Multi-factor authentication (MFA) is a security method that'll require you to provide multiple forms of identification, such as a password and a one-time code generated via an app, before accessing the application. MFA provides enhanced protection against unauthorised access.
Setting up multi-factor authentication
To setup multi-factor authentication, visit the Profile app. You can also access the Profile app by going to edit your profile via the top-right menu in Rex.
You'll first be prompted to download an authenticator app on your phone. Any QR-code based authenticator will work, though we recommend Google Authenticator, Microsoft Authenticator or Twilio Authy.
You'll then be presented with instructions (via the selected app) on how to get set up with MFA.
Full setup instructions;
Here's a step-by-step guide on how to set up Multi-Factor Authenticator. Please note: Actions to take from your phone will note (Phone) before the instruction. Actions to take from your Computer/ Desktop Rex will note (Desktop) before the instruction.
- (Phone) Ensure you have an Authenticator App downloaded to your phone - Google Authenticator is recommended as the easiest for set up.
- (Desktop) Click your profile icon with your initials or photo in the top right hand corner of the screen.
- (Desktop) Click My Settings
- (Desktop) Click the blue Change Personal Info button, a new window will come up.
- (Desktop) Click on the Security tab on the left hand side of the new window
- (Desktop) Click the dark blue Set-Up button on the right of Multi-Factor Authentication (you may need to scroll over or make the window bigger)
- (Desktop) Click on I’ve downloaded an app
- (Desktop) A QR Code should appear - leave it up on desktop screen for now
-
(Phone) Open the Authenticator app you have downloaded
- Google Authenticator - Click the large plus (+) button or click Add Code, select Scan a QR Code
- Microsoft Authenticator - Click the plus (+) button or click add account, select Other (Google, Facebook, etc.)
- Authy/Twilio - set up your profile first, confirming phone number and email address. Once set up Click the plus (+) button then select Scan QR Code
- (Phone) From your Authenticator App scan the QR Code
- (Phone) You should now see a 6 digit code that updates every 30 seconds
- (Desktop) enter the 6 digit code from the Authenticator App then enter your Rex password when prompted to confirm the connection to the app on your phone
Notes:
- Once MFA is enabled, you'll be prompted to provide a 6-digit code, generated by your selected MFA app every time you login.
- Enabling multi-factor authentication will require you to re-enter your password.
- Disabling multi-factor authentication will require you to enter a multi-factor code
MFA FAQs
Where is my code going?
Once set up correctly, the MFA code will appear in the Authenticator App you downloaded on your phone (Google, Microsoft, Twilio etc). It will not be sent via SMS or email.
Do you plan on supporting other multi-factor methods in the future?
We don’t have any immediate plans to support other multi factor methods . Authenticator-based MFA (a.k.a TOTP MFA) is one of the most secure methods available and boasts several advantages over email/SMS-based MFA.
What impact does multi-factor authentication have on the API?
Multi-factor authentication do not currently impact API usage and there are no breaking changes being made to the API at this stage. Note that we will eventually update the API to be compatible with multi-factor verification checks at a later date.
I'm getting an "Invalid Code"?
This can happen if there is even a 1 minute difference in the time showing on your phone and the time on your computer. If there is a difference, check that you have automatic time zone set up on your phone and computer. If you are still getting this error this will mean the MFA set up may not have been done correctly. Affected users can reach out to our Customer Care Team via email: support@rexsoftware.com.au who can reset the connection after the user has gone through an identity verification process.
What happens if users with MFA setup get locked out of their account?
We anticipate that users will occasionally get locked out due to lost phones/uninstalled apps or similar scenarios. Affected users can reach out to our Customer Care Team via email: support@rexsoftware.com.au who can unlock the user’s account after the user has gone through an identity verification process.