Registration/2FA - Revision history

S Braun: /* Token Management */

2026-04-21T13:28:23Z

Token Management

← Older revision		Revision as of 15:28, 21 April 2026
Line 69:		Line 69:
	To activate the second factor, '''please perform the following steps:'''		To activate the second factor, '''please perform the following steps:'''

	1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> → [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 2.0''', '''bwForCluster JUSTUS 2''' and '''bwForCluster NEMO 2'''] (2FA tokens are valid for all three clusters; KIT members can reuse their existing hardware and software tokens)</br> → [https://bwservices.uni-heidelberg.de/user/twofa.xhtml Registration server for '''bwForCluster Helix''']		1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> → [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 3.0''', '''bwForCluster JUSTUS 2''' and '''bwForCluster NEMO 2'''] (2FA tokens are valid for all three clusters; KIT members can reuse their existing hardware and software tokens)</br> → [https://bwservices.uni-heidelberg.de/user/twofa.xhtml Registration server for '''bwForCluster Helix''']
	[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]		[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]

M Janczyk: /* Token Management */

2025-06-30T12:58:46Z

Token Management

← Older revision		Revision as of 14:58, 30 June 2025
Line 72:		Line 72:
	[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]		[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]

	2. '''Register a new "[[Registration/2FA#Registering_a_new_Software_Token_using_a_Mobile_APP\|Smartphone Token]]"''' or if you own a [https://www.yubico.com/ Yubikey]''' register a new "[[Registration/2FA#Registering_a_new_Yubikey_OTP_Token\|Yubikey Token]]"''' or '''"[[Registration/2FA#Registering_a_new_Yubikey_OATH_TOTP_Token\|Yubikey OATH TOTP Token]]"''' ~~([[Registration/2FA#Pros_and_Cons_of_the_different_Solutions\|pros ans cons]])~~.		2. '''Register a new "[[Registration/2FA#Registering_a_new_Software_Token_using_a_Mobile_APP\|Smartphone Token]]"''' or if you own a [https://www.yubico.com/ Yubikey]''' register a new "[[Registration/2FA#Registering_a_new_Yubikey_OTP_Token\|Yubikey Token]]"''' or '''"[[Registration/2FA#Registering_a_new_Yubikey_OATH_TOTP_Token\|Yubikey OATH TOTP Token]]"'''.

	3. '''Register a new "[[Registration/2FA#Backup_TAN_List\|TAN List]]" (backup TAN list)'''.		3. '''Register a new "[[Registration/2FA#Backup_TAN_List\|TAN List]]" (backup TAN list)'''.

M Janczyk at 13:14, 4 March 2025

2025-03-04T13:14:35Z

← Older revision		Revision as of 15:14, 4 March 2025
Line 69:		Line 69:
	To activate the second factor, '''please perform the following steps:'''		To activate the second factor, '''please perform the following steps:'''

	1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> → [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 2.0''', '''bwForCluster JUSTUS 2''' and '''bwForCluster NEMO'''] (2FA tokens are valid for all three clusters; KIT members can reuse their existing hardware and software tokens)</br> → [https://bwservices.uni-heidelberg.de/user/twofa.xhtml Registration server for '''bwForCluster Helix''']		1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> → [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 2.0''', '''bwForCluster JUSTUS 2''' and '''bwForCluster NEMO 2'''] (2FA tokens are valid for all three clusters; KIT members can reuse their existing hardware and software tokens)</br> → [https://bwservices.uni-heidelberg.de/user/twofa.xhtml Registration server for '''bwForCluster Helix''']
	[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]		[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]

Line 108:		Line 108:
	The exact process is a little bit different in every app, but is usually started by pressing on a button with a plus (+) sign or an icon of a QR code.		The exact process is a little bit different in every app, but is usually started by pressing on a button with a plus (+) sign or an icon of a QR code.

	5. Once the QR code has been loaded into your Software Token app there should be a new entry called '''bwIDM''' (bwUniCluster, JUSTUS 2 and ~~NEMO~~) or '''bwServices''' (Helix).		5. Once the QR code has been loaded into your Software Token app there should be a new entry called '''bwIDM''' (bwUniCluster, JUSTUS 2 and NEMO2) or '''bwServices''' (Helix).
	Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item.		Generate an One-Time-Password by pressing on this entry or selecting the appropriate button/menu item.
	You will receive a six-digit code.		You will receive a six-digit code.

