Doc::MFA: Difference between revisions

From Computer Science Wiki
Jump to navigation Jump to search
← Older edit
VisualWikitext
Carnold (talk | contribs)
Staff, Strategic, Techstaff, Bureaucrats, dic
979 edits
Carnold (talk | contribs)
Staff, Strategic, Techstaff, Bureaucrats, dic
979 edits
 
(2 intermediate revisions by the same user not shown)
Line 2: Line 2:


== Introduction ==
== Introduction ==
Computer Science uses Google Authenticator time based one-time password (TOTP) second factor login.  See this article for more information on using the service: https://support.google.com/accounts/answer/1066447  We recommend using the official ''Google Authenticator'' app '''OR''' the ''DUO Mobile'' app on your Android or iOS smart phone, however many apps and devices are compatible with Google TOTP.  We allow and recommend registering multiple Google Authenticator devices.  The goal for MFA is to improve the security of your CS account without causing too much disruption to your workflow.
Computer Science offers two different MFA options. 
* '''Google Authenticator''' time based one-time password (TOTP) login.  See this article for more information on using the service: https://support.google.com/accounts/answer/1066447  We recommend using the official ''DUO Mobile'' app '''OR''' ''Google Authenticator'' app on your Android or iOS smart phone, however many apps and devices are compatible with Google TOTP.
* '''FIDO2 based passkey''' We recommend using bio-metrics on your Android or iOS smart phone to securely store your passkeys.  See https://it-training.apple.com/tutorials/support/sup540/ for iOS support or https://support.google.com/android/answer/14124480?hl=en for Android devices
The goal for MFA is to improve the security of your CS account without causing too much disruption to your workflow.


== How it Works ==
== Enable MFA ==
Once CS MFA is enabled, CS login protected websites will follow this login flow:
Currrently, participation in Computer Science MFA is optional.  You can go to https://admin.cs.vt.edu/my-profile to enable or disable MFA for your CS account.  Not all services currently support MFA login, for example SSH to rlogin.
 
== Trusted Devices ==
After you successfully log in with CS MFA, you have the option to remember the device for a certain amount of time.  This means CS MFA won't ask you to enter your OTP again from this specific "device" until it expires.  You should only do this on machines that you trust, such as your desktop/laptop.  The "device" is specific to the machine and browser that you are using.  For example, if you have Firefox on your laptop saved as a trusted device, then you log in from Chrome on the same machine, it will still ask for your OTP.
 
== Fail Safe ===
CS Login is configured to bypass MFA if you are connected to the official VT VPN.  If you get locked out of your account, you can connect to the VT VPN to access your account again.
 
== Google Authenticator ==
When Google Authenticator is enabled, CS login protected websites will follow this login flow:
* If you are logging in from a new or unknown computer and browser
* If you are logging in from a new or unknown computer and browser
** You are first prompted for your username and password
** You are first prompted for your username and password
** After successful password login, you will be prompted to enter a token.
** After successful password login, you will be prompted to enter a token.
** Open your Google Authenticator App and locate the Computer Science 6 digit token.  The token changes every 30 seconds.
*** Open your Google Authenticator App and locate the Computer Science 6 digit token.  The token changes every 30 seconds.
** Enter your token
** Enter your token
** After successful token, you will be prompted if you want to register the device as "trusted."  You can choose to register or skip.  If you register, then you won't be prompted for the mfa token on this computer/browser combo for a certain amount of time.  If you skip, then you will be prompted again next login.
** After successful token, you will be prompted if you want to register the device as "trusted."  You can choose to register or skip.  If you register, then you won't be prompted for the mfa token on this computer/browser combo for a certain amount of time.  If you skip, then you will be prompted again next login.
** After device registration, you should be taken to your destination site
** After device registration, you should be taken to your destination site
== Enable MFA ==
Currrently, participation in Computer Science MFA is optional.  You can go to https://admin.cs.vt.edu/my-profile to enable or disable MFA for your CS account.  Not all services currently support MFA login, for example SSH to rlogin.


Recommended steps for enabling CS MFA:
Recommended steps for enabling CS MFA:
Line 22: Line 31:
* Leave the "My Profile" page open, and use another web browser or new private window to https://admin.cs.vt.edu to register your device and test.  Doing this will allow you to disable MFA if you have trouble registering.
* Leave the "My Profile" page open, and use another web browser or new private window to https://admin.cs.vt.edu to register your device and test.  Doing this will allow you to disable MFA if you have trouble registering.


== Registering Devices ==
=== Registering Device ===
The first time you log into your account after turning MFA on, you will be prompted to register a Google Authenticator device.  This is done using either a QR code or a secret key, both are display on the screen.  Both the QR code and secret key are sensitive, so keep them safe!  Printing the QR code is a great way to keep a hard copy backup of your MFA code.  Once you have a enter the QR or secret key into your app, click on the "Confirm" button and it will prompt you for your TOTP key.  You can give the device a name which can only be set at the time of registration.  You can register additional TOTP devices by going to https://login.cs.vt.edu/cas
The first time you log into your account after turning MFA on, you will be prompted to register your MFA device.  This is done using either a QR code or a secret key, both are display on the screen.  Both the QR code and secret key are sensitive, so keep them safe!  Printing the QR code is a great way to keep a hard copy backup of your MFA code.  Once you have a enter the QR or secret key into your app, click on the "Confirm" button and it will prompt you for your TOTP key.  You can give the device a name which can only be set at the time of registration.  You can register additional TOTP devices by going to https://login.cs.vt.edu/cas


== Trusted Devices ==
== Passkey ==
After you successfully log in with CS MFA, you have the option to remember the device for a certain amount of time.  This means CS MFA won't ask you to enter your OTP again from this specific "device" until it expires.  You should only do this on machines that you trust, such as your desktop/laptop. The "device" is specific to the machine and browser that you are using.  For example, if you have Firefox on your laptop saved as a trusted device, then you log in from Chrome on the same machine, it will still ask for your OTP.
'''Warning''': Passkey support may vary a lot by all operating systems and devices.
 
