Table of Contents

Multi-Factor Authentication: Overview

Jennifer Trower Updated by Jennifer Trower

Read Time: 4 mins

Sonar provides you with the ability to use Multi-Factor Authentication (otherwise known as MFA) for logging into your instance. This feature helps to provide security for your instance while users log in. Sonar provides this as an optional feature to users, unless the “Required” option is enabled.

It is recommended that you set up multiple Authentication Factors, including Recovery Codes, to prevent an account lockout. This ensures you can access your account if your primary authentication method is lost or unavailable.

Setting Up MFA

To set up your MFA access, navigate to the User Profile Icon → Security tab → Create Authentication Factor.

Clicking the Create Authentication Factor button will open a window allowing you to select the type of authentication you wish to use.

Authenticator App

Setting up the Authenticator App factor provides you with a QR code, which you will scan on your mobile device with the authentication app of your choice. You will then receive a verification code on your authenticator app. Enter the code you are then provided within your app in the space under the QR code and click “Submit Code”. This saves and verifies this Authentication Factor to your user settings.

Only one QR code will be generated per Authentication Factor. If you lose access to this setup or close the window without scanning the QR code, you will need to delete this Authentication Factor and recreate it.
Rate limits for Authenticator app login attempts are 5 per minute, 15 per hour, and 30 per day.

Rate limiting is used to prevent abuse and ensure fair usage of resources among multiple users. It controls the rate at which requests are made.

Email

To create an Email Authentication Factor, you will enter your user email and then click “Send Verification Code”. After entering the verification code sent to your email, you will click “Submit Code” to verify and save the Authentication Factor.

You have a 30 second wait period in between being able to resend a verification code to your email.
Rate limits for Email verification login attempts are 3 per minute, 10 per hour, and 30 per day.

Rate limiting is used to prevent abuse and ensure fair usage of resources among multiple users. It controls the rate at which requests are made.

Recovery Codes

Recovery Codes provide you with the ability to access the instance if you are unable to use another Authentication Factor.

Creating Recovery Codes for your user is simple and only requires you to click “Get Recovery Codes”. Sonar will provide you with a total of 16 Recovery Codes. We recommend you click on the “Copy Codes” button and then save them in a secure location for later use.

Once recovery codes have been generated, you will see the number of available codes under the Data Column in the table. When you use a code, the table will show the decline in available codes remaining. Once you have used all of your Recovery Codes, you will need to set up the Authentication Factor again to generate another set of 16 Recovery Codes.

SMS

Choosing to use SMS as an Authentication Factor allows you to have verification codes sent to your mobile device. To set this Authentication Factor up, you will need to provide a valid phone number in the “Phone Number” field and then click “Send Verification Code”. After you receive the code on your mobile device, enter it in the space provided and click “Submit Code”. This will save this Authentication Factor.

You have a 30 second wait period in between being able to resend a verification code to your mobile device.
Rate limits for SMS login attempts are 2 per minute, 5 per hour, and 15 per day.

Rate limiting is used to prevent abuse and ensure fair usage of resources among multiple users. It controls the rate at which requests are made.

Requiring MFA for Login

Within your instance, you have the ability to require MFA login for all users. To enable this feature being required, navigate to Settings → Security → Login Options → Multi-Factor Authentication check box, then select Save.

If a user does not have an Authentication Factor created when you enable the “Required” option, Sonar will automatically create an Email Authentication Factor for the user.

Logging in with MFA

Once you have your Multi-Factor Authenticators created, you are now ready to use them when you log into the instance.

You will be presented with 3 different pages when using MFA for logging in.

  1. The Sonar Login page, where you will enter your user credentials and click Log In.
  2. The MFA selection page, where you will choose which Authentication Factor you would like to use to log into the instance with.
  3. The Verification Code page, where you will provide the code you receive via your Authenticator App, Email, or SMS. Or by using your Recovery Codes, if applicable.

Once you click “Continue” on the last page, you will then be logged into your Sonar instance.

How did we do?

Auth0: Overview

Password Policy In Depth

Contact