H Winkhardt at 14:01, 3 February 2025

2025-02-03T14:01:11Z

← Older revision		Revision as of 16:01, 3 February 2025
Line 249:		Line 249:

	'''If you no longer have valid tokens (mobile app, hardware token, Yubikey or backup TAN, i.e. lost or broken smartphone), you can not access the section "My Tokens" anymore.		'''If you no longer have valid tokens (mobile app, hardware token, Yubikey or backup TAN, i.e. lost or broken smartphone), you can not access the section "My Tokens" anymore.
	In this case you will need to contact the [https://~~bw-support~~.~~scc~~.~~kit.edu~~/ ticket system].'''		In this case you will need to contact the [https://www.bwhpc.de/supportportal ticket system].'''
	Open a ticket, include your user name, the name of the bwHPC cluster and ask for a reset of your 2FA tokens.		Open a ticket, include your user name, the name of the bwHPC cluster and ask for a reset of your 2FA tokens.
	Please note that this process may take some time and also means additional work for the operators.		Please note that this process may take some time and also means additional work for the operators.

R Keller: /* How 2FA works on the bwHPC Clusters */

2025-01-20T11:07:20Z

How 2FA works on the bwHPC Clusters

← Older revision		Revision as of 13:07, 20 January 2025
Line 40:		Line 40:
	The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:		The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:
	* 2FAS for [https://play.google.com/store/apps/details?id=com.twofasapp Android] or [https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794 iOS] ([https://2fas.com/ Web Page] and [https://github.com/twofas GitHub], ''Apple and Google Cloud can be used for backups depending on the operating system.'')		* 2FAS for [https://play.google.com/store/apps/details?id=com.twofasapp Android] or [https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794 iOS] ([https://2fas.com/ Web Page] and [https://github.com/twofas GitHub], ''Apple and Google Cloud can be used for backups depending on the operating system.'')
	* Open Source FreeOTP on [https://f-droid.org/en/packages/org.fedorahosted.freeotp/ F-Droid], [https://play.google.com/store/search?q=freeotp Android] or [https://apps.apple.com/de/app/freeotp-authenticator/id872559395 iOS] with a possibility of local backup files.		* Open Source FreeOTP ([https://github.com/freeotp GitHub]) on [https://f-droid.org/en/packages/org.fedorahosted.freeotp/ F-Droid], [https://play.google.com/store/search?q=freeotp Android] or [https://apps.apple.com/de/app/freeotp-authenticator/id872559395 iOS] with a possibility of local backup files.
	* Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS] (''Google Cloud can be used for backups, but these backups are not encrypted and can therefore be read by Google!'')		* Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS] (''Google Cloud can be used for backups, but these backups are not encrypted and can therefore be read by Google!'')
	* Microsoft Authenticator for [https://play.google.com/store/apps/details?id=com.azure.authenticator Android] or [https://apps.apple.com/de/app/microsoft-authenticator/id983156458 iOS] ([https://www.microsoft.com/de-de/security/mobile-authenticator-app Web Page])		* Microsoft Authenticator for [https://play.google.com/store/apps/details?id=com.azure.authenticator Android] or [https://apps.apple.com/de/app/microsoft-authenticator/id983156458 iOS] ([https://www.microsoft.com/de-de/security/mobile-authenticator-app Web Page])

