Service Multi-factor Authentication (MFA)
Changing passwords for Uni-ID / project numbers and MFA / tokens
Greater security for your login
Every time you log in, an authentication process checks whether the given account really belongs to the user making the request. Typically, a password is used to verify access authorization, and in the context of a login, this is referred to as a factor. However, since a password can easily be obtained along with the username, for example, through phishing, this approach no longer offers state-of-the-art protection against third parties gaining unauthorized access to an account and all of its associated data and rights.
With multi-factor authentication (MFA), your identity is verified during login using other, independent factors in addition to your password. The URZ provides the MFA Token Self Service platform (with the LinOTP software) as a centralized service for Heidelberg university employees and students to set up additional factors. Here, multiple factors are made available, which users can select and set up individually.
If you encounter any obstacles or have any questions when setting up your tokens or using MFA on the VPN, please contact IT Service by video call.
- MFA Token Self Service platform (access limited to the university network or VPN)
- How-to: Setting up an Android smartphone as a software token
- How-to: Setting up an iOS smartphone as a software token
- How-To: Set up KeePassXC as a token
- How-To: Login Cisco Secure Client - AnyConnect - VPN
- Help via video call
Target Group
- University employees
- Students
- Users with a project number
Use
- Additional factors, unlike passwords, are not just static bits of information and cannot be easily copied. As a result, MFA provides a secure login process for the connected services thereby increasing the protection of user accounts and data.
- Factors from different categories, such as “knowledge” (e.g. a personal password) and “possession” (e.g. a smartphone with an authenticator app or a hardware token) as well as “inherent” (e.g. individual biometric characteristics such as fingerprint or face), reinforce each other and significantly reduce the risk of attacks.
-
Account theft is made much more difficult and requires considerably more effort. This means that the data and permissions of all users are better protected.
Explanatory video: BSI
Access and Requirements
The login for the connected services consists of multiple steps:
- using your personal Uni ID or project number and password (factor one - something the user "knows") as well as
- an additional token in the second step (factor two - something the user "has").
A token is an additional asset that users must have in their possession as a second factor. This includes, for example, a smartphone with a corresponding authenticator app that generates time-based one-time passwords or a hardware token. These one-time passwords can then be entered when logging in to the MFA protected services.
The following requirements must be met to use MFA:
- You must have a Uni-ID or project number.
- You must have set up at least one additional factor (e.g. smartphone with authenticator app) using LinOTP (login via Uni ID or project number).
- The setup of additional factors must be done from the university network or via VPN.
By default, so-called software tokens are recommended for creating one-time passwords, which can be generated using a smartphone and an Authenticator app. It is also possible to generate the tokens using software (KeePassXC) on a PC or Mac if no smartphone/tablet PC is available.
In addition to software-based tokens, hardware tokens can also be used. All institutions therefore have the option of procuring their own hardware tokens in a decentralized manner, whereby the URZ recommends certain manufacturers and devices. A list of tested tokens can be found in the FAQ.