Zimbra Two-Factor Authentication - Revision history

Benjii: /* How to revoke trusted computer/device */

2022-06-02T02:31:07Z

How to revoke trusted computer/device

← Older revision		Revision as of 20:31, 1 June 2022
Line 104:		Line 104:
	You can easily revoke a trusted computer/device in Settings > Accounts > Select "Primary" Account > Trusted Devices found in your Zimbra webmail. Revoke trust for any selected device by clicking "revoke this device" link or get rid of them all by clicking on "revoke all other devices" link.		You can easily revoke a trusted computer/device in Settings > Accounts > Select "Primary" Account > Trusted Devices found in your Zimbra webmail. Revoke trust for any selected device by clicking "revoke this device" link or get rid of them all by clicking on "revoke all other devices" link.

	[[file:~~RevokeTrust~~.png]]		[[file:2FA-06-Setup-Successful.png]]

	=='''Application Passcode'''==		=='''Application Passcode'''==

Benjii at 22:42, 6 May 2022

2022-05-06T22:42:22Z

Show changes

Jab: /* How to Install and Configure an OTP smartphone app */

2020-12-17T01:50:56Z

How to Install and Configure an OTP smartphone app

← Older revision		Revision as of 19:50, 16 December 2020
Line 40:		Line 40:
	In this example, we use Google authenticator, but please visit the Zimbra Wiki where you can find other options.		In this example, we use Google authenticator, but please visit the Zimbra Wiki where you can find other options.

	===In the App Store or Play Store, search by Google authenticator, then click Install.~~===~~		=== Google Authenticator ===
			In the App Store or Play Store, search by Google authenticator, then click Install.

	[[File:OTP1.png\|200px\| Image (c) Zimbra]]		[[File:OTP1.png\|200px\| Image (c) Zimbra]]

	~~===~~Once the app is installed, open it, and click Begin Setup.~~===~~		'''Once the app is installed, open it, and click Begin Setup.'''

	[[File:OTP2.png\|200px\| Image (c) Zimbra]]		[[File:OTP2.png\|200px\| Image (c) Zimbra]]

	~~===~~The app will ask if you want to configure a Manual entry or Scan a barcode. Zimbra Collaboration 8.7 supports only manual entry for now. However, keep in mind the next Bug where it is being discussed to add the option to support barcodes~~===~~		'''The app will ask if you want to configure a Manual entry or Scan a barcode. Zimbra Collaboration 8.7 supports only manual entry for now. However, keep in mind the next Bug where it is being discussed to add the option to support barcodes'''

	[[File:OTP3.png\|300px\| Image (c) Zimbra]]		[[File:OTP3.png\|300px\| Image (c) Zimbra]]

	~~===~~To configure the App, the users must add an email address and the unique Key from the Zimbra Web Client.==		'''To configure the App, the users must add an email address and the unique Key from the Zimbra Web Client. ===

	[[File:OTP4.png\|300px\| Image (c) Zimbra]]		[[File:OTP4.png\|300px\| Image (c) Zimbra]]

John: /* 2FA Video Tutorial */

2020-01-08T18:56:05Z

2FA Video Tutorial

← Older revision		Revision as of 12:56, 8 January 2020
Line 12:		Line 12:
	='''2FA Video Tutorial'''=		='''2FA Video Tutorial'''=

	Watch this Zimbra ~~made~~ video on configuring 2FA inside webmail: https://youtu.be/_eEwnnaEvMU		Watch this official Zimbra.com video on configuring 2FA inside webmail: https://youtu.be/_eEwnnaEvMU

	='''How to enable'''=		='''How to enable'''=

John: Added link to the Zimbra instructional video on how to configure 2FA.

2020-01-08T18:53:42Z

Added link to the Zimbra instructional video on how to configure 2FA.

