Skip to content

Two-factor authentication

Profinity supports two-factor authentication (2FA) for local users when the site Sign-in method is Local. The sign-in screens and related pages also call it multi-factor authentication (MFA). A user proves a second factor with a six-digit time-based one-time password (TOTP) generated by an authenticator app, in addition to the password. The policy is site-wide. You set it on the Security tab of System Configuration, which needs the System administration permission. Users who sign in through single sign-on (SSO) rely on their identity provider for multi-factor authentication, as described in SSO and sign-in method.

Licence required

Two-factor authentication requires the Two-Factor Authentication licensed feature, included in the Server and Enterprise editions. Without it Enforce two-factor for local users is switched off when Profinity starts and cannot be kept on. Refer to Licensing for what each edition includes.

Two-factor policy settings

Switching on Enforce two-factor for local users requires every local user to enrol an authenticator before signing in. It also makes the Two-Factor Policy group appear. The group holds the settings in the following table.

Setting Default Range Description
Enforce two-factor for local users Off On or off Every local user must enrol a TOTP authenticator.
Require recovery codes during enrollment On On or off Users must confirm that they have saved their recovery codes before setup completes.
Allow remember this device Off On or off Shows Remember this device on the sign-in step, so that a user can skip the second factor on that browser until the duration ends.
Remember device duration (days) 10 1 to 90 How long a trusted browser skips the second factor. The setting appears only when Allow remember this device is on.

Saving the tab restarts Profinity and interrupts active sessions.

Security-key sign-in

Licence required

Security-key sign-in requires the Enterprise Security licensed feature, included in the Enterprise edition only. Without it Allow security-key sign-in is switched off when Profinity starts.

Switching on Allow security-key sign-in lets local users register a security key and use it instead of a password. It is available when Sign-in method is Local. A security key is a hardware device that follows the FIDO2 standard, and browsers talk to it through the Web Authentication (WebAuthn) standard. The setting is off by default and does not require keys for all users. Users who do not register a key keep signing in with their password.

Security keys need Enforce two-factor for local users switched on. Users register a key and sign in with it as described in Sign in with two-factor authentication.

Refer to Password policy for the password rules that apply to local users.