LimeSurvey Manual - User contributions [en]

TwoFactorAdminLogin

2023-05-04T15:49:04Z

Msouad: /* LimeSurvey CE */

<languages />
<translate>

__TOC__

=Introduction=

'''2-Factor-Authentication''' (2FA) is a way to add additional security to your account. It is called "two-factor-authentication" because two verification methods are used to access your account. The first "factor" is your usual password that is standard for any account. The second "factor" is a verification code retrieved from a 2FA application either from your computer or mobile device. For more details about 2FA and its importance, please visit the following [https://en.wikipedia.org/wiki/Multi-factor_authentication article].

If enabled, a 6 digits code (default value) has to be introduced when you log in to your LimeSurvey instance:

<center>[[File:2FA_login.png]]</center>

To learn more about this functionality, please continue reading below.

=How to install the 2FA plugin=

==LimeSurvey Cloud==

If you are using LimeSurvey Cloud (hosting provided by [https://limesurvey.org LimeSurvey GmbH]), just visit the [[Plugin manager|Plugin Manager]] page and enable it from there (see below for more details).

==LimeSurvey CE==

At the moment, the plugin is not a core component of LimeSurvey CE (Community Edition). To download it, access [https://account.limesurvey.org/limestore LimeStore] and [https://account.limesurvey.org/limestore/49-two-factor-administration-login download the plugin from here].

{{Note|To be able to download it, you need a [https://community.limesurvey.org/comfort-update-extension/ Premium account].}}

Once downloaded, unzip it, and move the folder into the plugins-related folder inside your LimeSurvey instance.

{{Note|To understand the difference between LimeSurvey Cloud and LimeSurvey CE, please visit this [[LimeSurvey_PRO_vs_LimeSurvey_CE|wiki section]].}}

{{Note|For LimeSurvey 3.x, the folder name inside plugins has to be ''TwoFactorAdminLogin''.}}

=Activate the 2FA plugin=

To activate your 2FA plugin, access your LimeSurvey instance, and activate it from your [[Plugin manager|Plugin Manager]]:

<center>[[File:2fa_activate.png]]</center>

To check the default settings, please click on "Configure".

==Plugin settings==

The configuration page contains the following settings:

<center>[[File:2FA plugin configuration.png]]</center>

*'''Issuer:''' The text typed in this box will be displayed in the app as issuer name.
*'''Digits:''' The number of digits the resulting codes will be. Please leave it at 6 for Google Authenticator.
*'''TimePeriod:''' The number of seconds a code will be valid. If you use Google Authenticator, please leave it to 30.
*'''Discrepancy:''' The amount of discrepancy is allowed for the client after the TimePeriod expires (seconds)

*'''Algorithm:''' The algorithm used to generate a hash:
**''SHA1 (Default)''
**''SHA256''
**''MD5''

*'''Force 2FA:''' If you enable it, all instance users have to create a 2FA token after they log in again into the LimeSurvey instance.

Don't forget to click on "Save" after updating your 2FA configuration.

=2-Factor-Settings=

Once you activated the plugin, a new menu item will be displayed on the top bar:

<center>[[File:2fa_location.png]]</center>

The dropdown menu includes the following two options:

*[[TwoFactorAdminLogin#2FA-Setting|2FA-Setting]]: Users can enable and manage their 2FA settings.
*[[TwoFactorAdminLogin#2FA-Administration|2FA-Administration]]: With the right permission, you can visualize whether the other instance users use 2FA or not.

==2FA-Setting==

If you haven't created any 2FA-token yet, the following page will be displayed:

<center>[[File:2fa_register.png]]</center>

If you decide to create a 2FA-token, click on "Register 2FA now". You will be prompted by the following message box:

<center>[[File:2fa_user_settings.png]]</center>

To enable 2FA:
#Select the 2FA authentication method. By default, five different 2FA types are provided: Google Authenticator (default), Authy, YubiKey, Authenticator Plus, Duo, and HDE OTP.
#Scan the QR-code with your mobile phone. For a list of application recommendations, check this [https://en.wikipedia.org/wiki/Help:Two-factor_authentication#Enabling_2FA_on_smartphones_and_tablet_computers article].
#Enter the confirmation key displayed in your 2FA application.

