What is Multi Factor Authentication?
Multi Factor Authentication (MFA) is an authentication strategy where a user is granted access to a resource once they have provided several separate pieces of evidence proving who they are. For example, think about accessing your bank accounts via an ATM machine. To prove to the bank who you are and that you can access your bank account, you insert your ATM card (something you have) and enter your PIN number (something you know). You have provided the bank with two forms of authentication enabling the bank to give you access to your accounts.
Why use MFA?
Plain and simple, to secure resources against unauthorized personnel and ensure only authorized users have access to appropriate resources.
Integration of One-Time Passwords with User Credentials
Berkeley Lab's implementation of multi-factor authentication requires the use of your credentials in conjunction with a one-time password (OTP). OTP can be provided either by a software or hardware solution. Berkeley Lab IT has enabled the ability to use either. Software OTPs are generated from Google Authenticator, whereas hardware OTPs are generated from authentication devices known as YubiKeys. Berkeley Lab IT issues the hardware authentication devices.
MFA at Berkeley Lab
Berkeley Lab uses MFA for authentication to:
- Windows Login - requirement of multi factor authentication for Operations personnel logging into Windows Active Directory computers (sometimes known as StrongID)
- HRIS Login - requirement of multi factor authentication for HR personnel logging into Berkeley Lab HR databases to modify HR data
- Web-based single sign on (SSO) - requirement of multi factor authentication for Shibboleth providing Lab personnel logging into Berkeley Lab resources like email, calendar, LETS, etc.
- Lawrencium HPC Cluster - All HPCS Clusters require One Time Passwords (OTPs) for Authentication
- Privileged Server Access - Access to certain critical servers and services is done via gateways (sometimes known as L4 Gateways, or L4 StrongID)
How do I get started using MFA?
The full process is outlined here. Please note that Berkeley Lab employees must submit a help ticket to obtain any hardware authentication device.
