, only users initially created based on campaign assigned to that user will be impacted. If you simply un-assign that user from accessing the original customer (via the Security tab on the user page), it will not disable two-factor auth for that user.
When the user logs in for the first time, and two-factor auth is required, they will see the following screen.
Using the Google Authenticator app, and if they have a device with a camera, they can simply scan the QR code presented, and the initial setup will be complete. If the user does not have a camera, they can manually enter the key (using the text after the Manual Key Entry field) shown in the above screenshot into the Google Authenticator app to complete the initial setup.
After the initial setup, each time the user logs in, they will be presented with the following screen, where they will need to enter their PIN generated from the Google Authenticator app. The user has a short window after the PIN expires for it to still remain valid.
In the event a user loses access to the Google Authenticator app, they will need to contact an administrator who has the ability to edit the user account on the GRU system. When editing the user, there is an area where the authentication flag can be reset. When the user attempts to login again, they will be presented with the workflow to initialize two-factor auth.