Multi-factor Authentication - Revision history

Ltalaschus at 12:09, 28 March 2024

2024-03-28T12:09:07Z

Cstelzmann at 11:24, 26 May 2023

2023-05-26T11:24:07Z

Ltalaschus: /* Configuration */

2023-05-23T13:20:36Z

Configuration

Ltalaschus: /* Management of app passwords */

2023-05-23T12:49:25Z

Management of app passwords

Ltalaschus: /* Management of app passwords */

2023-05-23T09:25:50Z

Management of app passwords

Ltalaschus: /* Management of app passwords */

2023-05-23T09:14:56Z

Management of app passwords

Ltalaschus at 09:08, 23 May 2023

2023-05-23T09:08:30Z

Ltalaschus: Created page with "To increase security during the login process, multi-factor authentication (MFA) can be activated for users with ''MailStore-integrated'' authentication. MailStore supports ''..."

2023-05-23T08:53:02Z

Created page with "To increase security during the login process, multi-factor authentication (MFA) can be activated for users with ''MailStore-integrated'' authentication. MailStore supports ''..."

New page

To increase security during the login process, multi-factor authentication (MFA) can be activated for users with ''MailStore-integrated'' authentication. MailStore supports ''Time-based One-time Password (TOTP)'' according to ''RFC 6238''. 
To do this, users need a TOTP-enabled device, e.g. a smartphone with an installed authenticator app.

'''Important notice:''' In order for valid one-time passwords (TOTP) to be generated, the system times of the MailStore Server and the end devices must be synchronized.

== Configuration ==

Administrators are able to configure multi-factor authentication in the [[Users,_Folders_and_Settings|user management]].

Log in as a MailStore administrator via MailStore Client. Click ''Administrative Tools'' > ''Users and Archives'' and then click ''Users''.

=== Activation===

* Open the properties of the user you want to enable MFA for.
* Select the entry ''MailStore-integrated with MFA'' from the ''Authentication'' drop-down menu.
* Confirm with ''OK''.
* The next time the user [[Multi-factor_authentication#Login|logs in]] with an MFA-enabled client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-enabled authenticator app (e.g. Google Authenticator), then enter an MFA code to complete the MFA configuration.

[[File:umgm_users_02_mfa.png|center|400px]]

=== Deactivation ===

* Open the properties of the user you want to disable MFA for.
* Select the entry ''MailStore-integrated'' from the ''Authentication'' drop-down menu.
* Confirm with ''OK''.
* App passwords that may have been created remain in place and remain valid.

[[File:umgm_users_02.png|center|400px]]

=== Reinitialize MFA ===

If a user lost the device on which MFA was set up, wants to set up MFA on a different device, or needs to set up MFA again for some other reason, you can reinitialize MFA. This generates a new secret from which the one-time passwords are derived. 
The next time the user [[Multi-factor_authentication#Login|logs in]], they will be prompted again to complete the MFA configuration.
 
If the user has not yet completed the MFA configuration with their device, this function is not available.

* Open the properties of the user you want to reinitialize MFA for.
* Click on the ''Commands'' button.
* Click on ''Reinitialize MFA''.
* Confirm the operation.

[[File:umgm_users_02_mfa_commands.png|center|400px]]

=== Delete App passwords ===

If a user has created app passwords to continue using ''non-MFA enabled clients'' (Scheduled Tasks, IMAP, Management API), you can delete them here.
 
If the user has not created any app passwords, this feature is not available.
 
App passwords can only be cleared in their entirety.

* Open the properties of the user whose app passwords you want to delete.
* Click the ''Commands'' button.
* Click on ''Remove App Passwords''.
* Confirm the operation.

== Login ==

If multi-factor authentication has been activated for a user, the next time the user logs in with an MFA-enabled client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-enabled authenticator app (e.g. Google Authenticator). This stores the previously generated secret into the app, and the app is able to generate valid one-time passwords. 
The secret is displayed below the QR code and can be copied to the clipboard with a double-click to be stored in a password manager.

[[File:Mfa_finalize_02.png|center|400px]]

If the QR code has been scanned and a valid MFA code has been entered, subsequent login attempts will only be asked for the MFA code.

[[File:Mfa_codeonly_02.png|center|400px]]

=== Trusted Devices ===

If the device from which the login is made is trusted, the option ''Trust this device for 14 days.'' can be set. When setting this option, an additional token is stored on the end device, which is sent with the login process.

