OTP (Authenticator App)

OTP (one-time password) is based on the time-based one-time password algorithm (TOTP). Users need to install an authenticator app on their phone (e.g., Google Authenticator, Microsoft Authenticator, Tencent Authenticator), scan a QR code or manually enter a secret key. The app generates a 6-digit dynamic code every 30 seconds. The user enters this code to complete secondary verification.

Path: Console → Enter a specific application → Top navigation 「Configuration」 → 「Security Settings」 → 「Multi-Factor Authentication」

 

1. Application Configuration

1.1 Enable OTP

• In the “Factor Management” section, find the “OTP” card and toggle the switch on.
• Click “Save” at the bottom of the page for the configuration to take effect.
• When enabled, users under this application will be required to enter an OTP dynamic code after successful password verification to complete login.

1.2 Disable OTP

• Toggle the switch off, then click “Save”.
• A pop-up warning will appear: if users have already bound OTP, disabling will remove all bindings irreversibly. Confirm to disable.

Both factors can be toggled independently. If both email verification and OTP are enabled, users can choose which method to use via tabs on the secondary verification page.

 

2. User Authentication Flow (Application Users)

2.1 First-time OTP Setup (Binding Process)

When a user logs in for the first time and OTP is enabled, the system guides them through binding:

1. After successful password verification, the user enters the OTP binding page.

2. The page displays a QR code (standard TOTP format).

3. The user opens an authenticator app (e.g., Google Authenticator) and scans the QR code.

   • If scanning fails, click “Having trouble scanning?” – a text key (uppercase letters and digits) will be shown for manual entry.

4. The authenticator app adds the account and generates a 6-digit dynamic code (changes every 30 seconds).

5. The user enters the dynamic code on the binding page and clicks “Confirm”.

6. Note: First-time binding also requires entering an email verification code.

7. After verification, OTP binding succeeds and the user is logged in.

2.2 Subsequent logins (Verification only)

For users who have already bound OTP:

1. After entering email and password, they are taken directly to the OTP verification page.

2. They open the authenticator app to see the current dynamic code.

3. They enter the dynamic code and click “Confirm”.

4. Upon success, login is completed.

2.3 OTP combined with other factors

• The secondary verification page provides tabs, allowing the user to choose either OTP or another enabled factor.
•  Any one of the enabled methods is sufficient to complete login.

2.4 Security Policy

• After 6 consecutive incorrect OTP code attempts (cumulative with other factors), the account will be locked for 1 hour.

 

3. Management in User Details Page

Administrators can view whether a user has bound OTP, manually reset the user’s OTP binding, or globally bypass MFA for that user.

Path: User Management → User List → Click the user’s email to enter details → Find the “Multi-Factor Authentication” module.

3.1 View OTP Binding Status

If the user has bound OTP, an “OTP” row appears with a “Reset” button on the right.

3.2 Reset OTP Binding

• Click “Reset”, then confirm in the pop-up dialog.

• After confirmation, the system clears the user’s OTP binding data.

• The next time the user logs in, they will need to re-bind OTP (if the application still has OTP enabled).

3.3 Global bypass switch (Disable/Enable user MFA)

• Shared with other verification methods. When disabled, the user bypasses all MFA (including OTP and email verification).
• When enabled, the user reverts to following the application’s MFA configuration and must perform secondary verification on next login. If the application toggles a factor off and on again, the user will need to re‑bind OTP.

4. Logs and Auditing

After enabling OTP, user activity logs record related events:

• Event type: Secondary authentication - OTP

• Recorded fields: User, IP, country, time, result (success/failure), failure reason.

You can view these records under Audit Logs → User Behavior Logs.