Keycyte PAM 3.2 · Administrator Guide
Multi-Factor Authentication
Multi-factor authentication (MFA) asks a user for a one-time code in addition to the password. Keycyte PAM supports three MFA types:
| MFA type | How the user gets the code |
|---|---|
Authenticator (AUTHENTICATOR) | A time-based code from an authenticator application, such as Microsoft Authenticator or Google Authenticator. The user registers Keycyte PAM in the application once by scanning a QR code. |
Email (EMAIL) | A code sent to the user’s e-mail address at each sign-in. |
SMS (SMS) | A code sent to the user’s phone number at each sign-in. |
MFA applies when the user signs in to the Admin Panel or the Client Panel. Server roles and password roles can also require an MFA code before a connection; see Server Roles.
Before you begin:
- You need the Edit permission for Users.
- For Email, and for sending authenticator setup e-mails, configure e-mail delivery in Settings > Notification. For SMS, configure an SMS gateway there. See Notification Settings.
- Make sure that users have an e-mail address or phone number on file. For domain users, the e-mail address is read from the directory if it is not set on the user.
Enabling MFA for Users
To enable MFA for one or more users:
- Select Users in the menu.
- Do one of the following:
- For one user, click MFA Setup in the row of the user.
- For several users, select them and click Enable MFA (envelope icon) in the toolbar.
- In the MFA Setup dialog, select the MFA type: Authenticator, Email or SMS.
- For Authenticator, select or clear Send MFA setup email to users:
- Selected: each user receives an e-mail with the QR code and secret key.
- Cleared: each user sees the QR code at the next successful sign-in and completes the setup there.
- Click Setup.
The MFA Setup Results dialog shows the outcome for each user. For security, the QR code and secret are never shown to the administrator. If the setup e-mail cannot be sent, the user sees the QR code at the next sign-in instead.
For Email and SMS, MFA is active immediately; no setup step is needed.
You can also turn MFA on or off and change the type when you edit a user: select MFA and choose the MFA Type in the Portal User panel. Users without MFA are marked with a badge in the user list.
What the User Sees
At the next sign-in, after entering the password:
- Authenticator, not yet set up: the sign-in page shows a QR code and the secret key. The user scans the code with an authenticator application and enters the 6-digit code in MFA Code.
- Authenticator, set up: the user enters the current code from the application in MFA Code.
- Email or SMS: Keycyte PAM sends a code, and the user enters it in MFA Code.
Wrong codes count as failed sign-in attempts and can lock the account according to the local user password policy.
Tip
To give a user a new authenticator secret, for example after the user replaced the phone that holds the authenticator application, edit the user, clear MFA, click Save, and then run MFA Setup for the user again with Authenticator. Clearing MFA removes the stored secret, so the next setup issues a new one.