DDM HelpTwo-factor authentication
With two-factor authentication, signing in takes the password and a 6-digit code from an authenticator app on the phone – Microsoft Authenticator, Google Authenticator, 1Password, Authy or any other app that shows codes for a QR code. Whoever has only the password does not get in.
Everybody can switch it on for themselves. Administrators can require it for the whole organisation, and decide whether a code by e-mail may stand in for the app.
Setting it up
- In the CMS, click your name at the bottom left and open My account. Under Two-factor authentication, click Set up. In the app, Settings › Two-factor authentication opens the same page in the browser.
- If you have a DDM password, confirm with it.
- Scan the QR code with your authenticator app. If you cannot scan it – on the phone itself, say – enter the key shown beside it, or tap On this phone: open in the authenticator app.
- Enter the 6-digit code the app now shows for DDM and click Activate.
- Keep the backup codes – in your password manager, or printed. Each of them signs you in once if your phone is not to hand. They are shown only now; click I have saved them.
Signing in
After your password – your DDM password or your company password with an LDAP account – DDM asks for the code:
- Code from the app: the 6 digits your authenticator app shows for DDM.
- Send a code by e-mail instead: a code to your e-mail address, valid for 10 minutes – if your organisation allows it.
- Use a backup code: one of the codes you saved. Each works once.
Tick Trust this device on a device of your own: DDM then asks no code there for 30 days.
Ten wrong codes in a row pause signing in for 15 minutes.
New phone, lost phone
- New backup codes under My account › Two-factor authentication creates ten new ones; the previous ones stop working.
- Switch off turns it off again – unless one of your organisations requires it. Then the button is Replace authenticator app: scan the new QR code with your new phone and enter its first code. Your old app keeps working until then, and your backup codes stay as they are.
- Phone lost and no backup codes? Sign in with a code by e-mail, if your organisation allows it, and set it up again. Otherwise ask an administrator of your organisation: under Users › your name › Reset two-factor authentication, they remove it, and you sign in with your password alone – and set it up again straight away where your organisation requires it. An owner's is reset only by another owner.
For the organisation
Under Settings › Security, administrators decide two things:
| Setting | What it does |
|---|---|
| Require two-factor authentication | Everybody who has not set it up yet is asked to at their next step – in the CMS or the app – and can only continue afterwards. Nobody can switch it off for themselves any more, only replace their authenticator app. People who sign in with your single sign-on are not asked: your identity provider decides how they sign in. |
| Codes by e-mail | Whether a code to the e-mail address may stand in for the app at sign-in. Switch it off if the same password opens the mailbox – then the mailbox is no second factor. Backup codes keep working either way. |
If you require two-factor authentication without having set it up yourself, DDM takes you to setting it up right away.
Under Users, each person's details show whether they have two-factor authentication. The audit log records when somebody sets it up, switches it off, creates new backup codes, signs in with a backup code – or when an administrator resets it.