When Passkey is enabled, CS login protected websites will follow this login flow:
* If you are logging in from a new or unknown computer and browser
** You are first prompted for your username and password
** After successful password login, you will be prompted to process your passkey
** Generally, an operating system window will pop up giving you the option to select your passkey device
** After successfully presenting your Passkey, you will be prompted if you want to register the device as "trusted."  If you register, then you won't be prompted for the mfa token on this computer/browser combo for a certain amount of time.  If you skip, then you will be prompted again next login.
** After device registration, you should be taken to your destination site
 
Recommended steps for enabling CS MFA:
* Go to https://admin.cs.vt.edu/my-profile and enable MFA
* Leave the "My Profile" page open, and use another web browser or new private window to https://admin.cs.vt.edu to register your device and test.  Doing this will allow you to disable MFA if you have trouble registering.
 
=== Registering Device ===
The first time you log into your account after turning MFA on, you will be prompted to register your MFA device.  Passkey device registration is handled by your operating system, so the process will vary greatly.  


== Tips ==
== Tips ==
* Give your TOTP devices meaningful names when if you first register them, this is especially useful when you have multiple devices registered.
* Give your TOTP device a meaningful name when if you first register them
* Make sure to backup your Google Authenticator codes, and transfer them to any new phone you get.
* Make sure to backup your Google Authenticator codes, and transfer them to any new phone you get.
* You can use a printout of our QR code as a hard copy backup.  Make sure to keep this safe!
* You can use a printout of our QR code as a hard copy backup.  Make sure to keep this safe!

Latest revision as of 08:53, 5 September 2024

Computer Science Multi-factor Authentication (MFA)

Introduction

Computer Science offers two different MFA options.

The goal for MFA is to improve the security of your CS account without causing too much disruption to your workflow.

Enable MFA

Currrently, participation in Computer Science MFA is optional. You can go to https://admin.cs.vt.edu/my-profile to enable or disable MFA for your CS account. Not all services currently support MFA login, for example SSH to rlogin.

Trusted Devices

After you successfully log in with CS MFA, you have the option to remember the device for a certain amount of time. This means CS MFA won't ask you to enter your OTP again from this specific "device" until it expires. You should only do this on machines that you trust, such as your desktop/laptop. The "device" is specific to the machine and browser that you are using. For example, if you have Firefox on your laptop saved as a trusted device, then you log in from Chrome on the same machine, it will still ask for your OTP.

Fail Safe =

CS Login is configured to bypass MFA if you are connected to the official VT VPN. If you get locked out of your account, you can connect to the VT VPN to access your account again.

Google Authenticator

When Google Authenticator is enabled, CS login protected websites will follow this login flow:

  • If you are logging in from a new or unknown computer and browser
    • You are first prompted for your username and password
    • After successful password login, you will be prompted to enter a token.
      • Open your Google Authenticator App and locate the Computer Science 6 digit token. The token changes every 30 seconds.
    • Enter your token
    • After successful token, you will be prompted if you want to register the device as "trusted." You can choose to register or skip. If you register, then you won't be prompted for the mfa token on this computer/browser combo for a certain amount of time. If you skip, then you will be prompted again next login.
    • After device registration, you should be taken to your destination site

Recommended steps for enabling CS MFA:

  • Install Google Authenticator App on your smart phone device: Android or Apple
  • Go to https://admin.cs.vt.edu/my-profile and enable MFA
  • Leave the "My Profile" page open, and use another web browser or new private window to https://admin.cs.vt.edu to register your device and test. Doing this will allow you to disable MFA if you have trouble registering.

Registering Device

The first time you log into your account after turning MFA on, you will be prompted to register your MFA device. This is done using either a QR code or a secret key, both are display on the screen. Both the QR code and secret key are sensitive, so keep them safe! Printing the QR code is a great way to keep a hard copy backup of your MFA code. Once you have a enter the QR or secret key into your app, click on the "Confirm" button and it will prompt you for your TOTP key. You can give the device a name which can only be set at the time of registration. You can register additional TOTP devices by going to https://login.cs.vt.edu/cas

Passkey

Warning: Passkey support may vary a lot by all operating systems and devices.

When Passkey is enabled, CS login protected websites will follow this login flow:

  • If you are logging in from a new or unknown computer and browser
    • You are first prompted for your username and password
    • After successful password login, you will be prompted to process your passkey
    • Generally, an operating system window will pop up giving you the option to select your passkey device
    • After successfully presenting your Passkey, you will be prompted if you want to register the device as "trusted." If you register, then you won't be prompted for the mfa token on this computer/browser combo for a certain amount of time. If you skip, then you will be prompted again next login.
    • After device registration, you should be taken to your destination site

Recommended steps for enabling CS MFA:

Registering Device

The first time you log into your account after turning MFA on, you will be prompted to register your MFA device. Passkey device registration is handled by your operating system, so the process will vary greatly.

Tips

  • Give your TOTP device a meaningful name when if you first register them
  • Make sure to backup your Google Authenticator codes, and transfer them to any new phone you get.
  • You can use a printout of our QR code as a hard copy backup. Make sure to keep this safe!
  • If your TOTP device fails to register for whatever reason, you will need to generate a new QR code by closing the browser and logging in again.
  • If you get locked out of your account because of MFA, Contact Techstaff.
  • You can review your registered and trusted devices by logging into https://login.cs.vt.edu/cas
Retrieved from "http://wiki.cs.vt.edu/index.php?title=Doc::MFA&oldid=4844"