{{Note|From a technical perspective, you can use any 2FA application that supports TOTP (Time-based One-Time Password algorithm). For more information on what TOTP is, please check this [https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm article].}}

To confirm the creation of your 2FA-token, click on "Create 2FA binding".

<hr width="50%" style="margin:auto">

Once done, the following two options will be displayed in your personal 2FA settings:

<center>[[File:2fa_unset.png]]</center>

* '''Unset 2FA:''' Confirm your action to delete the 2FA-token associated to your account.

{{Note|Please note that you will need to re-authenticate again if "Force 2FA" is enabled from the plugin settings.}}

* '''Reset 2FA:''' If this option is selected, you will be asked to scan the new QR-code and introduce the new confirmation Key.

==2FA-Administration==

With the necessary permissions, you can have access to the 2FA user management panel from where you can check how many users activated 2FA.

<center>[[File:2fa_user_management.png]]</center>

*'''Action:''' A red trash button is displayed in this column next to the users that have enabled 2FA. If someone asks to get the 2FA-token reset because he/she cannot log in anymore into your instance, you can delete the 2FA-token associated with his/her account from here.
*'''Username:''' All the instance users are listed under this column.
*'''Full name:'''The full name typed in here by your users is displayed in this field.
*'''Email:''' The email address corresponding to your users.
*'''2FA-Method:''' The 2FA-method chosen by each user.
*'''2FA enabled:''' If "1", it means that 2FA is enabled for the respective user.

=FAQs=

==I am a super administrator and locked myself out. How can I delete my 2FA-token?==

You will need access to your database and truncate the 2FA-related column.

==How can I enforce 2FA to all my users?==

Enable "Force 2FA" from the plugin configuration menu.

==From where can I download the plugin?==

Please access [https://www.limesurvey.org/limestore LimeStore] and [https://www.limesurvey.org/limestore?view=extensiondetails&id=49 download the plugin from download it from here]. To be able to download it, you need to hold a Premium package

==I use LimeSurvey Cloud. Do I have to purchase the plugin?==

No. The plugin is already part of the core LimeSurvey plugins - you can enable it by accessing the plugin menu.

</translate>

TwoFactorAdminLogin

2023-05-04T14:13:22Z

Msouad: /* LimeSurvey CE */

<languages />
<translate>

__TOC__

=Introduction=

'''2-Factor-Authentication''' (2FA) is a way to add additional security to your account. It is called "two-factor-authentication" because two verification methods are used to access your account. The first "factor" is your usual password that is standard for any account. The second "factor" is a verification code retrieved from a 2FA application either from your computer or mobile device. For more details about 2FA and its importance, please visit the following [https://en.wikipedia.org/wiki/Multi-factor_authentication article].

If enabled, a 6 digits code (default value) has to be introduced when you log in to your LimeSurvey instance:

<center>[[File:2FA_login.png]]</center>

To learn more about this functionality, please continue reading below.

=How to install the 2FA plugin=

==LimeSurvey Cloud==

If you are using LimeSurvey Cloud (hosting provided by [https://limesurvey.org LimeSurvey GmbH]), just visit the [[Plugin manager|Plugin Manager]] page and enable it from there (see below for more details).

==LimeSurvey CE==

At the moment, the plugin is not a core component of LimeSurvey CE (Community Edition). To download it, access [https://account.limesurvey.org/limestore LimeStore] and [https://account.limesurvey.org/limestore/49-two-factor-administration-login download the plugin from here].

{{Note|To be able to download it, you need a [https://www.limesurvey.org/editions-and-prices/limesurvey-ce/editions-and-prices-community Premium account].}}

Once downloaded, unzip it, and move the folder into the plugins-related folder inside your LimeSurvey instance.

{{Note|To understand the difference between LimeSurvey Cloud and LimeSurvey CE, please visit this [[LimeSurvey_PRO_vs_LimeSurvey_CE|wiki section]].}}

{{Note|For LimeSurvey 3.x, the folder name inside plugins has to be ''TwoFactorAdminLogin''.}}

=Activate the 2FA plugin=

To activate your 2FA plugin, access your LimeSurvey instance, and activate it from your [[Plugin manager|Plugin Manager]]:

<center>[[File:2fa_activate.png]]</center>

To check the default settings, please click on "Configure".

