Understanding Two-Factor Authentication with TOTP

Two-factor authentication using time-based one-time password (TOTP) provides another layer of security in addition to password verification.

Time-based one-time password (TOTP) is a second factor where a user enters a short code (6 or 8 digits) generated from:

  • A shared secret key, which is stored on the server and in the user's authenticator application.

    Note:

    This feature uses offline TOTP, which refers to a one-time password generated locally on an authenticator device using a shared secret and the current time, without requiring internet or network connectivity. The generated code is validated by the authentication server (the PeopleSoft system) using the same shared secret and time-based algorithm.

  • The current time, which is refreshed periodically.

The administrator uses these pages to set up two-factor authentication using TOTP:

Page Name Usage

Security Policy

See Configuring Two-Factor Authentication Security Policies

Define the security parameters used in encoding the one-time code.

TOTP Configuration

See Configuring Time-Based One-Time Passwords

Define the characteristics of the one-time code.

Web Profile Configuration

See Configuring the Web Profile for Two-Factor Authentication

Set the custom property required to enable two-factor authentication.

Manage User 2FA

See Managing User Two-Factor Authentications

Reset or remove expired one-time codes.

After the administrator completes the setup, here are the high-level steps that a user follows to enroll a device:

  1. An end user starts enrollment.

    When the user signs in, they are directed to the enrollment page. See Configuring User Two-Factor Verifications

  2. The system generates a random secret for this user, based on the parameters set by the administrator.
  3. The system displays a QR code on the Authenticator Enrollment page that contains data about the secret and current time.

    The enrollment page also displays manual setup instructions.

  4. The user scans the QR code (or enters the information from the manual setup) to add the account to their authentication device.

    The user's authentication application stores the secret and begins generating rotating TOTPs, codes that are valid for short periods of time.

  5. The user completes the enrollment by entering a current TOTP code from their authentication application.

    This proves that the user actually scanned the QR code and entered the secret correctly.

  6. The system verifies the enrollment TOTP.
    • The system looks up the pending enrollment secret it just generated.
    • The system calculates expected TOTP codes for the current time interval, and a small window (time skew)
    • The system compares the user-entered code against the calculated value.
  7. If the calculated code matches the entered code, the system marks the enrollment as successful.

    The system saves the device enrollment record, and clears any pending enrollment state.

  8. After enrollment, when a user signs in, first their password is validated.
  9. If the password is correct, the user is prompted for two-factor verification.
  10. The user enters a TOTP code from their enrolled device.
  11. The system check the TOTP code against the valid generated code based on the shared secret and the current timestamp.
  12. The system allows access if both the code and timestamp are valid.