Configuring Two-Factor Authentication

Two-factor authentication (2FA) provides extra security to OpenKM logins. In addition to the typical login and password, once the user is authenticated, they will be asked for an extra six-digit code generated by a mobile application called Google Authenticator.

Compliance

The two-factor authentication implements a two-step verification of HOTP/TOTP. Also known as one-time passwords.

It has been tested with:

• The Google Authenticator
• The Microsoft Authenticator

Should work with other applications like:

• OTP Auth (iOS)
• Step Two (iOS)
• FreeOTP
• Twilio Authy
• Duo Mobile de Cisco

Prerequisite

Because two-factor authentication has been implemented using Google Authenticator, it is necessary to download and install the application from Google Play or the Apple App Store.

Once installed and configured, this application does not even need an Internet connection.

OpenKM configuration

Each user can configure their own account to use 2FA. To do so: Go to KCenter, at top right > Settings > Settings tab > Two-factor authentication.

If 2FA is enabled by the administrator, at the bottom of the User Configuration dialog you will see a new option 2FA. Depending on whether 2FA is enabled, you will see:

• Disable button: if 2FA has already been configured for this user.
• Enable button: if 2FA has not been configured yet.

If you click the Enable button, a new window with the following parameters will appear:

• The current user ID to be configured.
• A QR code that you should scan with the Google Authenticator application.
• A text box where you must enter the verification code generated by Google Authenticator (after the QR code has been scanned).

Once you have completed these steps, please click the Accept button.

Scan QR code

To scan the QR code, open Google Authenticator on your mobile and perform the following steps:

1. Click on Configure account.
2. Select Scan code.
3. Point your mobile device at the QR image on the screen.
4. Once the image is properly scanned, the account for OpenKM is added.
5. Now you will see a square with a number (code) which you will have to enter when required.

Google Authenticator use

Once 2FA is configured on your OpenKM account, the next time you log in to OpenKM, after your username and password are verified, a new screen will appear requiring you to enter a code obtained from the Google Authenticator application you previously configured.