Configure Multi-Factor Authentication

The Multi-Factor Authentication (MFA) feature reinforces security when logging in to the ARTESCA UI.

This feature is available both for local users and for users authenticated by an external Identity Provider (IdP).

• For local users, the MFA feature can be enabled during the user creation or at any time from the user’s details page on the ARTESCA UI.

• For users authenticated by an external IdP, the MFA feature can be enabled on the user’s details page on the ARTESCA UI.

Note

MFA is recommended and can be enforced by the Platform Admin for all users, from the Global Settings menu. In this case, the MFA feature cannot be disabled or edited at the user’s level.

The system supports Time-based One Time Password (TOTP) multi-factor authentication. Two types of MFA methods are available:

• Software-based: mobile applications (such as Google Authenticator, Microsoft Authenticator, or FreeOTP) or compatible password managers.

• Hardware-based: physical security keys like YubiKey.

To configure the MFA, follow these steps:

1. Enable the MFA option for the user.

2. Register the TOTP device:

   • For mobile or software-based solutions, follow Configure the Software-based Mobile Authenticator Setup.

   • For YubiKey hardware-based solutions, follow Configure the Hardware-based YubiKey Device.

Enable the MFA Option for a User

This procedure allows you to enable the MFA option for a user.

For a local user

For a local user, you can enable the MFA option:

• during the user creation.

• by clicking the Multi-Factor Authentication tab on the user’s details page, then checking the Enable MFA checkbox and clicking Save MFA Configuration.

For a user authenticated by an external IdP

For a user authenticated by an external IdP:

1. From the ARTESCA UI, in the Identity menu, click Users.

2. Click the Multi-Factor Authentication tab on the user’s details page.

3. Check the Enable MFA checkbox and click Save MFA Configuration.

The MFA feature is configured on the next user’s login where you will be prompted to configure your MFA method.

Register the TOTP Device

This section provides the procedures to configure the available MFA methods.

Tip

From the Multi-Factor Authentication tab, you can disable the MFA feature (if not enforced by the Platform Admin), and manage registered devices.

Configure the Software-based Mobile Authenticator Setup

After logging in, the Mobile Authenticator Setup dialog box displays.

1. Follow the Mobile Authenticator Setup procedure.

   1. Install a standard TOTP application on your mobile device. Your options include, but are not limited to: Google Authenticator, Microsoft Authenticator, and FreeOTP.

   2. Open the application and scan the barcode.

   3. Enter the One-time code provided by the application.

      (Optional) Provide a Device Name to help you manage your OTP devices.

   4. Click Submit.

      

2. Your mobile authenticator setup is registered and you are automatically logged out from the ARTESCA UI. Log in using the credentials (username/e-mail and password) and update the password.

   

3. For next logins, after entering the credentials, you must enter the one-time code sent to the device previously registered.

   

Configure the Hardware-based YubiKey Device

Important

Prior to following the procedure, ensure that you have a YubiKey device and the Yubico Authenticator application installed on your computer.

After logging in, the Mobile Authenticator Setup dialog box displays.

1. Click Unable to scan?.

   

   It provides you with a secret key that you will use to configure your YubiKey device. Copy the secret key to your clipboard.

2. Insert your YubiKey device into your computer.

   

3. In the Yubico Authenticator application, on the left-side menu, click Accounts.

   

4. On the right-side, under Setup, click Add account. The Add account dialog box displays.

   

5. Fill in the fields:

   

   • For the Account name, enter a name to help you manage your YubiKey devices.

   • For the Secret key, paste the secret key copied to your clipboard.

6. Click Save.

7. On the ARTESCA UI, in the Mobile Authenticator Setup dialog box, enter the One-time code provided by the application.

   (Optional) Provide a Device Name to help you manage your OTP devices.

8. Click Submit.

   

9. The YubiKey device method is registered and you are automatically logged out from the ARTESCA UI. Log in using the credentials (username/e-mail and password) and update the password.

   

10. For next logins, after entering the credentials, you must enter the one-time code sent to the previously registered device.