Payroll Password and 2FA

Where Two Factor Authentication is enabled via the 00-2FA parameter, the Payroll Password form now also prompts for the 2FA code when logging into a Payroll secured area. Successfully entering the 2FA code in combination with the Payroll password will allow the user to access Payroll areas for the current login session.

If the 2FA parameter is turned on and the user is not set to use 2FA, then an error message will be displayed asking the user to contact the System Administrator.

If the 2FA parameter is turned off, the payroll password behaviour remains unchanged.

Enable Two Factor Authentication for a user

After turning on Two Factor Authentication at the database level, each user requiring access to Payroll will need to be configured separately from within User Security. Please ensure the email address is correct on the Resource record before enabling 2FA.

MenuBar > Security > Maintain User Security > Modify User > Enable Two Factor Authentication

Once configured, an email is sent to the User with instructions on how to set up 2FA on a mobile or other device. The email also contains the Secret (barcode/key) which is used to generate the Authentication Code. The Secret is encrypted and stored against the Resource record.

If a new Secret is required for a User, select ‘Resend Two Factor Authentication Email’ from User Security. This will invalidate the previous Secret sent for that User as well as the Authentication Code generated from that Secret.

MenuBar > Security > Maintain User Security > Modify User > Resend Two Factor Authentication Email

If 2FA is no longer required for a User, select ‘Remove’ from User Security. This will invalidate the previous Secret sent for that User as well as the Authentication Code generated from that Secret.

MenuBar > Security > Maintain User Security > Modify User > Remove