Groupware 2-factor authentication setup step-by-step

Manuals

Illustrated instructions to enable 2FA

More ...Less ...

Set up a program instance and assign an application password

More ...Less ...

Permanent Link:

Each mail application running on your computer requires its own application password to authenticate and cannot use your account password. The following is an explanation of how to generate such a password. Information on how to set up the software can be found here.

1. Go to the application password area in your Mail server's Web GUI
   
2. Add an application code - e.g. for Thunderbird on your workstation in the institute. Make sure to use a meaningful label - e.g. "thunderbird@mpi". The label must make sense to you in order to identify the application instance associated with it.
   
   
3. The application code is displayed. You'll see the new application label appearing in the list in the background.
   
   A very random word--the application password is shown. Keep this window open for now.
4. DO NOT write down, store or screenshot the application password! For you not being able to produce the password when needed is part of the security concept!
5. Open the application you want to connect to your mail account- e.g. [[GroupwareThunderbird]Thunderbird]].
   • If you didn't already set up your account (majority of cases), use the respective assistant in the mail app to connect to an existing mail account. Enter your mail address--e.g. myuser@cbs.mpg.de. Enter the application code as password.
   • If you already set up your account and just want to apply 2FA which you just enabled (less common case), wait for the program to complain about the password being wrong. Enter the application password instead of your account password.
6. Close the dialog with the application password. Do not remember it , do not write it down. You won't need it anymore, ever. It is a feature of this password, not to be remembered!
7. The new application is now registered for your account and will be shown in the application list at "Preferences"/"Accounts" in the Webmail service. Check this list from time to time (e.g. once a year) and remove applications that you no longer use (e.g. for phones your sold). The "Last Used" field shows the date, the respective application last accessed your mail account.
8. Repeat the process for additional mail clients - e.g. when setting up Thunderbird somewhere else.

Back to FAQ start

Short instructions for advanced users

More ...Less ...

Permanent Link:

• The mail server uses OATH-TOTP 2FA that can and must be enabled by users themselves.
• TOTP seeds are not the same as the ones used for RemoteLinux/RemoteWindows .
• 2FA must be enabled upon first login to the Web GUI.
• IMAPs/SMTPs/Caldavs/Carddavs client applications are supported via server generated application passwords issued by users themselves in the "Preferences" tab of the Web GUI in the "Accounts" section.
• There's no practical limit to the number of applications per user account.
• 2FA can only be reset by IT if access to the TOTP seed is lost. Physical presence and verification with a government issued ID (e.g. passport) is necessary in this case.
• The Webmail service provides options to mark a browser as safe during login. This will suppress 2FA requirement to 30 days.

Back to FAQ start

Hints

• Consider making a backup of your credentials, if you have a second phone: Groupware
• The application password are long, random and difficult to remember. That's a feature, not a bug. It is discouraged to remember them or write the down anywhere.
• If you change your institute password, application passwords will remain valid.