Difference between revisions of "BMO/UserGuide/Two-Factor Authentication"

From MozillaWiki
< BMO‎ | UserGuide
Jump to: navigation, search
(Initial Draft)
 
(→‎Help! My phone has been destroyed: fix typo)
 
(14 intermediate revisions by 3 users not shown)
Line 1: Line 1:
−
BMO supports two either TOTP or Duo. Duo is only available for Mozilla employees, while TOTP is available to everyone.
+
== Bugzilla and Two-Factor Authentication ==
  
−
== TOTP Setup ==
+
[https://bugzilla.mozilla.org bugzilla.mozilla.org (BMO)] uses either
 +
[[#Configure_2FA:_TOTP_.28Google_Authenticator.29|TOTP]] or [[#Configure 2FA: Duo|Duo Security]] for Two-Factor authentication.
 +
Duo is only available for all Mozilla employees, while TOTP is available to everyone.
  
−
You need the following:
+
All Mozilla employees should use Duo Security where possible.
  
−
# You need a TOTP authenticator app, such as Google Authenticator ([https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8 iOS], [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android]) installed on a phone or tablet. There are authenticator programs available for desktop OSes, but doing this is '''not recommended'''. In this guide we'll say "device" instead of phone or device. '''Note''' the device does not need internet connectivity once the Authenticator app is installed.
+
It is also very import to generate [[#Generate Recovery Codes|Recovery Codes]]
−
# You should have a printer or a notepad to '''write down''' recovery codes.
+
and store them in a safe, offline location.
  
−
Once you have the above ready, it is time to enable 2FA.
+
== Configure 2FA: TOTP (Google Authenticator) ==
  
−
# Vist the [http://bugzilla.mozilla.org/userprefs.cgi?tab=mfa Two-Factor Authentication] page.
+
The following instruction will guide you through configuing 2FA using TOTP.
−
# Click the button labeled "Time-based One-Time Password (TOTP)"
+
This guide assumes that you're using Google Authenticator ([https://itunes.apple.com/us/app/google-authenticator/id388497605?mt=8 iOS], [https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2 Android]) installed on a phone or tablet. There are authenticator programs available for desktop OSes, but doing this is '''not recommended'''. It is also '''not recommended''' to use 1Password for TOTP (one-time passwords) if you also store your bugzilla password there because that defeats the purpose of two-factor authentication.
−
# You will now see a barcode. Pick up your device and open the authenticator app. There will be a screen with a button at the bottom labeled "Scan a barcode" -- choose that button.
 
−
# Aim the device's camera at the screen. As soon as it recognizes the barcode the camera view will disappear and you will see a six-digit number.  
 
−
# Back on the page, the barcode will still be displayed. There is a small text box below it, which is where you must enter that six digit code from the authenticator app. Enter that code quickly and click the "Submit Changes" button at the bottom of the page.
 
  
−
At this point you have 2FA enabled! Every time you log in, you will need to enter your password
+
Visit the [http://bugzilla.mozilla.org/userprefs.cgi?tab=mfa Two-Factor Authentication] page.
−
and also the six-digit code from the authenticator app.
 
  
−
Now, we must also establish '''Recovery Codes'''. Recovery Codes are longer codes that you may use
+
Click the button labeled "Time-based One-Time Password
−
if you lose your device. Each recovery code may only be used one time -- and they're really like an emergency failsafe.
+
(TOTP)"<br>https://i.imgur.com/rQSy4qYl.png
−
If you do not have recovery codes and you lose your device you might lose access to your account forever.
 
  
−
Recovery Codes can be created on the [http://bugzilla.mozilla.org/userprefs.cgi?tab=mfa Two-Factor Authentication]
+
You will now see a barcode.<br> http://i.imgur.com/AnjoUgOl.png
−
page at any time. If you've already created some but lose them, you can create them again (and the old ones will become useless).
 
  
−
== Duo Setup ==
+
Pick up your device and open the authenticator app. There will be a screen with
 +
a button at the bottom labeled "Begin Setup"
  
−
'''TODO'''
+
This is what you will see on your device. The screenshot is from an iPhone, but
 +
Android is similar.<br> https://i.imgur.com/oSZYKSvm.png
 +
 
 +
After "Begin Setup", the screen will give you two options: "Scan a barcode" or
 +
"Manual Entry". Choose "Scan a barcode"<br>https://i.imgur.com/AgfClWam.png
 +
 
 +
Now the device's camera is going to activate. Aim the camera at the barcode
 +
shown in the Bugzilla window is inside the square.
 +
 
