Requiring Two-Factor Authentication

While the Mandatory two-factor authentication for privileged roles flag is on, the permissions of administrator and editor roles work only on accounts that have two-factor authentication turned on. The flag is off by default.

Roles the rule covers

• System administrator
• Editor-in-chief and Section editor
• Catalogue editor and Content editor
• Production coordinator
• Publishing board

The Registered researcher, Reviewer, Unit manager and Auditor roles are outside the rule.

Accounts without two-factor setup

The person can sign in to the panel, but the permissions of their covered roles do not work. They can keep working with their roles that are outside the rule. The Two-factor authentication required. warning appears at the top of the panel. The Turn it on button in the warning opens the My profile → Security tab. Once the setup is finished, the permissions of the roles come back at once. The steps of the setup are in Using Two-Factor Authentication.

Turning the flag on

1. Set up two-factor authentication for your own account on the My profile → Security tab.
2. Tell the users in these roles in advance that they need to do the setup.
3. On the Administration → Site settings screen, open the Features tab.
4. Turn on the Mandatory two-factor authentication for privileged roles flag.
5. In the window that opens, press Confirm.

The flag takes effect at once, and the change is written to the audit log.

If you turn the flag on without doing your own setup, your administration permissions stop too. In that case, set up your own two-factor authentication first. Once the setup is finished, your permissions come back.

If a user loses their authenticator app, you reset their two-factor authentication. Until the person does the setup again, they cannot do the work of their covered roles. The steps are in Resetting Two-Factor Authentication.