WSO Access with RFC 6238 TOTP 2FA app

Reference:

https://docs.vmware.com/en/VMware-Workspace-ONE-Access/services/ws1_access_authentication_cloud/GUID-7233283A-D7D0-4D3D-B04B-888D890F3064.html

Let’s first understand why 2FA is mandatory for any organization.

https://blogs.vmware.com/euc/2022/07/why-every-organization-needs-to-have-multi-factor-authentication.html

Now you can choose your own favor 2FA app to login to WSO Access.

To enable this new authentication method, administrator only needs to

1. Enable “Authenticator App” authentication method.

2. Add the method to your IDP. For example, the built-in IDP.

3. Modify your authentication policy to ask user for password + Authentication App 2FA.

Demo video on how to add the new “Authentication app” authentication method

This next demo shows the end user experience. In the video, user scanned a QR code with his favor authentication app for the first time login. Once the registration was done, user was able to use the OTPO code generated by his authentication app to get authenticated.

Twilio Authy

Microsoft Authenticator

Google Authenticator

The authenticator apps I have tested with are all similar in features. They all scan QR code to start to use. OTOP codes are generated automatically with an expiration time.

As the way things work are very similar across different RFC 6238 app, one can also take privacy into account when it comes to choosing an authenticator app.

Here are app privacy of the authenticator apps I have looked at. The app privacy are listed out for your reference.