---
type: source
title: "FAQ: Two-Factor Authentication (2FA)"
tags: [2fa, totp, troubleshooting, account-security]
related: [2-factor-authentication, ums, funktionsaccount]
created: 2026-07-01
updated: 2026-07-01
authors: []
year: 2026
url: "https://rz.uni-greifswald.de/support/faq/zwei-faktor-authentifizierung-2fa"
venue: "URZ Support FAQ"
sources: ["output/rz_uni_greifswald_de_support_faq_zwei_faktor_authentifizierung_2fa.md"]
---

# FAQ: Two-Factor Authentication (2FA)

This source provides detailed troubleshooting and operational guidance for the implementation of Two-Factor Authentication (2FA) at the Universität Greifswald, specifically for the **UMS** (Account Management) and **Groupware** services.

## Key Technical Details
- **Mechanism**: Uses **TOTP** (Time-based One-Time Password).
- **Configuration Parameters**:
    - **Digits**: 6
    - **Algorithm**: SHA1
    - **Interval**: 30 seconds
- **Scope**: A single 2FA setup per account covers both UMS and Groupware.
- **Email Access**: 2FA is mandatory for the Groupware Webmailer but not for external email clients using IMAP/SMTP.

## Troubleshooting Common Errors
- **White Screen / "Internal Error!"**: Indicates a security lockout. Triggered by 5 consecutive failed login or 2FA attempts. The user is blocked for 30 minutes.
- **"Invalid TOTP Format"**: Occurs when the input is not exactly 6 digits.
- **"Invalid TOTP Code"**: Attributed to:
    1. **System Time Mismatch**: Device time is incorrect.
    2. **Expiration**: The code was used after its validity window.
    3. **Secret Mismatch**: The secret in the app does not match the server (often caused by restarting the setup process, which generates a new secret).
    4. **Incorrect Parameters**: Manual setup used parameters other than 6 digits/SHA1/30s.

## Functional Account Management
For [[funktionsaccount]] entities, 2FA is managed by the designated [[ressourcenverantwortliche]].
- **Management**: The responsible person can change or view 2FA settings via **UMS** $\rightarrow$ **My Resources** $\rightarrow$ **Resources** $\rightarrow$ **Change 2FA**.
- **Access Sharing Methods**:
    1. **Delegation**: Sharing the account via Groupware.
    2. **Secret Sharing**: The responsible person provides the QR code or TOTP secret (recommended via Nextcloud or USB, not email).
    3. **Responsibility Transfer**: Adding the user as a responsible person via a change request.
