# Enable Twofactor SMS authentication

## <span class="mw-headline" id="bkmrk-understanding-two-fa-1">Understanding two factor authentication</span>

Two factor security will require authenticated user to

1. Provide a passcode sent to their cell phone
2. Login from one the office IP addresses ("Office IP")
3. Login from an IP that they have succesfully logged in from X times before ("Home IP")

The IP based requirements are optional, and HomeIP is a subset of the OfficeIP solution.

Note: This functionality is still considered BETA

## <span class="mw-headline" id="bkmrk-preparation-1">Preparation</span>

To enable 2 factor authentication for users you will need to prepare the following:

- List of IP's that should not require 2 factor authentication
- An messaging URL for sending SMS's

Optionally you will also enter cellphone numbers for all employees in their user user profiles.

## <span class="mw-headline" id="bkmrk-step-by-step-setup-1">Step by step setup</span>

### <span class="mw-headline" id="bkmrk-system-configuration-1">System configuration</span>

First you will setup the system to run in testmode, so that all messages are sent for you. After checking everything works, disable the testmode.

Change server configurations

- Set **smsConnectUrl** to your connection URL
- Check that **smsParamMessage** fits the parameter name of your SMS provider
- Check that **smsParamNumber** fits the parameter name of your SMS provider

Optionally you can allow IP based exceptions from the rules

- Set **passcodeTrustedIp** to true
- Set **passcodeTrustedIpList** to contain your office IP's

Furthermore you can allow multiple logins from the same IP to

- Set **passcodeUserIpHistory** to true
- Set **passcodeUserIpHistoryCount** to minimum succesfull logins

### <span class="mw-headline" id="bkmrk-activate-passcode-fi-1">Activate passcode filters</span>

Stop the application server

Go to the application folder and dive into: &lt;application&gt;\\WEB-INF\\web.xml

Uncomment the section containing the servlet mapping

```xml
 <filter>
    <filter-name>TwoFactorAuthentication</filter-name>
    <filter-class>dk.tempusserva.passcode.SmsVerificationFilter</filter-class>
 </filter>
 <filter-mapping>
    <filter-name>TwoFactorAuthentication</filter-name>
    <url-pattern>/main</url-pattern>
 </filter-mapping>
```

Start the application server

### <span class="mw-headline" id="bkmrk-test-and-go-live-1">Test and go live</span>

Validate that two factor login works as intended.

Change server configurations

- Set **smsTestMode** to false