R Keller: /* How 2FA works on the bwHPC Clusters */ Add FreeOTP

2025-01-20T11:04:26Z

How 2FA works on the bwHPC Clusters: Add FreeOTP

← Older revision		Revision as of 13:04, 20 January 2025
Line 40:		Line 40:
	The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:		The most common solution is to use a mobile device (e.g. your smartphone or tablet) as a Software Token by installing one of the following apps:
	* 2FAS for [https://play.google.com/store/apps/details?id=com.twofasapp Android] or [https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794 iOS] ([https://2fas.com/ Web Page] and [https://github.com/twofas GitHub], ''Apple and Google Cloud can be used for backups depending on the operating system.'')		* 2FAS for [https://play.google.com/store/apps/details?id=com.twofasapp Android] or [https://apps.apple.com/us/app/2fa-authenticator-2fas/id1217793794 iOS] ([https://2fas.com/ Web Page] and [https://github.com/twofas GitHub], ''Apple and Google Cloud can be used for backups depending on the operating system.'')
			* Open Source FreeOTP on [https://f-droid.org/en/packages/org.fedorahosted.freeotp/ F-Droid], [https://play.google.com/store/search?q=freeotp Android] or [https://apps.apple.com/de/app/freeotp-authenticator/id872559395 iOS] with a possibility of local backup files.
	* Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS] (''Google Cloud can be used for backups, but these backups are not encrypted and can therefore be read by Google!'')		* Google Authenticator for [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android] or [https://apps.apple.com/de/app/google-authenticator/id388497605 iOS] (''Google Cloud can be used for backups, but these backups are not encrypted and can therefore be read by Google!'')
	* Microsoft Authenticator for [https://play.google.com/store/apps/details?id=com.azure.authenticator Android] or [https://apps.apple.com/de/app/microsoft-authenticator/id983156458 iOS] ([https://www.microsoft.com/de-de/security/mobile-authenticator-app Web Page])		* Microsoft Authenticator for [https://play.google.com/store/apps/details?id=com.azure.authenticator Android] or [https://apps.apple.com/de/app/microsoft-authenticator/id983156458 iOS] ([https://www.microsoft.com/de-de/security/mobile-authenticator-app Web Page])

H Schumacher: Removed '/' in link. The link now leads to the OTP check instead of skipping it. The latter led to problems.

2024-09-27T14:56:56Z

Removed '/' in link. The link now leads to the OTP check instead of skipping it. The latter led to problems.

← Older revision		Revision as of 16:56, 27 September 2024
Line 68:		Line 68:
	To activate the second factor, '''please perform the following steps:'''		To activate the second factor, '''please perform the following steps:'''

	1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> → [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 2.0''', '''bwForCluster JUSTUS 2''' and '''bwForCluster NEMO'''] (2FA tokens are valid for all three clusters; KIT members can reuse their existing hardware and software tokens)</br> → [https://bwservices.uni-heidelberg.de//user/twofa.xhtml Registration server for '''bwForCluster Helix''']		1. '''Select the registration server of the cluster''' for which you want to create a second factor and login to it:</br> → [https://login.bwidm.de/user/twofa.xhtml Registration server for '''bwUniCluster 2.0''', '''bwForCluster JUSTUS 2''' and '''bwForCluster NEMO'''] (2FA tokens are valid for all three clusters; KIT members can reuse their existing hardware and software tokens)</br> → [https://bwservices.uni-heidelberg.de/user/twofa.xhtml Registration server for '''bwForCluster Helix''']
	[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]		[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]

M Janczyk: /* How 2FA works on the bwHPC Clusters */

2024-01-30T09:18:17Z

How 2FA works on the bwHPC Clusters

← Older revision		Revision as of 11:18, 30 January 2024
Line 16:		Line 16:
	* The Pros and Cons of the various solutions can be found in this [[Registration/2FA/ProCon\|wiki]].		* The Pros and Cons of the various solutions can be found in this [[Registration/2FA/ProCon\|wiki]].

	== How 2FA works on the bwHPC Clusters ==		= How 2FA works on the bwHPC Clusters =

	{\|style="background:#deffee; width:100%;"		{\|style="background:#deffee; width:100%;"

M Janczyk: /* Generate a Second Factor (2FA) */

2024-01-30T09:17:47Z

Generate a Second Factor (2FA)

← Older revision		Revision as of 11:17, 30 January 2024
Line 11:		Line 11:

	If you only have a mobile device, you can use software-based solutions as a second factor. If you don't want to use a smartphone app, we recommend using a hardware token such as Yubikey.		If you only have a mobile device, you can use software-based solutions as a second factor. If you don't want to use a smartphone app, we recommend using a hardware token such as Yubikey.

	== FAQ, Pros and Cons ==

	* If you have any questions about 2FA, please read the [[Registration/2FA/FAQ\|FAQs]], and if your question remains unanswered, please submit a support ticket.		* If you have any questions about 2FA, please read the [[Registration/2FA/FAQ\|FAQs]], and if your question remains unanswered, please submit a support ticket.

