Multi-factor authentication: Difference between revisions

From MoodleDocs
Main page ► Managing a Moodle site ► Authentication ► Multi-factor authentication
Authentication
(Added a new section with Recommendations and example setup)
Line 1: Line 1:
{{Authentication}}
{{Authentication}}
==What is multi-factor authentication (MFA)?==
==What is multi-factor authentication (MFA)?==
[https://en.wikipedia.org/wiki/Multi-factor_authentication Multi-factor authentication (MFA)] is an authentication method that requires the user to provide two or more verification factors to gain access to an online account such as Moodle site. MFA helps improve security of your site.
[https://en.wikipedia.org/wiki/Multi-factor_authentication Multi-factor authentication (MFA)] is an authentication method that requires the user to provide two or more verification factors to gain access to an online account such as Moodle site. MFA helps improve security of your site.
==Manage multi-factor authentication==
==Manage multi-factor authentication==
From ''Site administration > Plugins > Admin tools > Manage multi-factor authentication'' you can select the 'factors' which must satisfy in order to login. These factors must add up to 100. By configuring multiple factors and weighting them you can easily have quite complex and flexible rules.
From ''Site administration > Plugins > Admin tools > Manage multi-factor authentication'' you can select the 'factors' which must satisfy in order to login. These factors must add up to 100. By configuring multiple factors and weighting them you can easily have quite complex and flexible rules.
Line 9: Line 7:
'''Non administrator:''' This factor enables you to give points for free to a user who is not an admin. This makes it easy to require admin users to have 2 or more factors while not affecting normal users.
'''Non administrator:''' This factor enables you to give points for free to a user who is not an admin. This makes it easy to require admin users to have 2 or more factors while not affecting normal users.


'''Authentication type:''' Here you can specify that users with certain auth types, eg [https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language SAML] via [https://en.wikipedia.org/wiki/Active_Directory_Federation_Services ADFS] already have 100 points, making them exempt from additional checks.
'''Authentication type:''' Here you can specify that users with certain auth types, eg [https://en.wikipedia.org/wiki/Security_Assertion_Markup_Language SAML] via [https://en.wikipedia.org/wiki/Active_Directory_Federation_Services ADFS] already have 100 points, making them exempt from additional checks.


'''User capability:''' This factor checks whether a user has a capability, in the system context. If the user has this capability, they will not gain the points for this factor, and must instead use other factors to authenticate with the system. This is similar to the non-admin factor, however it operates on a role basis. In practice, the capability 'factor/capability:cannotpassfactor' should be given to roles who must use other factors to authenticate to the system. There is an additional setting for this factor that will allow admins to gain points for this factor, as by default they will always gain no points for this factor.
'''User capability:''' This factor checks whether a user has a capability, in the system context. If the user has this capability, they will not gain the points for this factor, and must instead use other factors to authenticate with the system. This is similar to the non-admin factor, however it operates on a role basis. In practice, the capability 'factor/capability:cannotpassfactor' should be given to roles who must use other factors to authenticate to the system. There is an additional setting for this factor that will allow admins to gain points for this factor, as by default they will always gain no points for this factor.
Line 17: Line 15:
'''Email:''' A simple factor which sends a short lived code to your email which you then need to enter to login. Generally speaking this is a low security factor because typically the same username and password which logs you into moodle is the same which logs you into your email so it doesn't add much value.
'''Email:''' A simple factor which sends a short lived code to your email which you then need to enter to login. Generally speaking this is a low security factor because typically the same username and password which logs you into moodle is the same which logs you into your email so it doesn't add much value.


'''Grace period:''' This allows users to log in without interacting with MFA for a set period of time. Users can only achieve the points for this factor if there are no other input factors for them to interact with during the login process. This factor should be placed last in the list, that way all other factors are interacted with during the login process first. On the first page after login, if a user is currently within their grace period, regardless of whether they used gracemode as a login factor, they are presented a notification informing them of the grace period length, and that they may need to setup other factors or risk being locked out once the grace period expires.
'''Grace period:''' This allows users to log in without interacting with MFA for a set period of time. Users can only achieve the points for this factor if there are no other input factors for them to interact with during the login process. This factor should be placed last in the list, that way all other factors are interacted with during the login process first. On the first page after login, if a user is currently within their grace period, regardless of whether they used gracemode as a login factor, they are presented a notification informing them of the grace period length, and that they may need to setup other factors or risk being locked out once the grace period expires.