 +
It will recognize the barcode pretty quickly -- providing the screenshot below
 +
was quite difficult.<br> https://i.imgur.com/gcN8dqRm.png
 +
 
 +
The authenticator app on your device should now be displaying a six digit
 +
code<br> https://i.imgur.com/jwntvbXm.png
 +
 
 +
On the page showing the barcode, you must enter your current password and the
 +
six digit code displayed on your device.
 +
 
 +
The password field is above the barcode, and field for the six digit code is
 +
below. <br> https://i.imgur.com/XZ3VmNll.png
 +
 
 +
Now enter that six digit code into the text box under the barcode.
 +
 
 +
After the password and code are entered, you must click "Submit Changes"
 +
 
 +
If nothing went wrong, it is now time to create recovery codes. If something
 +
went wrong, consult the FAQ at the end of this guide.
 +
 
 +
It is time to create [#Recovery Codes]
 +
 
 +
== Configure 2FA: Duo ==
 +
 
 +
The following instruction will guide you through configuing 2FA using Duo.
 +
Duo is only available to Mozilla employees at this time.
 +
 
 +
First, You must be [https://mana.mozilla.org/wiki/display/SD/DuoSecurity enrolled with Duo Security via login.mozilla.com] before you can use Duo 2FA.
 +
 
 +
In addition to the app, you will need to know what your Duo username is -- this is your LDAP email
 +
which might not be the same (and does not have to be) as your Bugzilla email ("bugmail").
 +
 
 +
Visit the [http://bugzilla.mozilla.org/userprefs.cgi?tab=mfa Two-Factor Authentication] page,
 +
and click the button labeled "Duo Security" <br>
 +
https://i.imgur.com/QFtqu8dl.png
 +
 
 +
Now you'll see two text fields. The first is for your current password,
 +
and the second one is the username you use for Duo -- your LDAP email.<br>
 +
https://i.imgur.com/gnSb5QUl.png
 +
 
 +
After filling in those forms and clicking "Submit Changes", you will encounter the typical Duo authentication screen,
 +
similar to the one that you get when logging into other Mozilla services.
 +
 
 +
== Generate Recovery Codes ==
 +
 
 +
Recovery Codes are special codes
 +
that can be used instead of the codes generated by Google Authenticator on your
 +
device -- but they are longer (10 digits) and each code may only be used once.
 +
 
 +
Recovery codes are important if you lose your device, they're an emergency
 +
failsafe. If you do not have recovery codes and you lose your device you might
 +
lose access to your account forever.
 +
 
 +
Visit the [http://bugzilla.mozilla.org/userprefs.cgi?tab=mfa Two-Factor Authentication] page.
 +
Assuming that you're using 2FA, you will see a screen that looks something like the following<br>
 +
https://i.imgur.com/zAqQnMll.png
 +
 
 +
Click on "Generate Printable Recovery Codes".
 +
You'll be taken to a page and required to re-authenticate using both your password and your second factor (either Duo or TOTP).
 +
Continuing through that, you'll get something like this:<br>
 +
https://i.imgur.com/UvDyXJhm.png
 +
 
 +
If possible, you should print those codes out. If printing is not an option,
 +
write them down. In either case, it is important to keep them in a safe place -- and not on your computer.
 +
There are ten codes, and each code can be used once instead of your authenticator -- and typically you would use them to disable and re-enable 2FA in the event you lose your authenticator device.
 +
 
 +
== FAQ ==
 +
 
 +
=== I'm using Duo and all I see is a white box ===
 +
 
 +
Check your browser addons -- it's possible that some extension is blocking Duo.
 +
 
 +
=== I'm using TOTP and my code doesn't work ===
 +
 
 +
# Make sure time on your computer is correct. If your computer's clock is off, it will prevent TOTP from working.
 +
# Make sure you're using the right code generator -- if you're using TOTP you will *not* be using the Duo app, for instance.
 +
 
 +
=== Help! My phone has been destroyed ===
 +
 
 +
This is why you must generate and store [[#Generate Recovery Codes|Recovery Codes]]! If you did, you can use
 +
one of those Recovery codes to disable 2FA and re-enable it on a new device.
 +
 
 +
If you lose both your recovery codes and your device:
 +
 
 +
* If you're a Mozilla employee, contact Service Desk
 +
* If you're a community member, email bugzilla-admin [at] mozilla.org.
 +
 
 +
In either case, you will need to provide sufficient evidence of your identity.

