here<\/a> for more information.<\/p>\n\n\n\nTwo Factor Expiration:<\/strong> Use this option to specify the number of days before the 2FA cookie (set in the browser) will expire for the user and thus will require the user to re-authenticate via 2FA again. <\/p>\n\n\n\nFor example, when a user signs in and authenticates against 2FA for the first time, here are some applicable options for this setting:<\/p>\n\n\n\n
\nA value of 30<\/strong> means 30 days from the initial sign on before the user’s next sign on attempt will require 2FA again. This number can be adjusted as desired.<\/li>\n\n\n\nA value 0<\/strong> means no expiration date after the end-user’s initial 2FA. The user will never be presented with 2FA again, unless they attempt to access the application from a new device or new browser. <\/li>\n\n\n\nA value of -1<\/strong> means 2FA will be prompted to the end-user on every<\/strong> sign on attempt.<\/li>\n<\/ul>\n\n\n\nTable and Column info:<\/strong> The table and columns that contain the user information, which m-Power will use for sending the user an email or SMS text message, must be specified here.<\/p>\n\n\n\nStep 2 – Setting up the 2FA screen<\/h3>\n\n\n\n The screen presented to the end-user during the 2FA process depends on your chosen message type.<\/p>\n\n\n\n
For Email and SMS Verification:<\/strong><\/p>\n\n\n\nThe default screen is the mrcAuthentication.html<\/code> file located in your dictionary folder (...\/m-power\/mrcjava\/WEB-INF\/classes\/DICTIONARY<\/code>). If this file is not within this directory, simply copy it from ...\/m-power\/mrcjava\/mrcclasses\/<\/code>. You may customize the style of this page to your liking.<\/p>\n\n\n\nFor TOTP Verification:<\/strong> m-Power utilizes two separate HTML files specifically for authenticator-app workflows<\/sup>:<\/p>\n\n\n\nmrcAuthenticationTotpSetup.html<\/code>: Prompted on an unenrolled user’s first login to display the QR enrollment code. Default versions are bundled inside m-Power and are used automatically when a dictionary has no local copy. To customize them, copy the master files from \/mrcjava\/mrcclasses\/<\/code> into your dictionary folder.<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\tmrcAuthenticationTotp.html<\/code>: Prompted when an enrolled user needs to enter their 6-digit code.<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\tStep 3 – Add entry to web.xml file<\/h3>\n\n\n\n Open the web.xml file, located in …\/m-power\/mrcjava\/WEB-INF in a text editor and do a search for “mrc_auth2”. <\/p>\n\n\n\n
The following servlet shown below must be listed in this file. If is it not listed, please copy the code and place this at the bottom of the file before the final <\/webapp><\/code> tag at the very bottom of the file.<\/p>\n\n\n\n<servlet>\n <servlet-name>mrc_auth2<\/servlet-name>\n <servlet-class>mrc.TwoFactorAuthentication<\/servlet-class>\n<\/servlet>\n<servlet-mapping>\n <servlet-name>mrc_auth2<\/servlet-name>\n <url-pattern>\/servlet\/mrc.auth2<\/url-pattern>\n<\/servlet-mapping><\/code><\/pre>\n\n\n\nOnce the file has been saved, Tomcat will need to be restarted at this point.<\/p>\n\n\n\n
TOTP Configuration<\/h2>\n\n\n\n If you selected totp<\/code> for your Message Type Option, additional database and server configurations are required.<\/p>\n\n\n\nDatabase Changes<\/h3>\n\n\n\n One new column is needed on your user info table to store the user’s TOTP secret. By default, this column should be named TOTPSECRET<\/code>.<\/p>\n\n\n\n\nThe column stores the secret as plain Base32 when no encryption key is configured.<\/li>\n\n\n\n When the totp_encryption_key<\/code> property is set, the secret is stored as enc:<base64><\/code>.<\/li>\n\n\n\nAn empty or NULL value in this column means the user is “not enrolled yet,” prompting the QR enrollment page upon their next login.<\/li>\n<\/ul>\n\n\n\nExample DDL per platform (adjust schema\/library as needed):<\/p>\n\n\n\n
-- IBM i \/ DB2:\nALTER TABLE MYLIB.MRCSEC1 ADD COLUMN TOTPSECRET VARCHAR(200) DEFAULT NULL;\n\n-- SQL Server:\nALTER TABLE MYLIB.dbo.MRCSEC1 ADD TOTPSECRET VARCHAR(200) NULL;\n\n-- Oracle:\nALTER TABLE MYLIB.MRCSEC1 ADD TOTPSECRET VARCHAR2(200);\n\n-- MySQL \/ MariaDB:\nALTER TABLE MYLIB.MRCSEC1 ADD COLUMN TOTPSECRET VARCHAR(200) NULL;\n\n-- PostgreSQL:\nALTER TABLE mylib.mrcsec1 ADD COLUMN totpsecret VARCHAR(200);<\/code><\/pre>\n\n\n\nA TOTPSECRET value that is empty\/NULL<\/strong> means “not enrolled yet” \u2014 the user gets the QR enrollment page on next login.<\/p>\n\n\n\nRe-enrollment \/ lost phone<\/h4>\n\n\n\n If a user needs to be re-enrolled (for example, they lose their mobile device or get a new one), the TOTPSECRET value must be nullified. <\/p>\n\n\n\n
