2 Factor Authentication Setup

Overview

Two-factor authentication (2FA) is an extra layer of identity checking you can use to strengthen access security. You can configure this anytime.

In the Roles / Details tab you can make 2FA optional or mandatory for some or all roles. For each role, you can also choose which authentication methods can be used.

It can be used on any role except, for the following; 'web_services', 'password_reset' and 'fbt_declaration'.

Note that for 'drivers', 2FA will work in both the Catch-e system and the Driver Portal.

If needed driver's and employee's 2FA can be unenrolled from Drivers / Contact or Employees / Contact.

You can also choose to leave 2 Factor Authentication off completely for your business, so no role or user sees these settings.

Set-up Steps

Global Controls

Set [gb_controls]2factor_auth_enabled_flag to 'yes' if you want to use 2FA. It is set to 'yes' by default.

  • When this is set to 'yes', the Roles / Details 2 Factor Authentication section and the Users / 2 Factor Authentication tab are displayed, otherwise they are hidden.

  • When enabled, Catch-e's own staff are always configured to use 2FA.

Set [gb_controls]2factor_auth_app_token_name set the Token Name (Account Label). This text identifies the app for which this token is used. If this control is blank, the default token name will be [client name]: Operating Lease & Fleet Management. If this control is populated it will be used as Token Name (Account Label).

Note if you are using Authy (from Twilio). Authy looks up a logo based on the text that appears before colon ( : ) in the text. For example, if you enter ABC Fleet: Operating Lease & Fleet Management it will use ‘ABC Fleet’ to look up a logo. If the logo it looks up is not what you expect then you can change it to use the generic logo. Unfortunately Catch-e cannot force Authy to look up the logo you want.

Set [gb_controls]2factor_auth_revalidation_days for the number of days a user may login without performing a 2-factor authentication.

  • The system will not prompt for an access code for the defined number of days if the user is logging into the same browser, ip address, user login and method when they opted to 'Remember' the access code.

  • Each time a user logs in and one of these variables has changed, a 2FA code will be required (but each scenario can be remembered).

  • E.g. using a different combination of browser, network, computer, user login and enrolment method ('Sms' or 'Auth App') triggers the demand for a 2FA code.

Note: 'Remember' will not work if you are on a Wi-Fi network with changing ip addresses.

Set a [gb_controls]sms_provider as 'smsglobal' to enable the 'Sms' enrolment method. If not set, 'Auth App' will be the default and 'Sms' will not be available.

Populate [gb_controls]smsglobal_sms_provider_details with the Api Key and Api Secret generated from your SMS Global account

Role

Select the Roles / Details "Mandatory" checkbox for each role where 2FA is required. It is optional if this is unchecked.

Choose a "Method" that users can use. These are discussed in detail below;

Auth App

If using the 'Auth App' method, select and recommend an RFC 6238 compliant 2 factor authentication application such as Google Authenticator, Microsoft Authenticator or Authy to your staff.

Where ‘Auth App' is the selected method, the user will be prompted to enter an authentication code generated by the phone App. The Token Name (Account Label) in the app can be set using [gb_controls]2factor_auth_app_token_name.

SMS

If 'Sms' is used an account with SMS Global will need to be set up.

The required access code will be sent via SMS to the users mobile number. The access code will be valid for 5 minutes from the time it was requested.

A mobile number can only be used for one user record.

Users

If 2FA is mandatory, all unenrolled users will be redirected to the Users / 2 Factor Authentication screen when they next login to complete the enrolment process.

If optional, users can navigate to the Users / 2 Factor Authentication screen and enrol if they want.

Enrolment Management

Users with the 'admin' role can navigate into the Users / 2 Factor Authentication tab of any user and enrol or unenroll on their behalf.

I.e. go through the enrolment process steps to activate their 2FA.

Locked out

If the entered app or sms code is valid, the user will have access into the Catch-e system. If it is invalid, three attempts will be allowed before the user is locked out of the system.

When a user is locked out, their Users / Details "Status" is 'locked'. An 'admin' role user can edit and change the status back to 'active'.