Administrator: Deploy Multi-Factor Authentication

Permissions for the configuration

Multi-factor authentication can only be configured by the administrator—that is, by users who are members of the "Administrators" user group.

Configuring Multi-Factor Authentication

In Portal Manager, you can configure multi-factor authentication in the "Portal Properties." There, it can be configured and enabled in the "Security" section. By default, all services are disabled.

The following methods can be enabled:

Authentication App (QR Code)

The authentication app is the preferred option because it can be used on any device. The authentication app uses TOTP.

Only the issuer's name is stored in the authentication app's configuration. This field is pre-filled with the portal name defined in the "General" section of the portal's properties.

The publisher is displayed in the authentication app:

Once the configuration is complete, the service can be enabled by checking the checkbox and made available to the portal user.

Text Message

Multi-factor authentication via SMS notifications can be used if some portal users own a smartphone.

Please note that you must create an account with "seven.io" (www.seven.io/de) to configure SMS. In the "seven.io" section, you'll find information about the provider as well as step-by-step instructions. You can find information on integrating alternative services in the section "Integrating Alternative Messaging Providers." You are also welcome to request assistance from our consultants (consulting@intrexx.com).

Structure of the SMS

To activate SMS, you must enter the following information using the "Configure" button:

  • Provider*: The provider is preset and cannot be changed

  • API Key*: Enter the required information for your SMS provider (e.g., messaging provider seven.io) in the Intrexx credentials store.

  • Sender's name: is described using 11 characters. If the sender's name is not stored, the phone number is used.

  • Message*: The message must include at least the placeholder for the verification code

*Required fields

API Key

When using the API key, you access the secure credential store in Intrexx. In the list, you can select an existing entry from the login information store.

Click "Select Login Information" at to open the dialog box for the login information store.

By clicking "Add Login Information" at , you can add a new entry using your SMS provider's API. Assign a unique name and enter the provider's API key in the "Password" field. Enter a description.

Use "OK" to apply the API key from the credentials store.

Sender's Name

The sender's name can be up to 11 characters long.

Message

Click "Add Placeholder" at to insert placeholders into the message. At least one placeholder for the verification code is required.

Placeholder

The following placeholders can be used:

Recommended: ${OTPFMT}

Formatted authentication code for an SMS message: The code consists of at least six digits and is displayed in groups of three or four (e.g., “123 456” or “1234 5678”).

${OTP}

Unformatted authentication code, consisting of six decimal digits by default (e.g., “123456”).

${OTPDIGIT[<i>]}

Digit of the authentication code, where <i> is the 0-based index of the digit in the authentication code (see example).

${OTPFMTSSML}

Definition of a formatted authentication code (digits separated by colons: 1:2:3:4:5:6)

${from}

Configured sender name, which may depend on the selected language.

${timestamp}

Time the message was created, in ISO-UTC format. The timestamp is 20 characters long, e.g., "2025-02-25T17:33:30Z".

If the maximum number of characters in an SMS is exceeded (usually 160 characters), providers respond in different ways:

Depending on the provider, the message is either automatically split into several consecutive text messages or the message is truncated.

This policy must be reviewed on a case-by-case basis with the respective provider. The character count in the SMS message dialog is based on the SMS standard of 160 characters.

Best Practice Example

Verification code at the beginning of the text message

If the verification code is placed at the very beginning of the text message, the recipient can often see it in the preview and use it right away without having to open the message completely:

Example using the variable ${OTPDIGIT[<i>]}

In this example, each variable represents a digit of the verification code. Please note that the placeholder is not provided via " " "Add Placeholder."

Multilingualism

In the text message, the sender and message can be entered in the portal languages. As usual, click on " " "Multilingualism" to enter multilingual text.

Enabling the Configuration

Once the configuration is complete, the service can be enabled by checking the checkbox and made available to the portal user.

Voice Call

Multi-factor authentication via a voice call is used when there are portal users who own a smartphone or a regular phone.

Please note that you must create an account with "seven.io" (www.seven.io/de) to set up voice call configuration. Please refer to the separate section on seven.io. You can request the integration of alternative services through our consulting department (consulting@intrexx.com).

Establishing a Voice Call

When configuring this service, enter the following information:

  • Provider*: The provider is preset

  • API Key*: Enter the required information for your SMS provider (e.g., seven.io) in the Intrexx credentials store.

  • Message*: Just as in the text message, you must enter at least the placeholder for the verification code

*Required fields

API Key

When using the API key, you access the secure credential store in Intrexx. In the list, you can select an existing entry from the login information store.

This will take you to the login information storage dialog. Click " " "Add Login Information" to add a new entry using your SMS provider's API. Assign a unique name and enter the provider's API key in the "Password" field. Enter a description.

Use "OK" to apply the API key from the credentials store.

Message

Click "Insert Placeholder" at to insert placeholders into the message. At least one placeholder for the verification code is required.

Placeholder

The following placeholders can be used:

${OTPFMT}

Formatted authentication code for voice message: The code consists of at least six digits. The numbers are separated by spaces (e.g., “1 2 3 4 5 6”).

${OTP}

Unformatted authentication code, consisting of six decimal digits by default (e.g., “123456”).

Recommended: ${OTPFMTSSML}

An authentication code formatted in SSML (Speech Synthesis Markup Language), in which the digits are separated by colons (e.g., “1:2:3:4:5:6”). This format is designed so that text-to-speech engines read each digit individually and clearly, rather than pronouncing them as a single compound number.

For more information about SSML, visit seven.io (https://docs.seven.io/de/rest-api/endpunkte/voice#ssml).

${OTPDIGIT[<i>]}

Digit of the authentication code, where <i> is the 0-based index of the digit in the authentication code (see example).

${timestamp}

Time the message was created, in ISO-UTC format.

The timestamp is 20 characters long, e.g., “2025-02-25T17:33:30Z”.

Best Practice Example

Example of a voice call in SSML 

<voice name="de-de-female" loop="2" loop-info="I repeat">
   Your verification code is: <break strength="medium" />
   <prosody rate="x-slow">
      <say-as interpret-as="number_digit"> ${OTPFMTSSML}</say-as>
   </prosody>
</voice>

Example using the variable ${OTPDIGIT[<i>]}

In this example, each variable represents a digit of the verification code.

Multilingualism

The voice message can be recorded in the portal's languages. Click the globe icon as usual to enter multilingual text.

Activating the Configuration

Once configuration is complete, the service can be enabled by selecting the "Enabled" setting and made available to the portal user.