The Authentication panel of Organisation Settings allows you to turn two step verification on, sometimes also known as 2FA or MFA. Two step verification will add an extra layer of security to user accounts by asking users to verify their identity with a verification code in addition to their username and password. The code comes from their authenticator app or sent is sent by email.
When two step verification is on, all users in an organisation will see a prompt after username & password logon to pick how they want to receive the verification code:
Use authenticator app
Send code by email
Use authenticator app
An authenticator app is a phone application that connects with software (in this case Willow360) and produces a 6-digit verification code every 30 seconds. Examples are Microsoft Authenticator and Google Authenticator.
If a user picks an authenticator app, the first step will be to connect to the app. This is done by using the authenticator app to scan the QR code shown by Willow360. Once scanned, the app creates a Willow360 account and produces a verification code every 30 seconds. The first time the user enters the code, they will successfully log in, the credentials to connect will be stored in Willow and the authenticator app will be setup for their Willow360 account.
When the authenticator app is setup, a user will directly go to the screen to enter a numeric code. They open their authenticator app to find the code and type it in.
They can disconnect their authenticator app from their Willow360 account by going to their Personal Settings and removing their authentication app credentials. Please note that the Willow360 account will still exist in the authenticator app even after the credentials are cleared from Willow and has to be removed manually from the app.
If the code is wrongly entered 10 times, a 15 minute time out is applied to Authenticator screens and Email Code screen as well
Send code by email
Willow will email the code to the user as soon as the Enter Email Code page is opened
The code is valid for 15 minutes
If the code is wrongly entered 10 times, a 15 minute time out is applied to Email Code screen and Authenticator screens as well
A code can be resent using the Resend verification code link
The code can't be resent again within a minute
The user types or pastes the link to the fields and if it's valid, they are logged in
Please note that if an authenticator app is connected, it will always be the first choice after the user enters their email & password credentials. In this situation it is possible to receive a code by email by clicking the link Send a verification code to your email address instead.
The 6-digit input (as known as the One-Time-Password or the OTP input) will submit a code whenever all digits are filled
Non-digit characters are ignored
You can also paste the code to the first input field. If the code is in an invalid format (e.g. letters), it gets ignored.
The input is cleared after any error happened during verifying code
This is the visual flow of the Two step verification:
When Two step verification is turned on, all users need to re-enter their credentials. They will be allowed to continue with their current session, but when they sign out or close their browser window, they will be asked to provide the credentials (+code) on their next visit.
Admins can force their users to re-enter their credentials by clicking the Force all users to re-enter their credentials link. The system will behave exactly as in the aforementioned scenario when Two step verification is switched on.
The rules for when the user gets asked to sign in stay the same as if the Two step verification was off:
If the user clicks Stay signed in, for a period of time (currently 15 days), they will not be asked for their credentials (unless they sign out)
If the user doesn't click Stay signed in, they are asked to sign in with every new session