'''IP range:''' Use this factor if you are on a secure network.This is very useful because it requires no setup by the end user, so you can set it up so that you can log in fully via a secure network, and once logged in they can setup other factors like [https://en.wikipedia.org/wiki/Time-based_one-time_password TOTP], and then use those other factors for logging in when not on a secure network.
'''IP range:''' Use this factor if you are on a secure network.This is very useful because it requires no setup by the end user, so you can set it up so that you can log in fully via a secure network, and once logged in they can setup other factors like [https://en.wikipedia.org/wiki/Time-based_one-time_password TOTP], and then use those other factors for logging in when not on a secure network.
Line 30: Line 28:


'''Security key:'''
'''Security key:'''
== Recommendations and example setups ==
When setting up MFA for your site, it’s important to ensure that you’re making your site more secure, but also creating a good experience for your users, including making sure that they are able to log in if they follow the right steps. Here are some recommendations to ensure that MFA is streamlined for your users:
# Make sure you turn on the '''Grace period''' factor when you turn on an authentication factor that requires users to configure something themselves ('''Authenticator app''' or '''Security key'''). This will give your users time to set up MFA before they are required to use it.
# If you don’t want to make MFA mandatory, enable '''No other factors'''. This will allow users with no other factors to log in using only their password.
# '''IP range''' factor is a very straightforward authentication method if all your users are using the same network. Once users are logged in using this factor, you can allow them to set up additional factors, such as an authenticator app, and then use those other factors to log in when not on your secure network.
=== Example setups ===
These are some examples of common MFA setups to increase the security of your Moodle site.
'''a) Email verification'''
# Enable MFA.
# Turn on factor '''Email''' and give it 100 points.
# You can turn on '''Trust your device''' to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.
# Let your users know that email verification is now enabled. Next time your users try to log in, they will see a message that asks them to check their email and enter a code that has been sent there.
'''b) Authenticator app'''
# Enable MFA.
# Turn on the factor '''Grace period''' and give it 100 points. This will allow your users a period of time to set up their authenticator apps and prevent them from being locked out of your site. Use the '''Grace period warning banner''' to let your users know that MFA will be enabled soon and encourages them to set up their authenticator app.
# Turn on the factor '''Authenticator app''' and give it 100 points.
# You can turn on '''Trust your device''' to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.
'''c) Email OR authenticator app'''
# Enable MFA.
# Turn on the factor '''Email''' and give it 100 points.
# Turn on the factor '''Grace period''' and give it 100 points. This will allow your users a period of time to set up their authenticator apps and prevent them from being locked out of your site. Use the '''Grace period warning banner''' to let your users know that MFA will be enabled soon and encourages them to set up their authenticator app.
# Turn on the factor '''Authenticator app''' and give it 100 points.
# You can turn on '''Trust your device''' to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.
'''d) Email AND authenticator app'''
# Enable MFA.
# Turn on the factor '''Email''' and give it 50 points.
# Turn on the factor '''Grace period''' and give it 100 points. This will allow your users a period of time to set up their authenticator apps and prevent them from being locked out of your site. Use the '''Grace period warning banner''' to let your users know that MFA will be enabled soon and encourages them to set up their authenticator app.
# Turn on the factor '''Authenticator app''' and give it 50 points. Users will have to pass both factors to get to 100 points and be able to log in.
# You can turn on Trust your device to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.


==Summary of good conditions for login==
==Summary of good conditions for login==
Line 37: Line 82:
*From this section you can add any relative URL from the siteroot for which the MFA check will not redirect from
*From this section you can add any relative URL from the siteroot for which the MFA check will not redirect from
*Links to any guidance pages or files may be uploaded here.
*Links to any guidance pages or files may be uploaded here.
===Admin locked out of site - how to resolve===
===Admin locked out of site - how to resolve===
Be careful as an administrator when configuring and testing the factors that you do not lock yourself out of the site. If you do then MFA can be disable from the command line by entering:
Be careful as an administrator when configuring and testing the factors that you do not lock yourself out of the site. If you do then MFA can be disable from the command line by entering:
<syntaxhighlight lang="php">
<syntaxhighlight lang="php">
: php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0</syntaxhighlight>
: php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0</syntaxhighlight>
 
[[https://docs.moodle.org/es/Autenticación de múltiples factores]]
[[es:Autenticación de múltiples factores]]

Revision as of 13:21, 29 November 2023

What is multi-factor authentication (MFA)?

Multi-factor authentication (MFA) is an authentication method that requires the user to provide two or more verification factors to gain access to an online account such as Moodle site. MFA helps improve security of your site.

Manage multi-factor authentication

From Site administration > Plugins > Admin tools > Manage multi-factor authentication you can select the 'factors' which must satisfy in order to login. These factors must add up to 100. By configuring multiple factors and weighting them you can easily have quite complex and flexible rules.

Non administrator: This factor enables you to give points for free to a user who is not an admin. This makes it easy to require admin users to have 2 or more factors while not affecting normal users.

Authentication type: Here you can specify that users with certain auth types, eg SAML via ADFS already have 100 points, making them exempt from additional checks.

User capability: This factor checks whether a user has a capability, in the system context. If the user has this capability, they will not gain the points for this factor, and must instead use other factors to authenticate with the system. This is similar to the non-admin factor, however it operates on a role basis. In practice, the capability 'factor/capability:cannotpassfactor' should be given to roles who must use other factors to authenticate to the system. There is an additional setting for this factor that will allow admins to gain points for this factor, as by default they will always gain no points for this factor.

