Inside Activate
...
How To Guides
One Time Password (OTP) and Multi-Factor Authentication
6 min
activate supports multi factor authentication (mfa) for password reset and login using one time passwords (otp) an otp is a time based passcode generated from a secure algorithm, commonly used in authenticator apps such as microsoft authenticator or google authenticator this provides an additional layer of security beyond traditional email or sms verification authenticator apps users can install any app that supports standard otp algorithms (totp) common options include true 220,220,221left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type configuration to enable multi factor authentication for password resets set the parameter //resources/configuration/passwords/requirepin to true this enforces a second factor requirement during password reset the default registration task (//tasks/passwords/set password questions) allows selection of email , sms , or one time password as verification methods you can disable email and sms options in the form if they are not permitted optionally, disable shared secrets by setting toset and toreset to 0 this enforces otp only authentication without security questions registration process users register for otp through the standard password reset registration process by selecting one time password as their second factor method they are presented with a qr code , which can be scanned using their authenticator app the registration information is securely encrypted and stored within activate password reset when resetting a password, instead of receiving a pin by email or sms, users enter the one time password generated by their registered app otp based authentication is supported across activate internal web reset activate anywhere password reset activate windows credential provider activate anywhere login once registered for mfa, users can also be required to use their otp when logging into activate anywhere configuration parameters true 220,220,221left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type left unhandled content type securing sensitive tasks mfa can also be required when executing sensitive web tasks to enforce this, include a multifactorcode control in the task’s web form \<multifactorcode id="pin1" label="code" /> the form cannot be submitted until a valid otp is entered, providing an extra layer of security for critical actions