arrow_back history picture_as_pdf This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong. ~~NOTRANS~~ ~~Title: Multi-factor authentication~~ A modern authentication system offers more than one check for user verification. A simple mechanism is username/password check. But the problem is often that it's not secure enough because if someone knows your username/password combination, doors are open. So an additional check is necessary to get better security. There are different techniques like: * enter a verification code, sent to a custom email address * use an app to confirm (often used for online banking) * use another authentication provider like Auth0, Okta, Google, ... Sure, the list is not complete but it covers common solutions. The authentication mechanism of JVx is flexible. The default security managers are ready to use and offer base checks. The framework supports different databases and also xml files for user management. It's easy to create your own security manager if you need specific checks. If you require multi-factor authentication for your application. it's also possible with JVx because it's already built-in. JVx contains a standard implementation for common multi-factor authentication mechanism'. As usual, it's supported to implement your own multi-factor authentication. The configuration is simple. Just wrap your existing security manager: before: <file xml> <securitymanager> <class>com.sibvisions.rad.server.security.XmlSecurityManager</class> <userfile>users.xml</userfile> </securitymanager> </file> after: <file xml> <securitymanager> <class>com.sibvisions.rad.server.security.mfa.MFASecurityManager</class> <mfa enabled="true"> <class>com.sibvisions.rad.server.security.XmlSecurityManager</class> <authenticator> <class>com.sibvisions.rad.server.security.mfa.auth.TextInputMFAuthenticator</class> <!-- use an implementation of: com.sibvisions.rad.server.security.mfa.auth.IPayloadNotificationHandler <notificationhandler></notificationhandler> --> </authenticator> </mfa> <userfile>users.xml</userfile> </securitymanager> </file> The important thing is the authenticator. The ''TextInputMFAuthenticator'' creates a password/code for confirmation. It sends the code via ''notificationhandler''. The default implementation sends an email. It's possible to create your own notification handler to send the code as SMS or use a different communication channel.