Connect with Us!
Latest Event
Latest Case Study
Latest Case Study
Discover Affino
Two-Factor Authentication Guide
In Affino, users and your internal staff users can use Two-Factor Authentication when they login from an unrecognised device.
This minimises the risk of granting access to non-authorised users or hackers to the back-end and for front-end users.
Affinos’ 2FA allows you to define which security groups can use 2FA.
Once a user has confirmed their code, Affino will store the device against their record as a saved device and they no longer need to request a code.
However, users would have the option to not save the device in case they are logging in from a public device.
This guide will show you how to set up 2FA.
Set up 2FA on the Login Profile
Control > Security > Login Profiles > (Add/Edit) > Two-Factor Authentication
The Two-Factor Authentication panel on the Login Profile allows you to enable 2FA and to choose whether to use Email and/or SMS as the preferred verification method.
Fields:
- Enable Two-Factor Authentication: Select to enable Two-Factor Authentication (This will send a code to their email or mobile when logging in from an unrecognised device)
- Use Email Two-Factor Authentication: Select to use email as Two-Factor Authentication (This will send a code to their email when logging in from an unrecognised device)
- Use SMS Two-Factor Authentication: Select to use SMS as Two-Factor Authentication (This will send a code to their mobile when logging in from an unrecognised device)
- SMS Provider Profile: Select the SMS Provider Profile used to send out the 2FA code
- Security Groups: Select which Security Groups can use 2FA
- Enforce Security Group: Select which Security Groups should be enforced to set up 2FA (If email is enabled, then the 2FA will be turned on automatically. If SMS is enabled, then they will be redirected to their My Account > Security screen to verify their mobile)
- Email Notification Subject: Subject of the message sent out in the email with the code
- Email Notification Message: Enter the email message to be sent out to users who reset their password via email (You can use the following placeholders: [_Email_Address_] and [_Code_])
- SMS Notification Message: Enter the email message to be sent out to users who requested a code to use in 2FA (You can use the following placeholders: [_Email_Address_] and [_Code_])
- Two-Factor Authentication Guidance: Enter the Two-Factor Authentication Guidance text that appears on the My Account screen, under Security (This text goes alongside the off/on toggle)
- Two-Factor Authentication Message: Enter the Two-Factor Authentication message that appears on the screen when this is triggered.
- Two-Factor Authentication Enter Code Message: Enter the Enter Code message that appears on the screen on top of the code field.
- Two-Factor Authentication Success Message: Enter the success message on screen once the code has been verified.
- Mobile Verification Guidance: Enter the Mobile Verification Guidance text that appears on the My Account screen, under Security (This text goes just above the link to add a mobile number for verification)
- Mobile Verification Message: Enter the Mobile Verification message that appears on the verification screen on top of the code field (This is only available if SMS Two-Factor Authentication is enabled)
- Mobile Verification Enter Code Message: Enter the Enter Code message that appears on the verification screen (Use [_Mobile_Number_Last4Digits_] placeholder to show the user's last 4 digits mobile number. This is only available if SMS Two-Factor Authentication is enabled)
- Mobile Verification Success Message: Enter the success message that appears on the screen once the code has been verified (This is only available if SMS Two-Factor Authentication is enabled)
- Mobile Verification SMS Notification Message: Enter the email message to be sent out to users who requested a code to verify their mobile (You can use the following placeholders: [_Email_Address_] and [_Code_]. This is only available if SMS Two-Factor Authentication is enabled)
- Code Expiry Period: Enter a value between 10 and 120 minutes. This period is the time a code (sent by email or SMS) will expire. Once expired, the user will need to request another code (Note: this expiry period is for both, Two-Factor Authentication and Mobile Verification)
Set up the SMS Provider Profile
Control > Settings > SMS Provider Profiles > Add
If you enabled the ‘Use SMS Two-Factor Authentication’ on the Login Profile then you will need to set up an SMS Provider Profile.
Without that profile set up, users will not be able to receive the SMS and code required for their authentication.
Note: only TXT Local is currently supported as the SMS Provider.
Fields:
- Name: Enter the Name you wish to call this SMS Provider Profile
- Description: Enter a brief description of the profile or any additional information which outlines the purpose of the profile
- SMS Provider (TXT Local): System field only, displays SMS Provider
- API Key: Enter your API Key from the Control Panel on TXT Local
- Test Mobile Number: Enter a test mobile number for sending out a test SMS message. If no mobile number is entered then no test will be sent. The number must start with the international prefix. The test message will be sent immediately, and the phone number removed. You will need to re-enter the mobile phone number for each test.
You can generate the API from the (Settings > API Keys) screen on TXT Local dashboard.
Click on Create New Key:
Leave blank and Save New Key:
Copy and paste the newly created API Key to the API Key field in the profile:
My Account: Two-Factor Authentication and Mobile Verification
My Account > Security > Two-Factor Authentication + Mobile Verification
When a user navigates to their My Account page they will see the Security option.
Clicking on the Security link will display the Two-Factor Authentication and Mobile Verification options.
This screen gives the ability to users to manage whether they want to use the 2FA tool. It is only visible if the 2FA is enabled on the Login Profile.
Users can also verify their mobile phone if they wish to use the 2FA via SMS.
After a user clicks on Verify, an SMS message will be sent.
The code is input and the Verify Code button is clicked:
The user now has their mobile number verified:
Users can also delete the number by clicking on the ‘Remove Number’ option:
Note: this screen will only be available to the users set in the ‘Security Groups’ option on the Login Profile.
User Login after enabling 2FA
Once a user enables 2FA on the (My Account > Security) page, they will be shown a Two-Step Authentication screen when they try to login.
Either one screen or both (Email Two-Factor Authentication / SMS Two-Factor Authentication) will be displayed, based on the selection made on the Login Profile and the users choice on the (My Account > Security) page.
Once they select an option, the code input screen will shown:
When the correct code is input, the success screen is displayed:
- and the user is redirected to the site.
User Security: Verified Mobile and Saved Devices
Control > Security > User Security > Audit
When user has verified their mobile number via SMS and their device via email, two new data points will be displayed on the Audit panel within the User Security detail screen:
When successfully logged in, Affino will save the browser string and date as a Saved Device.
Contacts: Saved Devices
Affino also lists the saved device per contact when they use the Two-Factor Authentication to log in.
The browser string and date are stored on the Saved Devices panel:
Two-Factor Authentication: Enforce Security Group
Control > Security > Login Profiles > (Add/Edit) > Two-Factor Authentication > Enforce Security Group
If a user is part of the Enforce Security Group, next time they login, they will be redirected to the (My Account > Security) screen:
When they logout and log back in again, the Two-Step Authentication screen will be displayed to the user:
In essence, the users set in the Enforce Security Group are obligated to use 2FA.
Conversion Events: Two-Factor Authentication/Verification Successful
Control > Promote > Conversion Events
There are 2 Conversion Events that can track which users have successfully verified their mobile and their login by using the 2FA.
1.- Two-Factor Mobile Verification Successful
2.- Two-Factor Authentication Successful
Both Conversion Events will trigger when the codes are accepted on the display side.
Did you find this content useful?
Thank you for your input
Thank you for your feedback
Driving business at some of the world's most forward thinking companies
Our Chosen Charity
Meetings:
Google Meet and Zoom
Venue:
Soho House, Soho Works +
Registered Office:
55 Bathurst Mews
London, UK
W2 2SB
© Affino 2024