Two-factor authentication
Profinity supports two-factor authentication (2FA), also called multi-factor authentication (MFA) in the sign-in screens and on related pages, for local users when the site Sign-in method is Local. A user proves a second factor with a six-digit time-based one-time password (TOTP) generated by an authenticator app, in addition to the password. The policy is site-wide and is set on the Security tab of System Configuration, which requires the System administration permission. Users who sign in through single sign-on rely on their identity provider for multi-factor authentication, as described in SSO and sign-in method.
Licence required
Two-factor authentication requires the Two-Factor Authentication licensed feature, included in the Server and Enterprise editions. Without it Enforce two-factor for local users is switched off when Profinity starts and cannot be kept on. Refer to Licensing for what each edition includes.
Two-factor policy settings
Switching on Enforce two-factor for local users requires every local user to enrol an authenticator before signing in, and it makes the Two-Factor Policy group appear beneath it. The group holds these settings:
| Setting | Default | Range | Description |
|---|---|---|---|
| Enforce two-factor for local users | Off | On or off | Every local user must enrol a TOTP authenticator. |
| Require recovery codes during enrollment | On | On or off | Users must confirm that they have saved their recovery codes before setup completes. |
| Allow remember this device | Off | On or off | Shows Remember this device on the sign-in step, so that a user can skip the second factor on that browser until the duration ends. |
| Remember device duration (days) | 10 | 1 to 90 | How long a trusted browser skips the second factor. The setting appears only when Allow remember this device is on. |
Saving the tab restarts Profinity and interrupts active sessions.
Enrolment and sign-in
When two-factor authentication is required and a user has no authenticator, Profinity opens the two-factor setup screen after the user enters a valid password. The user scans the QR code with an authenticator app, verifies a one-time code to prove the app is working, and then saves the recovery codes and confirms they are stored when the policy requires it.
On later sign-ins, Profinity asks for the authenticator code after the password is accepted, with a 6-Digit MFA Code field and an alternative Recovery Code field. A user who selects Remember this device on a site that allows it skips this step on that browser until the remember duration ends. Repeated incorrect codes are rate limited, so a user who keeps entering wrong codes must wait before trying again, and a locked-out user waits for the Login lockout duration (minutes) described under Session policy and login lockout.
If a code is rejected although it was typed correctly, the usual cause is the clock on the phone, because authenticator codes depend on the device time being correct. If the phone is lost and the recovery codes are not available, an administrator resets the user's authenticator from the User Actions tab, as described in MFA Account Management, and the user enrols again at the next sign-in. While Enforce two-factor for local users is on, a signed-in local user manages their own authenticator from the Two-Factor Authentication pill on the ADMIN page, as described in MFA Account Management.
Security-key sign-in
Licence required
Security-key sign-in requires the Enterprise Security licensed feature, included in the Enterprise edition only. Without it Allow security-key sign-in is switched off when Profinity starts.
Switching on Allow security-key sign-in, which is available when Sign-in method is Local, lets local users register a FIDO2 security key and use it instead of a password. The setting is off by default, and it does not require keys for all users, so users who do not register a key keep signing in with their password.
A user registers a key from the Two-Factor Authentication pill on the ADMIN page, by selecting Begin security key registration in the SECURITY KEYS (WEBAUTHN) panel and following the browser prompt, after which Profinity shows "Security key registered successfully." Registration needs a browser that supports WebAuthn and a page served over HTTPS or from localhost. When a site allows security keys and the browser supports them, the login page shows a Sign in with security key button beneath the password form. If registration is cancelled or times out, Profinity shows "Security key registration was cancelled or timed out." and the user can select Begin security key registration again.
Because the SECURITY KEYS (WEBAUTHN) panel is part of the Two-Factor Authentication dialog, which is shown only while Enforce two-factor for local users is on, a site that wants security keys also enforces two-factor authentication.
Related pages
Refer to Password policy for the password rules that apply to local users.