Multifactor Authentication With edu-ID

You can already configure two-factor authentication for your SWITCH edu-ID account

The IT department is gradually activating multi-factor authentication (or MFA, two-factor authentication or strong authentication) for various services in order to increase the security of our applications (more info on our blog, in French). In addition to your password, you will be asked for a one-time code, either received by SMS or generated in an application provided for this purpose (such as Google Authenticator).

The edu-ID digital identity includes multi-factor authentication and enabling it is easy. To read official SWITCH documentation on MFA and edu-ID, go here: https://help.switch.ch/eduid/faqs/?lang=en#mfa

Activation

(adapted from the official SWITCH documentation)

To enable two-step login, go to your SWITCH edu-ID account at https://eduid.ch and click on the plus (+) sign next to Two-step login

or go directly to the two-step login settings (https://eduid.ch/web/edit-security-settings/).

Then enable one of the two-step authentication methods. We recommend using a mobile authentication app to obtain your codes. The following mobile applications work among others: Twilio Authy, FreeOTP, Google Authenticator, Microsoft Authenticator, or OTP Auth. (Other applications that support TOTP can also be used.) More information on iBarry.ch

More and more password managers offer the ability to manage both your passwords as well as the 2nd factor within a single app, such as macOS Keychain (latest version) or BitWarden (premium version). ). This also has the advantage of being synchronized across different devices.

The other option, which we do not recommend for reasons of reliability, is to use SMS. A code will be sent to you for each connection requiring a 2nd factor.

If you use a non-Swiss phone number, please be aware that certain countries and operators may limit the delivery of SMS messages, or charge for them. In this case, we recommend you use an authenticator app rather than the SMS option.

It is possible to enable more than one two-step login method. Login with app is then displayed as the first/preferred tab.

Depending on your settings, two-step login is only used for those services that require it (On request) or for all services each time (Always).

To disable two-step login, go back to the two-step login settings (https://eduid.ch/web/edit-security-settings/) and disable all of the enabled methods. Please note that this may mean that you need to reinitialise or reverify the verification code if you reactivate a certain method later on.

Most of the authenticator apps mentioned above work with multiple account providers too, such as Google, Facebook, etc.

Connection

When connecting to a service requiring a second factor, after the usual login asking for your email address and edu-ID password, you will be presented with a new page:

This page enables you to choose between using an app generated code (for example in Google Authenticator) or an SMS, depending on what you have configured. If available, the don't ask again for one week option means you will not be prompted for the second factor for seven days when using the current browser.

Connecting to the Pulse Secure VPN

Starting from the 11th of July 2022, each time you connect to our VPN, you will be prompted with the familiar edu-ID login page, requiring you to enter your email address and edu-ID password:

Then, if you haven't yet configured a second factor, the process will guide you through setting it up. By clicking on continue, you will be taken to the two-step authentication settings page (https://eduid.ch/web/edit-security-settings/) of your edu-ID account:

If your second factor is configured, you will be asked to enter it. If you chose the authenticator app, open the app and copy the displayed code:

If you chose SMS code, check your mobile phone and enter the received code:

The process will then end and you will be connected to the VPN!

When logging into the VPN using edu-ID, the authentication process uses an embedded browser, to be sure the browser is not insecure or compromised. This means that you won't be able to save your edu-ID password. We recommend using a password management too and copy/pasting your email address and edu-ID password.

Passkey

Passkey is a new standard that is emerging, supported by major internet players and should ultimately be THE secure authentication solution. Edu-ID is now Passkey compatible. Once configured, this allows you to authenticate in a “passwordless” way, without having to enter your password. You can find an overview of the passkey technology here: https://www.ibarry.ch/en/safe-devices/passkeys/

The technology is still new, and there are multiple ways to configure Passkeys. Not all OS, apps or devices are compatible. You can find more information in the Switch FAQ.

Please report any problems or incompatibility encountered during Passkey configuration or use to the helpdesk.

Questions

You will find the answers to multiple questions concerning multi-factor authentication on the official SWITCH edu-ID website: https://help.switch.ch/eduid/faqs/?lang=en#mfa