Two-Factor Authentication
Registry supports two-factor authentication for users and institutions who want an extra layer of security. Two Factor Authentication is required for institutional administrators in both the production repository and the demo repository, since institutional admins have the ability to delete materials. It is not required for institutional users, however we recommend that all users enable it.
Tip
Two-factor settings are separate on the production and demo repositories. Enabling or disabling this feature in the Registry production system has no effect on the demo system and vice-versa. You'll have to set your preferences separately on each system.
Enabling Two-Factor Authentication
Institutional users can enable two-factor authentication for themselves. Institutional administrators can require it for all users at their institution, thereby forcing them to enable it. Institutional users who enable two-factor auth for themselves can choose to disable it later. When an administrator enables two-factor auth for their institution, users cannot opt out or disable the setting.
Enabling Two-Factor for Yourself
To enable two-factor authentication for yourself, click the My Account in the upper right corner of the screen.
Click the Set Up Two-Factor Auth button. Then enter your mobile phone number and choose either Authenticator App, Authy or Text Message.
Notice
The Authenticator App method is currently available only on demo.aptrust.org. We hope to make this option available on repo.aptrust.org shortly.
Click Submit when you're done.
Using an Authenticator App will require you to enroll a compatible device, most commonly your phone, in 2FA by scanning a QR code (or entering a setup key) on your authenticator app of choice. Some common authenticator apps include Google Authenticator, Microsoft Authenticator, and the Duo Mobile app. Authy allows you to complete two-factor authentication via push notification, while Text sends a text (SMS) message to your phone with a one-time authentication token.
Here are some examples of authenticator apps that you can use including documentation of setup, though there are others available.
You should receive a text message or push notification within a minute or so. If you chose the authenticator app or text/SMS option, enter the code you received in the text message into the verification field in Registry. If you chose the authenticator app method, you will need to view your code in your app. This code will appear under the default name "APTrust" (if on the demo environment, it will say "APTrust/demo" instead).
Tip
If you are having trouble verifying with your authenticator app, try ensuring that the device where your authenticator app is running, such as your phone, is synced with the current time. This method of authentication relies on the second factor device being able to know the exact current time. Time zone, however, is not relevant. If you are unsure if your device is synced to the current time, try accessing your device's Date & Time Settings and select Set Automatically if not already chosen. This is the default setting for most devices that are connected to a network. If your device is not connected to a network, or does not connect to a network, you will have to set the device time to the current time manually. Otherwise, your authenticator app may not function correctly.
If you have Authy installed on your phone and you chose to verify via push notification, click the Approve button when the Authy verification request appears.
Generating Backup Codes
If you're using two-factor authentication, you should generate a set of backup codes, in case you need to log in to the Registry when you don't have access to your phone.
To generate backup codes, click the Generate Backup Codes button at the top of the My Account page. Copy your backup codes to a safe place on your computer. These codes are valid for one-time use.
Enabling Two-Factor for Other Users or Your Entire Institution
Institutional administrators can require two-factor authentication for specific users at their institution, or for the institution as a whole.
To enable two-factor auth for a specific user:
-
Click Users on the left nav bar.
-
Click the name of the user you want to edit.
-
Change Require Two-Factor Auth to Yes.
-
Click Submit.
To require two-factor auth for your institution:
-
Click More Options in the left navigation bar.
-
Click Institution.
-
Click Edit.
-
Change Enable two-factor authentication? to Yes.
-
Click Submit.
Grace Period for New Users
New users have a grace period during which they will be prompted to enabled two-factor authentication. On the production repository, this grace period is 30 days long. On the demo repository, this grace period is 90 days long. The grace period begins when the user's account is created. It applies to all users for whom two-factor auth is required (institutional administrators and institutional users for whom two-factor auth has been required at their institution).
If You're Locked Out
If you can't log in and you don't have access to any valid backup codes, contact help@aptrust.org.