==Plugin settings==

The configuration page contains the following settings:

<center>[[File:2FA plugin configuration.png]]</center>

*'''Issuer:''' The text typed in this box will be displayed in the app as issuer name.
*'''Digits:''' The number of digits the resulting codes will be. Please leave it at 6 for Google Authenticator.
*'''TimePeriod:''' The number of seconds a code will be valid. If you use Google Authenticator, please leave it to 30.
*'''Discrepancy:''' The amount of discrepancy is allowed for the client after the TimePeriod expires (seconds)

*'''Algorithm:''' The algorithm used to generate a hash:
**''SHA1 (Default)''
**''SHA256''
**''MD5''

*'''Force 2FA:''' If you enable it, all instance users have to create a 2FA token after they log in again into the LimeSurvey instance.

Don't forget to click on "Save" after updating your 2FA configuration.

=2-Factor-Settings=

Once you activated the plugin, a new menu item will be displayed on the top bar:

<center>[[File:2fa_location.png]]</center>

The dropdown menu includes the following two options:

*[[TwoFactorAdminLogin#2FA-Setting|2FA-Setting]]: Users can enable and manage their 2FA settings.
*[[TwoFactorAdminLogin#2FA-Administration|2FA-Administration]]: With the right permission, you can visualize whether the other instance users use 2FA or not.

==2FA-Setting==

If you haven't created any 2FA-token yet, the following page will be displayed:

<center>[[File:2fa_register.png]]</center>

If you decide to create a 2FA-token, click on "Register 2FA now". You will be prompted by the following message box:

<center>[[File:2fa_user_settings.png]]</center>

To enable 2FA:
#Select the 2FA authentication method. By default, five different 2FA types are provided: Google Authenticator (default), Authy, YubiKey, Authenticator Plus, Duo, and HDE OTP.
#Scan the QR-code with your mobile phone. For a list of application recommendations, check this [https://en.wikipedia.org/wiki/Help:Two-factor_authentication#Enabling_2FA_on_smartphones_and_tablet_computers article].
#Enter the confirmation key displayed in your 2FA application.

{{Note|From a technical perspective, you can use any 2FA application that supports TOTP (Time-based One-Time Password algorithm). For more information on what TOTP is, please check this [https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm article].}}

To confirm the creation of your 2FA-token, click on "Create 2FA binding".

<hr width="50%" style="margin:auto">

Once done, the following two options will be displayed in your personal 2FA settings:

<center>[[File:2fa_unset.png]]</center>

* '''Unset 2FA:''' Confirm your action to delete the 2FA-token associated to your account.

{{Note|Please note that you will need to re-authenticate again if "Force 2FA" is enabled from the plugin settings.}}

* '''Reset 2FA:''' If this option is selected, you will be asked to scan the new QR-code and introduce the new confirmation Key.

==2FA-Administration==

With the necessary permissions, you can have access to the 2FA user management panel from where you can check how many users activated 2FA.

<center>[[File:2fa_user_management.png]]</center>

*'''Action:''' A red trash button is displayed in this column next to the users that have enabled 2FA. If someone asks to get the 2FA-token reset because he/she cannot log in anymore into your instance, you can delete the 2FA-token associated with his/her account from here.
*'''Username:''' All the instance users are listed under this column.
*'''Full name:'''The full name typed in here by your users is displayed in this field.
*'''Email:''' The email address corresponding to your users.
*'''2FA-Method:''' The 2FA-method chosen by each user.
*'''2FA enabled:''' If "1", it means that 2FA is enabled for the respective user.

=FAQs=

==I am a super administrator and locked myself out. How can I delete my 2FA-token?==

You will need access to your database and truncate the 2FA-related column.

==How can I enforce 2FA to all my users?==

Enable "Force 2FA" from the plugin configuration menu.

==From where can I download the plugin?==

Please access [https://www.limesurvey.org/limestore LimeStore] and [https://www.limesurvey.org/limestore?view=extensiondetails&id=49 download the plugin from download it from here]. To be able to download it, you need to hold a Premium package

==I use LimeSurvey Cloud. Do I have to purchase the plugin?==

No. The plugin is already part of the core LimeSurvey plugins - you can enable it by accessing the plugin menu.

</translate>