Setting up Two-Factor Authentication - One-time Password Sent through Email

If you choose this option, after the first level of authentication through the usual way, Password Manager Pro will randomly generate a unique password and it will be emailed to the user. The user has to enter the password sent by email to authenticate at the second level. The second level password generated and sent by Password Manager Pro is applicable only for that particular session of the web-interface. If the user logs out and tries to log in again, they will not be allowed to log in with the same password sent by email earlier. The user has to fetch the password sent by email again and enter it for authentication.

Summary of Steps

1. Configuring two-factor authentication in Password Manager Pro.
2. Enforcing two-factor authentication for required users.
3. Connecting to Password Manager Pro web interface when TFA is enabled.

1. Configuring Two-Factor Authentication in Password Manager Pro

1. Navigate to Admin >> Authentication >> two-factor Authentication.
2. Choose the option "One-time password sent through email".
3. Click "Save".

   

4. Then, click on Confirm to enforce OTP through email as the second factor of authentication.

2. Enforcing Two-Factor Authentication for the Required Users

• Once you confirm OTP through email as the second factor of authentication in the previous step, a new window will prompt you to select the users for whom two-factor authentication should be enforced.
• You can enable or disable two-factor authentication for a single user or multiple users in bulk from here. To enable two-factor authentication for a single user, click on the 'Enable' button beside their respective username. For multiple users, select the required usernames and click on 'Enable' at the top of the user list. Similarly, you can also 'Disable' two-factor authentication from here.

  

• You can also select the users later by navigating to Users >> More Actions >> two-factor Authenitcation.

3. Connecting to Password Manager Pro Web Interface when TFA is Enabled

The users for whom two-factor authentication is enabled, will have to authenticate twice successively. As explained above, the first level of authentication will be through the usual authentication. That is, the users have to authenticate through Password Manager Pro's local authentication or AD/LDAP/Azure AD authentication. If the administrator has chosen the TFA option "One time password sent through email", the two-factor authentication will happen as detailed below:

• Upon launching the Password Manager Pro web-interface, the user has to enter the username and local authentication or AD/LDAP/Azure AD password to log in to Password Manager Pro and click "Login".
• Once the first level of authentication succeeds, Password Manager Pro will generate a random password and email it to the user.
• The user has to fetch the password from the email and enter it as the second password.
• If the second authentication succeeds, the user will be allowed to view the Password Manager Pro web interface.

If you have configured High Availability,

Whenever you enable TFA or when you change the TFA type (PhoneFactor or RSA SecurID or One-time password or RADIUS or Duo) AND if you have configured high availability, you need to restart the Password Manager Pro secondary server once.