← Older revision		Revision as of 12:53, 8 January 2020
Line 1:		Line 1:
	='''Two Factor Authentication or 2FA'''=		='''Two Factor Authentication or 2FA'''=

	All XMission Zimbra email accounts support a beneficial security practice known as '''two-factor authentication''' (aka, 2FA). This includes both '''base and premium accounts'''. Two-factor authentication provides mailbox protection by combining something you know (your password) and something have (your smartphone or USB-key, etc.)		All XMission Zimbra email accounts support a beneficial security practice known as '''two-factor authentication''' (aka, 2FA). This includes both '''base and premium accounts'''. Two-factor authentication provides mailbox protection by combining something you know (your password) and something have (your smartphone or USB-key, etc.) Once configured you will utilize the 2FA authentication with all devices and programs you use for accessing email. All major platforms support and encourage the use of 2FA.

	[[File:2fa-diagram-zimbra87.png \| 700px \| Image (c) Zimbra]]		[[File:2fa-diagram-zimbra87.png \| 700px \| Image (c) Zimbra]]
Line 9:		Line 9:

	In simple terms, two-factor authentication prevents unauthorized users from accessing the system because they are very unlikely to have both variables to access the account. The password and PIN are needed to login. The PIN is sent to the mailbox owner's smartphone, through something like the Google Authenticator app. If either variable is missing, access is denied.		In simple terms, two-factor authentication prevents unauthorized users from accessing the system because they are very unlikely to have both variables to access the account. The password and PIN are needed to login. The PIN is sent to the mailbox owner's smartphone, through something like the Google Authenticator app. If either variable is missing, access is denied.

			='''2FA Video Tutorial'''=

			Watch this Zimbra made video on configuring 2FA inside webmail: https://youtu.be/_eEwnnaEvMU

	='''How to enable'''=		='''How to enable'''=

John at 23:12, 18 January 2018

2018-01-18T23:12:46Z

← Older revision		Revision as of 17:12, 18 January 2018
Line 158:		Line 158:

	Thunderbird (IMAP/POP3) prompts for new password after some time (after few minutes or sometimes after restarting client)		Thunderbird (IMAP/POP3) prompts for new password after some time (after few minutes or sometimes after restarting client)

			===Failed Login Attempts===

			Please note, use of Two-Factor Authentication (2FA) does not prevent account suspension due to exceeding [https://wiki.xmission.com/Hosted_Email:_Admin_Panel#Password_Expiration_and_Failed_Login_Attempts failed login attempts] limits.


	[[Category:Email]]		[[Category:Email]]
	[[Category:Zimbra]]		[[Category:Zimbra]]

Boom at 16:54, 7 April 2017

2017-04-07T16:54:06Z

← Older revision		Revision as of 10:54, 7 April 2017
Line 159:		Line 159:
	Thunderbird (IMAP/POP3) prompts for new password after some time (after few minutes or sometimes after restarting client)		Thunderbird (IMAP/POP3) prompts for new password after some time (after few minutes or sometimes after restarting client)

	~~='''Testing Zimbra Desktop with 2FA'''=~~

	~~Pending~~		[[Category:Email]]
			[[Category:Zimbra]]
	~~='''Testing~~ Zimbra ~~Connector for Outlook with 2FA'''=~~

	~~Pending~~

Boom: /* How to create an application passcode */

2017-04-07T16:51:30Z

How to create an application passcode

← Older revision		Revision as of 10:51, 7 April 2017
Line 112:		Line 112:
	===How to create an application passcode===		===How to create an application passcode===

	~~User~~ can create an application passcode by navigating to '''Preferences > Accounts > Applications''' and selecting Add Application Code button.		* Users can create an application passcode by navigating to '''Preferences > Accounts > Applications''' and selecting Add Application Code button.

	[[File:Appcode1.png]]		[[File:Appcode1.png]]

	Next enter the application name you desire in the '''"Add Application Code"''' dialog and click Next.		* Next enter the application name you desire in the '''"Add Application Code"''' dialog and click Next.

	[[File:Appcode2.png]]		[[File:Appcode2.png]]

	Application passcode will get generated, then it can be used to sign in to your account from that device.		* Application passcode will get generated, then it can be used to sign in to your account from that device.