[[File:Mfa_codeonly_trusted_device_03.png|center|400px]]

MailStore Client, Outlook Add-In and Web Access each save their own token. 
The token for MailStore Client and the Outlook Add-In is stored in the Windows credential manager. It does not move with roaming profiles. 
The token for web access is stored in the browser's ''Local Storage''. When Web Access is accessed in the browser's ''Incognito mode'', the token is not persisted in between browser sessions.

== Management of app passwords ==

Once multi-factor authentication has been enabled for a user, the normal password can no longer be used to log in with ''non-MFA enabled clients''. 
''Non-MFA enabled clients'' include: 
* ''[[Email_Archiving_with_MailStore_Basics#Automating_Execution_of_E-mail_Client_or_E-mail_Files_Archiving_Profiles|Scheduled Tasks]]'', that use the MailStore Client in command line mode
* [[Accessing_the_Archive_via_Integrated_IMAP_Server|IMAP clients]]
* [[Administration_API_-_Using_the_API|Management-API clients]], such as the [[PowerShell_API_Wrapper_Tutorial|Powershell API-Wrapper]] and the [[Python_API_Wrapper_Tutorial|Python API-Wrapper]]

To ensure that these clients can still be used, users can create app passwords. These passwords are generated by MailStore and are characterized by increased complexity.

App passwords can only be managed via MailStore Client by users with ''MailStore-integrated'' authentication. In addition, the ''Change Password'' right is required. 
App passwords work even with MFA disabled.

* Log on to [[Access_via_the_MailStore_Client_Software|MailStore Client]].
* From the ''Home'', click ''Manage Passwords''.
* The context names of the app passwords created so far are listed.
*: [[File:App_passwords_manage.png|center|400px]]
* Click ''Add'' to add a new app password.
*: [[File:App_passwords_create.png|center|400px]]
* Highlight a name and click ''Delete'' to delete an app password.

[[de:Multi-Faktor-Authentifizierung]]
[[en:Multi-Factor-Authentication]]

@@ Line 1: / Line 1: @@
-To increase security during the login process, multi-factor authentication (MFA) can be activated for users with ''MailStore-integrated'' authentication. MailStore supports ''Time-based One-time Password (TOTP)'' according to ''RFC 6238''.<br/><br/>
+To increase security during the login process, multi-factor authentication (MFA) can be activated for MailStore users. MailStore supports ''Time-based One-time Password (TOTP)'' according to ''RFC 6238''.<br/><br/>
-To do this, users need a TOTP-capable device, e.g. a smartphone with an installed authenticator app.
+To do this, users need a TOTP-capable device, e.g. a smartphone with an installed authenticator app.<br/><br/>
 <p class=msnote>'''Important notice:''' In order for valid one-time passwords (TOTP) to be generated, the system times of the MailStore Server and the end devices must be synchronized.</p>
@@ Line 13: / Line 15: @@
 * Open the properties of the user you want to enable MFA for.
-* Select the entry ''MailStore-integrated with MFA'' from the ''Authentication'' drop-down menu.
+* Check the option ''Multi-factor Authentication'' in the ''General Information'' section.
 * Confirm with ''OK''.
 * The next time the user [[Multi-factor_Authentication#Login|logs in]] with an MFA-capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-capable authenticator app (e.g. Google Authenticator), then enter an MFA code to complete the MFA configuration.
@@ Line 22: / Line 24: @@
 * Open the properties of the user you want to disable MFA for.
-* Select the entry ''MailStore-integrated'' from the ''Authentication'' drop-down menu.
+* Uncheck the option ''Multi-factor Authentication'' in the ''General Information'' section.
 * Confirm with ''OK''.
 * App passwords that may have been created remain in place and remain valid.

