Two Factor Authentication

Using 2FA with Formio Resource-based authentication

The following Two-Factor Authentication workflow is only compatible with Form.io Resource-based authentication. It's very common to utilize other authentication methods like OIDC or SAML for the deployed developer portal or custom applications. Please refer to the authentication provider's documentation to set up 2FA with these alternative methods.

The Form.io 2FA (Two-Factor Authentication) is a security feature within Form.io that adds an extra layer of protection to user accounts by requiring two modes of verification before granting access. In Form.io’s API-driven platform, 2FA can be configured for the Form.io Deployed Developer Portal by integrating authentication forms and workflows detailed below.

Integrating 2FA into an existing project:

In most recent Form.io platform deployments, 2FA is already integrated by default for the Portal Base project, managing authentication for the Developer Portal. Confirm this by checking that the Portal Base Project includes the necessary Two-Factor Authentication and Recovery forms, as well as fields to support the 2FA workflow within the User Resource.

If your Portal Base Project does not include 2FA, follow the instructions below:

Importing 2FA Forms/Resource

Integrating into an existing project:

1. Download the following project template JSON :

formio-2fa-template2.json

34KB

Open

1. Navigate to the Portal Base Project.
2. Click the Staging tab.
3. Click the Import Template tab and then the Choose File button.

1. Select the downloaded file from Step 1.
2. Click on the Import Template to Live. Note the following new Forms added to the project:

• Two-Factor Authentication Form - will be used to authenticate users with a one-time 6-digit code from an auth app.
• Two-Factor Recovery Form - will be used to authenticate users with a one-time recovery code.
• Two-Factor Authentication Settings Form - a form for switch on/off 2FA settings for users.

1. Verify that the default User resource is updated with Two-Factor settings.
2. Proceed to the next section to configure permissions for the newly incorporated forms.

Setting Up Permissions

With the Forms and Resources in place, delegate permissions to ensure the correct users can enable and use 2FA.

1. Navigate to the Two-Factor Authentication Form and click the Access tab.
2. Ensure the following Permissions have been set for the Submission Data Permission:

Permission	Role(s)
Create Own Submissions	Authenticated, Anonymous
Create All Submissions	Administrator
Read Own Submissions	Authenticated, Anonymous
Read All Submissions	Administrator
Update Own Submissions	Authenticated, Anonymous
Update All Submissions	Administrator
Delete Own Submissions	Authenticated
Delete All Submissions	Administrator

1. Ensure the following Permissions have been set for the Form Definition Access:

Permission	Role(s)
Read Form Definition (Restricted to owner)	N/A
Read Form Definition	Administrator, Authenticated, Anonymous
Update Form Definition (Restricted to owner)	N/A
Update Form Definition	Administrator
Delete Form Definition (Restricted to owner)	N/A
Delete Form Definition	Administrator

1. Navigate to the Two-Factor Recovery Form and click the Access settings.
2. Apply the same permissions detailed above for the Two-Factor Authentication Form.
3. Navigate to the Two-Factor Authentication Settings form and click the Access setting.
4. Ensure there are no Roles assigned to any of the Submission Data Permissions.

1. Ensure the following Permissions have been set for the Form Definition Access:

Permission	Role(s)
Read Form Definition (Restricted to owner)	N/A
Read Form Definition	Administrator, Authenticated
Update Form Definition (Restricted to owner)	N/A
Update Form Definition	Administrator
Delete Form Definition (Restricted to owner)	N/A
Delete Form Definition	Administrator

Enabling Two-Factor Authentication:

1. Login to the Developer Portal as a User or Admin.
2. Navigate to Account Settings and click the Two-Factor Authentication tab.
3. Click Turn on 2FA button to enable.

1. Scan a QR code with an Authenticator app (e.g. Google Authenticator, Microsoft Authenticator, Authy, etc.)
2. Enter the 6-digit code and click the Confirm button.

1. Keep an offline record of up to 10 recovery codes and store them in a safe place .

These codes can be used if the user loses access to the authenticator app or if the device is lost. Each code is valid for a single login and will be deleted after use

2FA User Login

1. Navigate to the Form.io Developer Porta.
2. Login using Form.io authentication credentials.
3. Enter the 2FA code from the authentication application (or a recovery code).

After submitting, the user should be redirected to the Form.io portal page.

Disabling 2FA

Simply click the Turn Off 2FA within Account Settings to disable 2FA.