Two Factor Authentication in Time Tracker

Two factor authentication (2FA) option in Time Tracker can be enabled on the avanced group settings page (Group tab - Advanced settings - Configure). Access to this page is limited to users who have the manage_advanced_settings access right (available in default Manager and Top manager roles).

When enabled, users are required to use 2FA (2-factor authentication) when logging in. This feature works via email. Here is how login procedure works:

• First, user login and password is checked.

• If login by password succeeds, Time Tracker checks if two-step authentication option is enabled in group.
• If 2FA is enabled and if a user does not have the override_2fa access right, a random access code is generated and emailed to user. User is also redirected to Two Factor Authentication page, where they have to enter 2FA code along with their regular password.

For this workflow to work, Time Tracker must be configured for mail. Also, all users must have a valid email specified in their profile.

2FA Override for Top Managers

Multiple things can go wrong with 2-step auth:

• Some users may not have their email specified.
• Their email may be old or not working.
• A Time Tracker server may be not configured or misconfigured with regards to email feature with the end result of mail not going anywhere.

As the means to mitigate the above risks and to provide an opportunity to fix problems, the Top manager role in Time Tracker includes the override_2fa access right. This allows a top manager to login without 2FA by just using their login and password even when 2FA is enabled in group.

Handling No Email Error

What happens when two-step authentication is enabled but a user does not have an associated email? In this case the "No email associated with this login" error is displayed on the Login screen for user as on the picture below. A top manager can fix this by logging in without 2FA and assign an email to user.

Time Tracker User Guide