Cohort: This factor requires the user to be in a particular cohort in order to log in.

Email: A simple factor which sends a short lived code to your email which you then need to enter to login. Generally speaking this is a low security factor because typically the same username and password which logs you into moodle is the same which logs you into your email so it doesn't add much value.

Grace period: This allows users to log in without interacting with MFA for a set period of time. Users can only achieve the points for this factor if there are no other input factors for them to interact with during the login process. This factor should be placed last in the list, that way all other factors are interacted with during the login process first. On the first page after login, if a user is currently within their grace period, regardless of whether they used gracemode as a login factor, they are presented a notification informing them of the grace period length, and that they may need to setup other factors or risk being locked out once the grace period expires.

IP range: Use this factor if you are on a secure network.This is very useful because it requires no setup by the end user, so you can set it up so that you can log in fully via a secure network, and once logged in they can setup other factors like TOTP, and then use those other factors for logging in when not on a secure network.

No other factors: This is designed to allow people to pass only if they have not setup other factors for MFA already.

Role:This factor checks whether a user has any chosen roles assigned in any context, and does not provide points if that is the case. This can be used to ensure the selected roles must use a higher level of authentication such as TOTP, while letting non-specified roles authenticate seamlessly. This factor should generally have high privilege roles such as manager and administrator selected to enforce higher account security for these groups. Trust this device:

Authenticator app: This factor sends a code to an authenticator app a user has already installed on their smartphone. Another term is TOTP - Time-based one-time password.

Security key:

Recommendations and example setups

When setting up MFA for your site, it’s important to ensure that you’re making your site more secure, but also creating a good experience for your users, including making sure that they are able to log in if they follow the right steps. Here are some recommendations to ensure that MFA is streamlined for your users:

  1. Make sure you turn on the Grace period factor when you turn on an authentication factor that requires users to configure something themselves (Authenticator app or Security key). This will give your users time to set up MFA before they are required to use it.
  2. If you don’t want to make MFA mandatory, enable No other factors. This will allow users with no other factors to log in using only their password.
  3. IP range factor is a very straightforward authentication method if all your users are using the same network. Once users are logged in using this factor, you can allow them to set up additional factors, such as an authenticator app, and then use those other factors to log in when not on your secure network.

Example setups

These are some examples of common MFA setups to increase the security of your Moodle site.

a) Email verification

  1. Enable MFA.
  2. Turn on factor Email and give it 100 points.
  3. You can turn on Trust your device to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.
  4. Let your users know that email verification is now enabled. Next time your users try to log in, they will see a message that asks them to check their email and enter a code that has been sent there.


b) Authenticator app

  1. Enable MFA.
  2. Turn on the factor Grace period and give it 100 points. This will allow your users a period of time to set up their authenticator apps and prevent them from being locked out of your site. Use the Grace period warning banner to let your users know that MFA will be enabled soon and encourages them to set up their authenticator app.
  3. Turn on the factor Authenticator app and give it 100 points.
  4. You can turn on Trust your device to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.


c) Email OR authenticator app

  1. Enable MFA.
  2. Turn on the factor Email and give it 100 points.
  3. Turn on the factor Grace period and give it 100 points. This will allow your users a period of time to set up their authenticator apps and prevent them from being locked out of your site. Use the Grace period warning banner to let your users know that MFA will be enabled soon and encourages them to set up their authenticator app.
  4. Turn on the factor Authenticator app and give it 100 points.
  5. You can turn on Trust your device to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.


d) Email AND authenticator app

  1. Enable MFA.
  2. Turn on the factor Email and give it 50 points.
  3. Turn on the factor Grace period and give it 100 points. This will allow your users a period of time to set up their authenticator apps and prevent them from being locked out of your site. Use the Grace period warning banner to let your users know that MFA will be enabled soon and encourages them to set up their authenticator app.
  4. Turn on the factor Authenticator app and give it 50 points. Users will have to pass both factors to get to 100 points and be able to log in.
  5. You can turn on Trust your device to allow your users to bypass MFA for a specified period of time after they have verified it with MFA for the first time.

Summary of good conditions for login

Here are listed the factors selected and their total weighting, adding up to 100.

General MFA settings

  • The MFA plugin enabled box should be checked for MFA to work.
  • From this section you can add any relative URL from the siteroot for which the MFA check will not redirect from
  • Links to any guidance pages or files may be uploaded here.

Admin locked out of site - how to resolve

Be careful as an administrator when configuring and testing the factors that you do not lock yourself out of the site. If you do then MFA can be disable from the command line by entering: 

: php admin/cli/cfg.php --component=tool_mfa --name=enabled --set=0

[de múltiples factores]

Retrieved from "https://docs.moodle.org/403/en/index.php?title=Multi-factor_authentication&oldid=147446"
Powered by MediaWiki