Skip to main content

MATH & DM3L

MFA (Multi Factor Authentication) enhances security by requiring you to enter a code (= a second factor, 2-Factor-Authentication/2FA). It is much harder to phish this code in addition to just your normal password.

The way you obtain this second factor code is what differentiates second factor methods.

Do this: Configure the same TOTP token in KeepassXC and an additional authenticator app. Also generate recovery codes, save them to KeepassXC as well. If you want, enable your imath account's email as a second factor as well. This can all be done at http://login.math.uzh.ch

See below for precise instructions. You got this!

Two-factor authentication

We use a centralized authentication server https://login.math.uzh.ch/ to manage MFA configuration for every I-MATH account. Our recommendation:

  1. Sign in to https://login.math.uzh.ch/
  2. Create an initial setup
  3. Once logged in, add at least one more authentication method.

See below for more details and screenshots.

Types of second factors

TOTP (Time-based One Time Passwords)
  • Codes are generated locally by a user's device (an authenticator app on a phone, KeePassXC, in-browser extension).
  • A new code is generated every 30 seconds.
  • Configuring TOTP requires to share a secret data between the server and the device: either by copying it directly or by scanning a QR code
Email codes
  • Codes are sent by the server to user's email and are valid several minutes. Only the last email's code is valid.
  • This method requires access to the email account.
Recovery (static) codes
  • A set of codes (usually 6) is shared between user and the server.
  • No expiration time.
  • Not practical for every day use, but can be treated as a backup method.

The web panel

This is the most user-friendly way to configure second factor and the only one to manage them later.

  1. Please login to https://login.math.uzh.ch/. If no MFA device is configured yet, the page asks to configure one.

|| authentik-login.png || authentik-configure-mfa.png ||

  1. Otherwise, the most recently used method is selected as the second factor, but a different method can be selected.

|| authentik-mfa-challenge.png || authentik-select-mfa.png ||

  1. Once logged-in you can create new MFA methods or delete those already configured.
    • authentik-setup-mfa.png

Some points to consider:

  • Only one email-base MFA can be configured and it uses the email assigned to the account.
  • We recommend configuring only one TOTP, across several devices (by copying the code to e.g. KeepassXC and scanning the QR code with MS Authenticator).
  • (Althgouth several TOTPs can be configured and any code is accepted currently, we're unsure if this is intentional and suspect it might change.)

SSH: terminal

The second factor is checked by SSH connections. If no second factor is configured yet, you will have a chance to configure one.

Note 1: You can select any text with a mouse and copy to the clipboard with Ctrl+Shift+C.

Note 2: Press Ctrl+C to cancel the authentication at any step.

  1. Recovery codes:
    • mfa-ssh-setup-recovery-codes.png
  2. TOTP: copy the secret to your authenticator (such as KeePassXC)
    • mfa-ssh-setup-totp.png
  3. Email: the email assigned to your account will be used
    • mfa-ssh-setup-email.png

If second factor is already configured, you can use a code from any method. Type email to request an email code - an email is sent automatically only when it is the only method. mfa-ssh-challenge.png

Entering an invalid code does not break the authentication process: you will be given another chance to enter a correct code.

SSH/ThinLinc: GUI client

The authentication process is the same when a GUI client like !ThinLinc client is used. However, this method is least friendly for the initial configuration: the displayed text cannot be copied. Because of this we suggest other ways to configure the MFA initially.

1. Please login over ssh or with !ThinLinc. If no MFA device is configured yet, a selection of options is shown.

  • mfa-tl-login.png mfa-tl-choose-setup.png

2. The easiest one to configure is email, but all three choices are possible:

  • mfa-tl-setup-totp.png mfa-tl-setup-recovery-codes.png mfa-tl-setup-email.png

3. If the second factor is configured, a list of methods is shown and you can use a code from any of them. Type email to request an email code - an email is sent automatically only when it is the only method.

  • mfa-tl-login.png mfa-tl-challenge.png mfa-tl-email-challenge.png

Problems

I cannot configure email codes

Please contact us on support@math.uzh.ch . Possible causes:

  1. There is another account this with email configured as a second factor. This usually happens to secondary accounts only.
  2. You have already started to configure the email, but the address has not been verified. Your MFA configuration must be cleaned.

I have lost access to my device and cannot sign in anymore

Please contact us - we will generate a short-living one-time URL to let you access your account and reconfigure MFA.

I'm stuck at "Something went wrong! Please try again later."

This usually happens when you try to configure an email-based MFA for an email that is already in use. You have to delete cookies in your browser that are associated with the domain login.math.uzh.ch, then try to use another method as a second factor.

Back to top