View source for Web:Multi-Factor Authentication Expansion

 - Note: Google Authenticator MFA has also been added.  See that [[Web:Google Authenticator Multi-Factor Authentication Expansion |page]] for more information

=Basic Description=
As a default, Prime 16 Web provides the ability to use email in a Multi-Factor Authentication (MFA) setup.  This expansion allows your organization to expand on that offering authentication codes via text or phone call.  Text and Phone calls are provided using an organization operated Twilio account, phone number, and setup.

All parts of the login experience, including Multi-Factor Authentication may be controlled from easy-to-use administration forms within Prime.

=Multi-Factor Authentication Setup=
From within Prime 16 Web, navigate to '''Administration''' --> '''Logon and Multi-Factor Authentication (MFA)''' --> '''Logon Settings'''

The Logon Settings allows you to set a number of options for your users:

[[File:Screen Shot 2022-03-07 at 2.33.23 PM.png|200px]]

Check the box next to '''Require Email Entry in Login''' to require the entry of Staff Number, Password, and Email in the initial login box.  Uncheck this box to only require Staff Number and Password.

Check the box next to '''MFA is IP Conditional''' to bypass MFA if the user comes from an approved IP address.  Uncheck the box if MFA is always required.

In '''MFA Bypass''', enter the IP address, addresses, or IP address range (separated with commas) to indicate the IP address(es) that are approved to bypass MFA.  Use the CIDR notation format to indicate address ranges, for example, 8.8.8.8/24 would cover addresses 8.8.8.1 to 8.8.8.254.

Check the box next to '''Enable Email MFA''' to offer email as an MFA option to users.  Email MFA comes through the Kemp's Case Works domain email system, so you'll want to be sure to whitelist the kempscaseworks.com domain email system.  Uncheck this box if you do not want to use Email MFA.  [Note: Email MFA relies on the staff person's settings having a valid email address.]

Check the box next to '''Enable Text MFA''' to offer a text message as an MFA option to users.  Text MFA uses a Twilio account set up and sustained by your organization to send these text messages.  Uncheck this box if you do not want to use Text MFA.  [Note: Text MFA relies on the staff person's settings having a valid cell phone number in the '''Multi-Factor Authentication Phone Number''' box found in the staff person's preferences settings.]

Check the box next to '''Enable Phonecall MFA''' to offer a phone call as an MFA option to users.  Phone call MFA uses a Twilio account set up and sustained by your organization to make these phone calls.  Uncheck this box if you do not want to use Phone call MFA.  [Note: Phone call MFA relies on the staff person's settings having a valid phone number in the '''Multi-Factor Authentication Phone Number''' box found in the staff person's preferences settings.]

=Login With MFA=

==Step 1 - ConvergeOne Login==
The first step in logging in is to verify that you are a authorized user with ConvergeOne.  Input your ConvergeOne user name.  This is typically in the format of <firstname>.<lastname>, but may vary if another user has the same first and last name.

==Step 2 - Staff Number, Password, Email Address(?)==
Step 2 will vary, depending on the setup in the system.  If the system is set to require the email address be entered, all three items are shown:

[[File:Screen Shot 2022-03-07 at 2.47.36 PM.png|200px]]

If the system is set not to require the email address, only staff number and password are shown:

[[File:Screen Shot 2022-03-07 at 2.48.32 PM.png|200px]]

Enter the required pieces of information and press '''Log In'''

==Step 3 - Choose your MFA Method==
If MFA is not required (i.e., email, text, and phone call MFA are not checked), this step is avoided, as is the MFA Authentication in Step 4.

If only one type of MFA is allowed (e.g., only email is checked), then it is automatically chosen and the user moves directly to Step 4.

If more than one type of MFA is allowed, the user may choose the method of MFA Authentication.  For each type, the system shows a partial snapshot of where the authentication message will be sent:

[[File:Screen Shot 2022-03-07 at 2.51.43 PM.png|200px]]

Choose your desired method by clicking on the circle next to it, and press '''Send Authentication Code / Proceed'''.

==Step 4 - Enter Authentication Code==
Enter the code sent by email, text, or phone call.  When entered, press '''Enter Code'''.  If you need to resend the code, press the '''Resend Code''' button. This will take you back to Step 3.  You may be able to select a different method there if necessary.

=Twilio Setup=
Setup of the Twilio setup mirrors that in the Texting Using Prime 16 page.  In fact, many organizations may use the same number with Twilio to send MFA messages to staff.  If that is the case, you can simply copy and paste information from the other setup page to this one.