Latest revision as of 16:09, 24 November 2022

Bugzilla and Two-Factor Authentication

bugzilla.mozilla.org (BMO) uses either TOTP or Duo Security for Two-Factor authentication. Duo is only available for all Mozilla employees, while TOTP is available to everyone.

All Mozilla employees should use Duo Security where possible.

It is also very import to generate Recovery Codes and store them in a safe, offline location.

Configure 2FA: TOTP (Google Authenticator)

The following instruction will guide you through configuing 2FA using TOTP. This guide assumes that you're using Google Authenticator (iOS, Android) installed on a phone or tablet. There are authenticator programs available for desktop OSes, but doing this is not recommended. It is also not recommended to use 1Password for TOTP (one-time passwords) if you also store your bugzilla password there because that defeats the purpose of two-factor authentication.

Visit the Two-Factor Authentication page.

Click the button labeled "Time-based One-Time Password (TOTP)"
rQSy4qYl.png

You will now see a barcode.
AnjoUgOl.png

Pick up your device and open the authenticator app. There will be a screen with a button at the bottom labeled "Begin Setup"

This is what you will see on your device. The screenshot is from an iPhone, but Android is similar.
oSZYKSvm.png

After "Begin Setup", the screen will give you two options: "Scan a barcode" or "Manual Entry". Choose "Scan a barcode"
AgfClWam.png

Now the device's camera is going to activate. Aim the camera at the barcode shown in the Bugzilla window is inside the square.

It will recognize the barcode pretty quickly -- providing the screenshot below was quite difficult.
gcN8dqRm.png

The authenticator app on your device should now be displaying a six digit code
jwntvbXm.png

On the page showing the barcode, you must enter your current password and the six digit code displayed on your device.

The password field is above the barcode, and field for the six digit code is below.
XZ3VmNll.png

Now enter that six digit code into the text box under the barcode.

After the password and code are entered, you must click "Submit Changes"

If nothing went wrong, it is now time to create recovery codes. If something went wrong, consult the FAQ at the end of this guide.

It is time to create [#Recovery Codes]

Configure 2FA: Duo

The following instruction will guide you through configuing 2FA using Duo. Duo is only available to Mozilla employees at this time.

First, You must be enrolled with Duo Security via login.mozilla.com before you can use Duo 2FA.

In addition to the app, you will need to know what your Duo username is -- this is your LDAP email which might not be the same (and does not have to be) as your Bugzilla email ("bugmail").

Visit the Two-Factor Authentication page, and click the button labeled "Duo Security"
QFtqu8dl.png

Now you'll see two text fields. The first is for your current password, and the second one is the username you use for Duo -- your LDAP email.
gnSb5QUl.png

After filling in those forms and clicking "Submit Changes", you will encounter the typical Duo authentication screen, similar to the one that you get when logging into other Mozilla services.

Generate Recovery Codes

Recovery Codes are special codes that can be used instead of the codes generated by Google Authenticator on your device -- but they are longer (10 digits) and each code may only be used once.

Recovery codes are important if you lose your device, they're an emergency failsafe. If you do not have recovery codes and you lose your device you might lose access to your account forever.

Visit the Two-Factor Authentication page. Assuming that you're using 2FA, you will see a screen that looks something like the following
zAqQnMll.png

Click on "Generate Printable Recovery Codes". You'll be taken to a page and required to re-authenticate using both your password and your second factor (either Duo or TOTP). Continuing through that, you'll get something like this:
UvDyXJhm.png

If possible, you should print those codes out. If printing is not an option, write them down. In either case, it is important to keep them in a safe place -- and not on your computer. There are ten codes, and each code can be used once instead of your authenticator -- and typically you would use them to disable and re-enable 2FA in the event you lose your authenticator device.

FAQ

I'm using Duo and all I see is a white box

Check your browser addons -- it's possible that some extension is blocking Duo.

I'm using TOTP and my code doesn't work

  1. Make sure time on your computer is correct. If your computer's clock is off, it will prevent TOTP from working.
  2. Make sure you're using the right code generator -- if you're using TOTP you will *not* be using the Duo app, for instance.

Help! My phone has been destroyed

This is why you must generate and store Recovery Codes! If you did, you can use one of those Recovery codes to disable 2FA and re-enable it on a new device.

If you lose both your recovery codes and your device:

  • If you're a Mozilla employee, contact Service Desk
  • If you're a community member, email bugzilla-admin [at] mozilla.org.

In either case, you will need to provide sufficient evidence of your identity.

Retrieved from "https://wiki.mozilla.org/index.php?title=BMO/UserGuide/Two-Factor_Authentication&oldid=1244714"