Skip to main content

Multi-factor authentication

Preamble​

You can enable two-factor authentication for form-based logins, i.e. login / password.

When this option is enabled, users must configure and then use an application such as Microsoft Authenticator to generate an access code after logging in with their login and password.

Two modes are available:

  • enable MFA for all accounts in the application;
  • enable MFA only for users with a defined role.
info

The Lagoon server code checks MFA for identities whose AuthenticationMode is Forms. SSO providers must handle their own MFA on the identity provider side.

Enable MFA for the entire application​

In the server project, enable MultiFactorAuthenticationRequired in the authentication configuration.

Server\Main.cs
protected override void OnConfigureAuthentification(AuthenticationOptions options)
{
    // Active l'authentification formulaire et impose le MFA à tous les comptes.
    options.AllowFormAuthentication = true;
    options.MultiFactorAuthenticationRequired = true;
}

Enable MFA for specific accounts​

To limit MFA to specific accounts, configure MultiFactorAuthenticationRoleName. All users with this role will need to configure and use MFA.

Server\Main.cs
protected override void OnConfigureAuthentification(AuthenticationOptions options)
{
    // Les utilisateurs qui possèdent ce rôle doivent utiliser le MFA.
    options.AllowFormAuthentication = true;
    options.MultiFactorAuthenticationRoleName = AppRole.MandatoryMfa;
}

All users who have the defined role, here AppRole.MandatoryMfa, will need to configure MFA and then sign in using it.

Application support​

If you enable this option, provide an administration screen to reset a user's MFA, for example when they have lost their authentication application or can no longer generate a code.

The reset is done server-side with UserManager.

Server
// Désactive le MFA pour forcer une nouvelle configuration à la prochaine connexion.
await _userManager.SetTwoFactorEnabledAsync(user, false);
Note

The next time the user signs in, the application will ask them to set up their MFA again.

User journey​

  1. The user signs in with their login and password.
  2. If MFA is required and not yet configured, the application prompts for authentication app setup.
  3. If MFA is configured, the application asks for the code generated by the authentication app.