	[[File:Appcode3.png]]		[[File:Appcode3.png]]

Boom: /* Application Passcode */

2017-04-07T16:50:22Z

Application Passcode

← Older revision		Revision as of 10:50, 7 April 2017
Line 102:		Line 102:
	='''Application Passcode'''=		='''Application Passcode'''=

	Clients such as IMAP or ActiveSync do not support the UI flow needed for TOTP authentication. For these users need to generate application passcode.		Clients such as IMAP or ActiveSync do not support the UI flow needed for TOTP authentication. This means that you will need to use the Application Code section to create codes for IMAP and ActiveSync use. For these users need to generate application passcode.

	Application passcodes:		==Application passcodes:==

	Randomly generated.		Randomly generated.
Line 110:		Line 110:
	Changing account password will revoke all application passcodes.		Changing account password will revoke all application passcodes.

	How to create an application passcode		===How to create an application passcode===

	User can create an application passcode by navigating to Preferences > Accounts > Applications and selecting Add Application Code button~~. User can enter the application name in the Add Application Code dialog and click Next. Application passcode will get generated and it can be used to sign in to your account~~.		User can create an application passcode by navigating to '''Preferences > Accounts > Applications''' and selecting Add Application Code button.

	~~Application specific passcode~~.png		[[File:Appcode1.png]]
	~~How to revoke an application passcode~~

	~~Once~~ the ~~user generates~~ application ~~passcode user can revoke it by navigating to Preferences > Accounts > Applications in Zimbra Web Client. User can revoke this application passcode after selecting the required~~ name in the ~~list~~.		Next enter the application name you desire in the '''"Add Application Code"''' dialog and click Next.

	~~Application passcode~~.png		[[File:Appcode2.png]]
	~~Known Issues~~

	Zimbra bugs		Application passcode will get generated, then it can be used to sign in to your account from that device.

			[[File:Appcode3.png]]

			==Revoking Application Codes==

			Once the user generates application passcode user can revoke it by navigating to '''Preferences > Accounts > Applications''' in Zimbra Web Client. Users can revoke this application passcode after selecting the required name in the list.


			=Known Issues=

			===Zimbra bugs===

	Bug 103824 {AUTH} Provide 2FA configuration capability in ZCO		Bug 103824 {AUTH} Provide 2FA configuration capability in ZCO
Line 132:		Line 141:
	Bug 105678 Application specific password entry should be purged when 2FA disabled from Admin Console		Bug 105678 Application specific password entry should be purged when 2FA disabled from Admin Console

	Notes		===Notes===

	Disabling two-factor authentication using Admin console does not clear user's two-factor data. Admin can disable user's two-factor authentication in case user is facing issues with authentication using TOTP/scratch codes. Re-enabling user's two-factor authentication using Admin console after user's problem has got resolved will allow user to use two-factor authentication. In future, Bug 104648 will allow Admin to clear user's two-factor data.		Disabling two-factor authentication using Admin console does not clear user's two-factor data. Admin can disable user's two-factor authentication in case user is facing issues with authentication using TOTP/scratch codes. Re-enabling user's two-factor authentication using Admin console after user's problem has got resolved will allow user to use two-factor authentication. In future, Bug 104648 will allow Admin to clear user's two-factor data.

	Third party issues		===Third party issues===

	Issue - Mail client issues with application passcode		Issue - Mail client issues with application passcode

Boom: /* How to revoke trusted computer/device */

2017-04-07T16:34:35Z

How to revoke trusted computer/device

← Older revision		Revision as of 10:34, 7 April 2017
Line 98:		Line 98:
	You can easily revoke a trusted computer/device in Preferences > Accounts > Trusted Devices found in your Zimbra webmail. Revoke trust for any selected device by clicking "revoke this device" link or get rid of them all by clicking on "revoke all other devices" link.		You can easily revoke a trusted computer/device in Preferences > Accounts > Trusted Devices found in your Zimbra webmail. Revoke trust for any selected device by clicking "revoke this device" link or get rid of them all by clicking on "revoke all other devices" link.

	~~(Need image Trusted Devices 2~~.~~jpg)~~		[[File:Trusteddevices3.png]]

	='''Application Passcode'''=		='''Application Passcode'''=