UPDATE MYLIB.MRCSEC1 SET TOTPSECRET = NULL WHERE USERID = 'JSMITH';<\/code><\/pre>\n\n\n\nOnce the field value is reset, the user re-enrolls with a fresh secret on next login.<\/p>\n\n\n\n
mrc-runtime.properties<\/h3>\n\n\n\n Optional advanced properties can be configured in \/mrcjava\/WEB-INF\/classes\/mrc-runtime.properties<\/code>:<\/p>\n\n\n\ntotp_encryption_key:<\/strong> Recommended for live production environments.<\/em> This property scrambles the secret codes (using AES-256-GCM) before saving them to your database. This ensures that even if someone gained unauthorized access to your database, they could not read the secrets or generate valid login codes. Without this key, the secrets are stored as readable plain text. <\/p>\n\n\n\nExample configuration:<\/em> totp_encryption_key=0nyqUmzvM+UtNOgil8AZMrhcAgs8H3NzeEhtxgjh21Y=<\/code><\/p>\n\n\n\nWarning:<\/strong> If you change or lose this key, the encrypted secrets can no longer be decrypted. Affected users will receive an error on the 2FA screen and must have their TOTPSECRET<\/code> column cleared by an administrator to re-enroll. Always back this key up alongside your other server secrets<\/p>\n\n\n\ntotp_window:<\/strong> Adjusts for slight time differences between your server and a user’s phone, which is often called “clock-drift tolerance”. Because authenticator apps generate codes based on the exact current time, a legitimate code might fail if a user’s phone clock is slightly fast or slow. This setting provides a brief grace period by accepting codes from just before or just after the current time. It accepts values from 0<\/code> to 4<\/code>. The default value of 1<\/code> means a code is valid for roughly 30 seconds before and after the current time.<\/p>\n\n\n\ntotp_issuer:<\/strong> The default company or app name displayed inside the user’s authenticator app. This is the label shown right above the 6-digit code on their phone, helping them identify what the code is for. Setting a value here is global, but can be overridden per dictionary in your mrcSignon2.xml<\/code> file<\/p>\n\n\n\nHTML Customizations<\/h3>\n\n\n\n Default versions are already included with m-Power and are used automatically when a dictionary has no copy. To customize for a dictionary, copy the master files (mrcAuthenticationTotp.html and mrcAuthenticationTotpSetup.html) from \/mrcjava\/mrcclasses\/<\/code> into \/mrcjava\/WEB-INF\/classes\/[DICTIONARY]<\/code>. Replace [DICTIONARY] with your actual dictionary name. <\/p>\n","protected":false},"excerpt":{"rendered":"Overview Two-factor authentication provides an additional security layer for user authentication. When a user authenticates via their username and password, a secondary form of authentication is prompted where the user must enter a unique code sent via email, text message, or a TOTP (Time-based One-Time Password) authenticator app. This document…<\/p>\n","protected":false},"author":1,"comment_status":"closed","ping_status":"closed","template":"","format":"standard","meta":{"footnotes":""},"ht-kb-category":[257],"ht-kb-tag":[],"class_list":["post-12193","ht_kb","type-ht_kb","status-publish","format-standard","hentry","ht_kb_category-security"],"_links":{"self":[{"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/ht-kb\/12193","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/ht-kb"}],"about":[{"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/types\/ht_kb"}],"author":[{"embeddable":true,"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/comments?post=12193"}],"version-history":[{"count":30,"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/ht-kb\/12193\/revisions"}],"predecessor-version":[{"id":15318,"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/ht-kb\/12193\/revisions\/15318"}],"wp:attachment":[{"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/media?parent=12193"}],"wp:term":[{"taxonomy":"ht_kb_category","embeddable":true,"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/ht-kb-category?post=12193"},{"taxonomy":"ht_kb_tag","embeddable":true,"href":"https:\/\/www.mrc-productivity.com\/docs\/wp-json\/wp\/v2\/ht-kb-tag?post=12193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"Security](\"\/techblog\/images\/2FA_1.png\")
<\/figure>\n\n\n\n![\"2FA](\"\/techblog\/images\/2FA_2.png\")
<\/figure>\n\n\n\n![\"\"\/](\"\/techblog\/images\/2faTotpSetup.png\")