M Janczyk at 13:53, 26 January 2024

2024-01-26T13:53:37Z

← Older revision		Revision as of 15:53, 26 January 2024
Line 253:		Line 253:
	Open a ticket, include your user name, the name of the bwHPC cluster and ask for a reset of your 2FA tokens.		Open a ticket, include your user name, the name of the bwHPC cluster and ask for a reset of your 2FA tokens.
	Please note that this process may take some time and also means additional work for the operators.		Please note that this process may take some time and also means additional work for the operators.


	= Pros and Cons of the different Solutions =

	This section briefly describes the differences between the above solutions.

	== Mobile App ==

	This sections describes the pros and cons of an app on your mobile device (phone or tablet).

	'''Pros:'''
	* Can be used at no extra cost if you have a mobile device.
	* When using your cell phone, you always have the second factor at your fingertips.

	'''Cons:'''
	* You need a mobile device.
	* If your device is lost or damaged, you will lose your second factor. (''Some services offer cloud synchronization, but you usually need an account and Google Authenticator does not encrypt your TOTP secret keys when storing them in the cloud.'')

	== Yubico OTP ==

	This sections describes the pros and cons of Yubico OTP. For Yubico OTP to work, you need a Yubikey with Yubico OTP support.

	'''Pros:'''
	* You do not need a mobile device. All you need is a USB port.
	* Simple and fast: The Yubikeys are preconfigured for Yubico OTP. All you need to do is touch the metal plate on the device when prompted.

	'''Cons:'''
	* You have to spend money on a Yubikey.
	* If you lose the device, you will lose the second factor (it is recommended to buy at least two Yubikeys).
	* If you do not have your Yubikey with you, you cannot log in to the clusters.
	* In bwHPC, the Yubicloud is used to synchronize the Yubico OTP keys (third-party provider).

	== Yubikey OATH TOTP ==

	This sections describes the pros and cons of Yubikey OATH TOTP. For Yubikey OATH TOTP to work, you need a Yubikey with OATH TOTP support. This solution is similar to the one for mobile apps, but an external pin generator is used.

	'''Pros:'''
	* You do not need a mobile device. All you need is a USB port.
	* You can use multiple devices such as phones and tablets (via USB, Lightning or NFC) or even your computer(s).
	* Since the TOTP is calculated on the Yubikey and the computer/mobile device is only used for displaying the TOTP and time synchronization, you can use the same device you use for login.

	'''Cons:'''
	* You have to spend money on a Yubikey.
	* If you lose the device, you will lose the second factor (it is recommended to buy at least two Yubikeys).
	* If you do not have your Yubikey with you, you cannot log in to the clusters.

← Older revision		Revision as of 14:58, 30 June 2025
Line 72:		Line 72:
	[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]		[[File:BwIDM-twofa.png\|center\|600px\|thumb\|My Tokens]]

	2. '''Register a new "[[Registration/2FA#Registering_a_new_Software_Token_using_a_Mobile_APP\|Smartphone Token]]"''' or if you own a [https://www.yubico.com/ Yubikey]''' register a new "[[Registration/2FA#Registering_a_new_Yubikey_OTP_Token\|Yubikey Token]]"''' or '''"[[Registration/2FA#Registering_a_new_Yubikey_OATH_TOTP_Token\|Yubikey OATH TOTP Token]]"''' ~~([[Registration/2FA#Pros_and_Cons_of_the_different_Solutions\|pros ans cons]])~~.		2. '''Register a new "[[Registration/2FA#Registering_a_new_Software_Token_using_a_Mobile_APP\|Smartphone Token]]"''' or if you own a [https://www.yubico.com/ Yubikey]''' register a new "[[Registration/2FA#Registering_a_new_Yubikey_OTP_Token\|Yubikey Token]]"''' or '''"[[Registration/2FA#Registering_a_new_Yubikey_OATH_TOTP_Token\|Yubikey OATH TOTP Token]]"'''.

	3. '''Register a new "[[Registration/2FA#Backup_TAN_List\|TAN List]]" (backup TAN list)'''.		3. '''Register a new "[[Registration/2FA#Backup_TAN_List\|TAN List]]" (backup TAN list)'''.