Engineering / ENG-1431
MFA for administrators
Description
Shaped in Emargen: MFA for administrators. Product page: the MFA for administrators spec in PROD.
Why
An administrator can change who may open what for a whole organisation. A password alone is not enough. Marlow Cold Chain asked for it (SUP-834), and every security questionnaire asks.
What we build
- Every administrator who signs in with a password uses a second factor: a code from an authenticator app (TOTP).
- From 11 June, an administrator without it is asked to set it up at their next sign-in and can't continue until they have.
- Ten recovery codes, shown once at set-up.
- If an administrator loses their phone, another administrator of the organisation resets their MFA; if there is no other, ACME support does it after checking with the customer's sponsor.
- Administrators who sign in through Entra ID or Okta use their company's MFA. We don't add a second one.
Not in this epic
- SMS as a second factor. Hardware keys. MFA for everyone.
Done when
No administrator signs in with a password alone.
Child issues
- ENG-1432 Administrators who sign in with a password set up an authenticator app Done
- ENG-1433 Portal: set-up screen with QR code and recovery codes Done
- ENG-1434 An administrator can reset another administrator's MFA Done
- ENG-1435 Enforcement date, an email a week before, and a banner Done
- ENG-1473 Require MFA enrolment before an administrator's first token Done
- ENG-1481 Recovery codes can be used twice Done
- ENG-1483 TOTP codes refused when the phone's clock is 40 s off Done
Linked issues
- is duplicated by ENG-1362 Marlow: require a second factor for administrators Closed
- relates to OPS-32 Administrators at single sign-on clients stuck at authenticator set-up Done
- relates to SUP-834 Marlow: MFA for portal administrators Done
- relates to ENG-1491 Administrators at single sign-on depots asked to set up an authenticator Done
Required since 09:00. 112 administrators set it up today. Administrators at single sign-on clients were asked to enrol by mistake this morning (OPS-32), fixed at 10:31. Closing.