Overview
Equus Platform now allows enabling Multi-Factor Authentication for all non-SSO users. Multi-Factor authentication (MFA) is an additional security layer that ensures additional security by requiring users to provide at least two pieces of evidence that prove their identity (multi-factor).
To demonstrate the second piece of evidence (first is typically credentials username and password), it is common to use a TOTP application (Time-based One Time Password). These include Google Authenticator, Authy, Microsoft Authenticator, etc.
Configuration
You can configure MFA at the System level on the Password Rules screen under Security Maintenance on the Configuration tab.
Fields/options include:
Remember This Device Duration in Days - The number of days a device is remembered when a user checks the ‘Remember This Device’ checkbox. Value can be set from 0 to 365.
Note a value of '0' means the user is asked for an authorization code every time they log in.
Authorization Code Timeout In Minutes - The number of minutes the code is valid. This value must be between 5 and 10,000. Once a code expires, users will need to generate a new code by clicking 'Resend Device Authorization Email' .
Device Authentication Method sets the verification procedure that users will use:
Email (Legacy) - Users will solely receive a 6 digit code via email to authorize their device.
Authentication App (Opt-In) - Users are permitted to optionally setup MFA.
Authentication App (Mandatory) - All users are required to setup MFA.
To enable MFA for all users, select either Authentication App (Opt-In) or Authentication App (Mandatory) and click
to confirm the changes.
Once MFA is enabled users will be prompted to setup MFA as soon as they login. They will be presented with the Activate Multi-factor Authentication screen and need to enter the code that is generated in their authenticator app upon either scanning the authentication QR code or entering the Secret Key.
Things to Note
MFA is not available for SSO users.
Secret Keys should be kept confidential to and only backed up to a secure location. If a user thinks their secret key may have been compromised, they should contact their system admin who can reset it.
Administrators are able to reset MFA for users if they have enabled it and are locked out of their account. This is completed on the user record
If MFA is not mandatory at the system level for all users, users can opt in their user profile by clicking on the Profile icon in the top right hand corner and clicking on the Profile option.
Disabling the MFA follows the same steps to enabling it. After confirming the password, the user must enter the code generated by authenticator app and click [Disable].