2FA - Revision history

Administrator at 05:13, 2 October 2023

2023-10-02T05:13:00Z

← Older revision		Revision as of 05:13, 2 October 2023
Line 22:		Line 22:
	'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable		'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable

	Suggestion ~~configure~~:		Suggestion settings:
	[[File: 2fa.jpg]]		[[File: 2fa.jpg]]

Administrator at 05:09, 2 October 2023

2023-10-02T05:09:05Z

← Older revision		Revision as of 05:09, 2 October 2023
Line 3:		Line 3:
	Two Factor Authentication		Two Factor Authentication

	= ~~User Resource template~~ =		= Configure settings for secure user login =
	~~Add Login~~ settings on User resource template:		Configure login settings on User resource template:

	If the user resource template is enabled WebAuthn, all users of the user resource template, when login will use WebAuthn for login. If not enable WebAuthn, user can login as normal.		If the user resource template is enabled WebAuthn, all users of the user resource template, when login will use WebAuthn for login. If not enable WebAuthn, user can login as normal.
Line 22:		Line 22:
	'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable		'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable

	Suggestion ~~setup~~:		Suggestion configure:
	[[File: 2fa.jpg]]		[[File: 2fa.jpg]]

Administrator at 04:44, 2 October 2023

2023-10-02T04:44:27Z

← Older revision		Revision as of 04:44, 2 October 2023
Line 21:		Line 21:

	'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable		'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable

			Suggestion setup:
			[[File: 2fa.jpg]]

	= Device Requirement =		= Device Requirement =
Line 133:		Line 136:
	Force or 2facredential will redirect to loginFirst if enable PIN, if not PIN will get message: your device does not support		Force or 2facredential will redirect to loginFirst if enable PIN, if not PIN will get message: your device does not support

	Not force and not 2facredential, can login, if without PIN not getting ask for register, if PIN get asking for register ~~on new login page~~		Not force and not 2facredential, can login, if without PIN will not getting ask for register, if PIN will get asking for register

Administrator: /* Device Requirement */

2022-01-28T10:05:01Z

Device Requirement

← Older revision		Revision as of 10:05, 28 January 2022
Line 26:		Line 26:
	To use WebAuthN your device is required:		To use WebAuthN your device is required:

	Windows need version 1903		Windows need version 1903 (winver)

	[[File: 2fa2.png\|400px]]		[[File: 2fa2.png\|400px]]

Administrator: Created page with "Category:Guides Two Factor Authentication = User Resource template = Add Login settings on User resource template: If the user resource template is enabled WebAuthn, a..."

2021-09-28T08:16:49Z

Created page with "Category:Guides Two Factor Authentication = User Resource template = Add Login settings on User resource template: If the user resource template is enabled WebAuthn, a..."

New page

[[Category:Guides]]

Two Factor Authentication

= User Resource template =
Add Login settings on User resource template:

If the user resource template is enabled WebAuthn, all users of the user resource template, when login will use WebAuthn for login. If not enable WebAuthn, user can login as normal.

[[File: 2fa1.png|700px]]

'''Enable''': you are not required configure login to use WebAuthn, just get asking after you are already login

'''Force''': you are required for configure login to use WebAuthn before login

'''Password''': Beside provide device PIN, you must provide password of your account on this site when login

'''Token''': use a hardware token for login

'''Strict''': can configure login to use WebAuthn on only one device

'''QASBypass''': if be selected, qas will run as normal although the WebAuthN is enable

= Device Requirement =

To use WebAuthN your device is required:

Windows need version 1903

[[File: 2fa2.png|400px]]

Set up Windows Hello PIN

[[File: 2fa3.png|600px]]

If your device still not enable Windows Hello PIN but the user is force or 2facredential, you will meet that message:

[[File: 2fa4.png|700px]]

= WebAuthn enable =

If WebAuthN is enable on your user but not Force and you still not register on any device, right after login to system will be asked for register. You can choose for register or not by click Ok or Cancel

[[File: 2fa5.png|700px]]

If the user already registered on a device or Force, when login will redirect to loginFirst

[[File: 2fa6.png|700px]]

Select credential on the list and click OK for login. If your account not on the list, click cancel, you will get page for register

= Register =

To register a user to use WebAuthN when login, follow these steps:

[[File: 2fa7.png|700px]]

Click OK to accept register

Then input PIN, click OK, you register successful

[[File: 2fa8.png|700px]]

= Login after register =

If you already registered on the current device, when login will redirect to loginFirst and your account will be on credential list

[[File: 2fa9.png|700px]]

Select your account and click OK

Then input PIN for login

[[File: 2fa10.png|700px]]

If enable password, you must input password after input PIN

[[File: 2fa11.png|700px]]

= Register on another device =

When the user already registered on a device, when login will redirect to loginFirst, but your account will not on credential list

[[File: 2fa12.png|700px]]

Click Cancel, you will be asked for reregister

[[File: 2fa13.png|700px]]

Click OK for accept reregister, you will receive an email with a code.

[[File: 2fa14.png|700px]]

Input the code and OK, then input PIN for done

[[File: 2fa15.png|700px]]

= QAS rule =

This is the logic for QAS login:

0. If that is the user that is already logged in, don’t do anything

1. If this is the anonymous user => Anon = load qas, otherwise goto 2

2. check if twofa enabled => true = goto 3, false = load qas

3. check if twofa is skipped for qas => true = load qas, false = goto 4

4. check if twofa is required or there is TwoFaCredentials on the account => true = goto 5, false = load qas

5. check if we have full access to that user already => Have full acccess = load qas, otherwise goto 6

6. Redirect to login first with twoFa

'''In general''' there are 2 cases will redirect to loginFirst and required login before loading qas (other case will load qas as normal)

Case 1: Fore and not QASBypass (no user login before, or have a user login before but the user doesn’t have admin right to qas user)

Case 2: TwoFaCredentials and not QASBypass (no user login before, or have a user login before but the user doesn’t have admin right to qas user)

= Note =

Force or 2facredential will redirect to loginFirst if enable PIN, if not PIN will get message: your device does not support

Not force and not 2facredential, can login, if without PIN not getting ask for register, if PIN get asking for register on new login page