Supported starting with ManualWorks 6.0.6.
Two-Factor Authentication by Email
ManualWorks supports two-factor authentication by email, so you must configure the mail server to use it.
Setting Up Two-Factor Authentication
Configuring the Mail Server
Configure the mail server and send a test mail.
If mail delivery stops working after you set up two-factor authentication, users cannot log in. In that case, remove the two-factor authentication setting from the startup script options.
Setting the Startup Script Option
Add the following startup script option. For how to set startup script options, see this guide.
3rabbitz.2fa_authenticator=mail
How Two-Factor Authentication Works
First, the user logs in with a password.
When two-factor authentication is on, <Stay logged in> no longer works.
ManualWorks sends a 6-digit verification code to the user's email. The user enters the code to complete the second step.
Click the <1Resend Code> link to get a new code. If less than 30 seconds have passed since the previous code was sent, the same code is sent again.
Notes
Setting the Code Validity Period
A verification code is valid for 120 seconds. To change the validity period, enter the following command in the Console.
set-preference -name TFA_VALIDITY_PERIOD -value 60
The value is in seconds. If you enter 0, the code does not expire.
Limiting Verification Attempts
As with passwords, you can limit the number of verification code attempts.
The ENABLE_PASSWORD_FAIL_LOCK option applies to both password and verification code checks. Passing the password check resets the failure count, but requesting a new code does not.
Regardless of the account lock setting, a verification code can no longer be used after five wrong attempts. In that case, get a new code with the <Resend Code> link.
No Exceptions for Specific Users
When two-factor authentication is on, all users must log in with two-factor authentication. You cannot exclude specific users.
With LDAP
Two-factor authentication also applies when LDAP is configured.
With OAuth
Two-factor authentication does not apply to users who log in with OAuth 2.0 or users who log in through JSP. It does apply to users who log in on the login page.