Setup Two Factor Authentication
Enable Two Factor Authentication (2FA)
Activate two factor authentication by running the command.
bench --site [sitename] set-config enable_two_factor_auth true
Specify the following in System Settings
The method of OTP validation (OTP App = TOTP using Soft or Hard Token while Email/SMS = HOTP using Email or SMS
The expiry time for the QR Code on the server if OTP App is specified
The OTP Issuer Name.
On activation of 2FA from setup, it is also activated for the Role "All". In this way, all users including the Administrator have to perform a 2nd level authentication with a token. By unchecking the "Two Factor Authentication" checkbox in the "All" role and enabling it in other roles, the need to login with a token can be limited to specific roles. 2FA does not apply to login by Web Users and API login
If using SMS authentication, please make sure that your SMS settings are updated
If using Email, make sure that your outgoing Email account settings are updated
When the new user tries to log in for the first time in a system that has two-factor authentication enabled and which has the authentication option as OTP App, an email is sent containing a link to the QR Code.
Scanning the QR Code with an authentication app like Google Authenticator registers the access for the user and automatically starts to generate tokens that can be used to login
If either of Email/SMS is used as the authentication method, you get notifications also
Q. I am unable to login even after following entire process.
Ans: Frappe uses TOTP based OTP algorithm, which depends on your device's system time. Please make sure that device you're using has same time set as your Howinibs server.
Was this article helpful?Give Feedback.
Last updated
