.. title:: Two Factor Authentication

Two Factor Authentication
===============================

Two Factor Authentication requires the user provide an additional piece of evidence beyond their standard password, to
gain access to the system. Kasm implements a Time-based One-Time Password (TOTP) algorithm that can be used with popular
apps such as Google's Authenticator.

Two factor authentication can be enabled by the administrator through group settings. Each user will be required to setup
their own secret and authentication application during their next login.

| Download the Apps:
| `Apple App Store <https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8>`_
| `Google Play Store <https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&hl=en_US?>`_

.. note::
  Google Authenticator is the only officially supported Application but others like Microsoft's Authenticator App or
  others that implement TOTP may be compatible.

Enable Two Factor
------------------

* Navigate to the Groups tab in the Administrators Sidebar and select green view button for the group

* Select Add Settings from the Group Settings card

* Select the "enable_totp_two_factor" setting and select True to add to all of the users in the group

.. image:: /images/two_factor/auth_enable.png
    :scale: 70%

User Authentication Setup
----------------------------

The user will be asked to add the authentication to their Authenticator App on the first log on after two factor was enabled.

Once the username and password have been verified a QR code and secret are provided for easy implementation in Google's Authenticator

* The User will select the plus icon in Authenticator and select Scan barcode to use thier phones camera to add the secret or Manual Entry to enter the secret manually

.. image:: /images/two_factor/auth_setup.png
    :scale: 70%

* User must enter one time password provided in the Authenticator App to login

.. image:: /images/two_factor/auth_code.png
    :scale: 70%

Reset Single-User Authentication
---------------------------------

The user can reset the authentication code in the reset password section.

* Navigate to the profile tab in the Sidebar and select "Reset Password"

* Enter current password and a new password

* Check the "Reset Two Factor Authenticator" checkbox and then click Submit

.. image:: /images/two_factor/auth_reset.png
    :scale: 70%

The administrator can reset the users authentication.

* Navigate to the Users tab in the Administrators Sidebar and select edit for the user

* Check the "Reset Two Authenticator Secret" checkbox and then click Submit

.. image:: /images/two_factor/auth_user_reset.png
    :scale: 70%