Limitations of Multi-Factor Authentication

Users – Security Policies: Maximum Number of Login Attempts

In the security policies of User Management (Main Menu: "Users / Configuration / Security / Security Policies"), you can set the maximum number of failed login attempts. Please note that this setting does not apply when using multi-factor authentication. The tokens can still be entered as many times as you like.

Allowed Authentication Type

In Intrexx User Management, you can define settings for logging in to the portal in the user configuration (main menu: "Users / Configuration / Authentication").

Please note that multi-factor authentication can only be used with Intrexx authentication.

This affects the binding of the following systems:

• Web

• Client

• Web Services

• OData

• WebDAV

Incompatibilities with Multi-Factor Authentication

The following services cannot be performed using multi-factor authentication:

• Data Transfer

• Admin API

• iOS App

• Android App

User Self-Service App

When using the User Self Service app, you should no longer use the "Forgot Password" feature.

If the "Forgot Password" feature has been enabled, the portal user's currently configured authentication method will be completely deleted.

This behavior is therefore comparable to the behavior described in "Situation 2: Authentication Type Is Permanently Disabled. " This means that the portal user must reconfigure their multi-factor authentication.

The User Self-Service app should be updated to the latest version in connection with the use of multi-factor authentication.

Authentication via a Custom Login Implementation

If you use customized implementations for web login (getlogin.vm or similar) and use $AuthProxy in Velocity, you may need to make some adjustments.

The following classes have been modified

• de.uplanet.lucy.server.auxiliaries.AuthProxy.login(ISession, String, Map<String, String>) now returns a map instead of a string.

• A separate function (de.uplanet.lucy.server.auxiliaries.AuthProxy.loginAnonymous(ISession, String)) is now provided for explicitly logging in the anonymous user.

The following classes have been removed

• de.uplanet.lucy.server.auxiliaries.AuthProxy#isPasswordAcceptable(java.lang.String)

• de.uplanet.lucy.server.auxiliaries.AuthProxy#getChallenge(de.uplanet.lucy.server.connector.IServerBridgeRequest, java.lang.String, java.lang.String, boolean)

• de.uplanet.lucy.server.auxiliaries.AuthProxy#invalidateChallenge(java.lang.String)

• de.uplanet.lucy.server.auxiliaries.AuthProxy#fakeChallenge(java.lang.String, java.lang.String)