Configuring Two Factor Authentication

Two-factor authentication (2FA) provides extra security for the OpenKM login. In addition to the typical login and password, once the user is authenticated, they will be asked for an extra six-digit code generated in a mobile application called Google Authenticator.

Compliance

The two-factor authentication implements a two-step verification of HOTP/TOTP. Also known as one-time password.

It has been tested with:

• The Google Authenticator
• The Microsoft Authenticator app

It should work with other applications, such as:

• OTP Auth (iOS)
• Step Two (iOS)
• FreeOTP
• Twilio Authy
• Duo Mobile by Cisco

Prerequisite

Because two-factor authentication has been implemented using Google Authenticator, it is necessary to download and install the application from Google Play or the Apple App Store.

Once installed and configured, this application does not even need an Internet connection.

OpenKM configuration

Each user can configure their own account to use 2FA. To do so, they have to go to Tools > Preferences > User Configuration.

If 2FA has been enabled by the administrator, at the bottom of the User Configuration dialog you will be able to see a new option 2FA. Depending on whether 2FA is enabled, you will see:

• Disable button: if 2FA was already configured for this user.
• Enable button: if 2FA has not been configured yet.

If you click the Enable button, a new window with the following parameters will appear:

• The current user ID to be configured.
• A QR code which you should scan with the Google Authenticator application.
• A text box where you have to enter the verification code generated by Google Authenticator (once the QR code has been scanned).

Once you have completed these steps, please click the Accept button.

Scan QR code

To scan the QR code, open Google Authenticator on your mobile and perform the following steps:

1. Click on Configure account.
2. Select Scan code.
3. Focus your mobile toward the QR image on the screen.
4. Once the image is properly scanned, the account for OpenKM is added.
5. Now you will see a square with a number (code) which you will have to enter when required.

Google Authenticator use

Once 2FA is configured on your OpenKM account, the next time you log into OpenKM, after your login and password are verified, a new screen will appear where you will be required to enter a code that must be obtained from the Google Authenticator application you previously configured.