@@ Line 1: / Line 1: @@
 To increase security during the login process, multi-factor authentication (MFA) can be activated for users with ''MailStore-integrated'' authentication. MailStore supports ''Time-based One-time Password (TOTP)'' according to ''RFC 6238''.<br/><br/>
-To do this, users need a TOTP capable device, e.g. a smartphone with an installed authenticator app.
+To do this, users need a TOTP-capable device, e.g. a smartphone with an installed authenticator app.
 <p class=msnote>'''Important notice:''' In order for valid one-time passwords (TOTP) to be generated, the system times of the MailStore Server and the end devices must be synchronized.</p>
@@ Line 15: / Line 15: @@
 * Select the entry ''MailStore-integrated with MFA'' from the ''Authentication'' drop-down menu.
 * Confirm with ''OK''.
-* The next time the user [[Multi-factor_Authentication#Login|logs in]] with an MFA capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP capable authenticator app (e.g. Google Authenticator), then enter an MFA code to complete the MFA configuration.
+* The next time the user [[Multi-factor_Authentication#Login|logs in]] with an MFA-capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-capable authenticator app (e.g. Google Authenticator), then enter an MFA code to complete the MFA configuration.
 [[File:umgm_users_02_mfa.png|center|400px]]
@@ Line 44: / Line 44: @@
 === Delete App passwords ===
-If a user has created app passwords to continue using ''non-MFA capable clients'' (Scheduled Tasks, IMAP, Management API), you can delete them here.
+If a user has created app passwords to continue using ''non MFA-capable clients'' (Scheduled Tasks, IMAP, Management API), you can delete them here.
 <br/>
 If the user has not created any app passwords, this feature is not available.
@@ Line 57: / Line 57: @@
 == Login ==
-If multi-factor authentication has been activated for a user, the next time the user logs in with an MFA capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP capable authenticator app (e.g. Google Authenticator). This stores the previously generated secret into the app, and the app is able to generate valid one-time passwords.<br/>
+If multi-factor authentication has been activated for a user, the next time the user logs in with an MFA-capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-capable authenticator app (e.g. Google Authenticator). This stores the previously generated secret into the app, and the app is able to generate valid one-time passwords.<br/>
 The secret is displayed below the QR code and can be copied to the clipboard with a double-click to be stored in a password manager.
@@ Line 78: / Line 78: @@
 == Management of app passwords ==
-Once multi-factor authentication has been enabled for a user, the normal password can no longer be used to log in with ''non-MFA capable clients''.<br/><br/>
+Once multi-factor authentication has been enabled for a user, the normal password can no longer be used to log in with ''non MFA-capable clients''.<br/><br/>
-''Non-MFA capable clients'' include:<br/>
+''Non MFA-capable clients'' include:<br/>
 * ''[[Email_Archiving_with_MailStore_Basics#Automating_Execution_of_E-mail_Client_or_E-mail_Files_Archiving_Profiles|Scheduled Tasks]]'', that use the MailStore Client in command line mode
 * [[Accessing_the_Archive_via_Integrated_IMAP_Server|IMAP clients]]
@@ Line 88: / Line 88: @@
 App passwords can only be managed via MailStore Client by users with ''MailStore-integrated'' authentication. In addition, the ''Change Password'' right is required.<br/>
 App passwords work even with MFA disabled.<br/>
-App passwords can never be used to login with MFA capable clients.
+App passwords can never be used to login with MFA-capable clients.
 * Log on to [[Accessing_the_Archive_with_the_MailStore_Client_software|MailStore Client]].

@@ Line 87: / Line 87: @@
 App passwords can only be managed via MailStore Client by users with ''MailStore-integrated'' authentication. In addition, the ''Change Password'' right is required.<br/>
-App passwords work even with MFA disabled.
+App passwords work even with MFA disabled.<br/>
 * Log on to [[Accessing_the_Archive_with_the_MailStore_Client_software|MailStore Client]].

@@ Line 1: / Line 1: @@
 To increase security during the login process, multi-factor authentication (MFA) can be activated for users with ''MailStore-integrated'' authentication. MailStore supports ''Time-based One-time Password (TOTP)'' according to ''RFC 6238''.<br/><br/>
-To do this, users need a TOTP-enabled device, e.g. a smartphone with an installed authenticator app.
+To do this, users need a TOTP capable device, e.g. a smartphone with an installed authenticator app.
 <p class=msnote>'''Important notice:''' In order for valid one-time passwords (TOTP) to be generated, the system times of the MailStore Server and the end devices must be synchronized.</p>
@@ Line 15: / Line 15: @@
 * Select the entry ''MailStore-integrated with MFA'' from the ''Authentication'' drop-down menu.
 * Confirm with ''OK''.
-* The next time the user [[Multi-factor_authentication#Login|logs in]] with an MFA-enabled client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-enabled authenticator app (e.g. Google Authenticator), then enter an MFA code to complete the MFA configuration.
+* The next time the user [[Multi-factor_Authentication#Login|logs in]] with an MFA capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP capable authenticator app (e.g. Google Authenticator), then enter an MFA code to complete the MFA configuration.
 [[File:umgm_users_02_mfa.png|center|400px]]
@@ Line 31: / Line 31: @@
 If a user lost the device on which MFA was set up, wants to set up MFA on a different device, or needs to set up MFA again for some other reason, you can reinitialize MFA. This generates a new secret from which the one-time passwords are derived.<br/>
-The next time the user [[Multi-factor_authentication#Login|logs in]], they will be prompted again to complete the MFA configuration.
+The next time the user [[Multi-factor_Authentication#Login|logs in]], they will be prompted again to complete the MFA configuration.
 <br/>
 If the user has not yet completed the MFA configuration with their device, this function is not available.
@@ Line 44: / Line 44: @@
 === Delete App passwords ===
-If a user has created app passwords to continue using ''non-MFA enabled clients'' (Scheduled Tasks, IMAP, Management API), you can delete them here.
+If a user has created app passwords to continue using ''non-MFA capable clients'' (Scheduled Tasks, IMAP, Management API), you can delete them here.
 <br/>
 If the user has not created any app passwords, this feature is not available.
@@ Line 57: / Line 57: @@
 == Login ==
-If multi-factor authentication has been activated for a user, the next time the user logs in with an MFA-enabled client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP-enabled authenticator app (e.g. Google Authenticator). This stores the previously generated secret into the app, and the app is able to generate valid one-time passwords.<br/>
+If multi-factor authentication has been activated for a user, the next time the user logs in with an MFA capable client (MailStore Client, MailStore Outlook Add-In, Web Access), the user will be prompted to scan a QR code with a TOTP capable authenticator app (e.g. Google Authenticator). This stores the previously generated secret into the app, and the app is able to generate valid one-time passwords.<br/>
 The secret is displayed below the QR code and can be copied to the clipboard with a double-click to be stored in a password manager.
@@ Line 74: / Line 74: @@
 MailStore Client, Outlook Add-In and Web Access each save their own token.<br/><br/>
 The token for MailStore Client and the Outlook Add-In is stored in the Windows credential manager. It does not move with roaming profiles.<br/><br/>
-The token for web access is stored in the browser's ''Local Storage''. When Web Access is accessed in the browser's ''Incognito mode'', the token is not persisted in between browser sessions.
+The token for Web Access is stored in the browser's ''Local Storage''. When Web Access is accessed in the browser's ''Incognito mode'', the token is not persisted in between browser sessions.
 == Management of app passwords ==
-Once multi-factor authentication has been enabled for a user, the normal password can no longer be used to log in with ''non-MFA enabled clients''.<br/><br/>
+Once multi-factor authentication has been enabled for a user, the normal password can no longer be used to log in with ''non-MFA capable clients''.<br/><br/>
-''Non-MFA enabled clients'' include:<br/>
+''Non-MFA capable clients'' include:<br/>
 * ''[[Email_Archiving_with_MailStore_Basics#Automating_Execution_of_E-mail_Client_or_E-mail_Files_Archiving_Profiles|Scheduled Tasks]]'', that use the MailStore Client in command line mode
 * [[Accessing_the_Archive_via_Integrated_IMAP_Server|IMAP clients]]
@@ Line 90: / Line 90: @@
 * Log on to [[Access_via_the_MailStore_Client_Software|MailStore Client]].
-* From the ''Home'', click ''Manage Passwords''.
+* From the ''Start Page'', click ''Manage Passwords''.
 * The context names of the app passwords created so far are listed.
 *: [[File:App_passwords_manage.png|center|400px]]
@@ Line 98: / Line 98: @@
 [[de:Multi-Faktor-Authentifizierung]]
-[[en:Multi-Factor-Authentication]]
+[[en:Multi-factor_Authentication]]

@@ Line 6: / Line 6: @@
 == Configuration ==
-Administrators are able to configure multi-factor authentication in the [[Users,_Folders_and_Settings|user management]].
+Administrators are able to configure multi-factor authentication within [[Users,_Folders_and_Settings|user management]].
 Log in as a MailStore administrator via MailStore Client. Click ''Administrative Tools'' > ''Users and Archives'' and then click ''Users''.

@@ Line 95: / Line 95: @@
 * Click ''Add'' to add a new app password.
 *: [[File:App_passwords_create.png|center|400px]]
 * Highlight a name and click ''Delete'' to delete an app password.
 [[de:Multi-Faktor-Authentifizierung]]
 [[en:Multi-factor_Authentication]]