---
type: concept
title: 2-Factor Authentication (2FA)
tags: ["security", "authentication", "access-control", "2fa", "totp"]
related: ["ums", "servervirtualisierung", "totp", "keepassxc", "freeotp", "zentraler-nutzeraccount", "groupware", "totp-configuration-parameters"]
created: 2026-06-30
updated: 2026-07-01
sources: ["output/rz_uni_greifswald_de_dienste_allgemein_sonstiges_servervirtualisierung.md", "output/rz_uni_greifswald_de_support_dokumentation_anleitungen_2fa_mit_totp.md", "output/rz_uni_greifswald_de_support_dokumentation_anleitungen_2fa_mit_totp_2fa_vorausse.md", "output/rz_uni_greifswald_de_support_faq_zwei_faktor_authentifizierung_2fa.md"]
---

# 2-Factor Authentication (2FA)

**2-Factor Authentication (2FA)** is a security process that requires two different forms of identification to verify a user's identity before granting access to IT services. At the Universität Greifswald, it is implemented as a security layer for the [[zentraler-nutzeraccount]] to protect WebGUI access and other sensitive university services.

## Scope of Application

The application of 2FA varies by service:

*   **Mandatory/Required for**: 
    *   [[ums]] (Account Management) WebGUI.
    *   Groupware Webmailer.
*   **Other Implementations**: 
    *   **Server Virtualization**: 2FA is used to secure access to the server virtualization WebGUI, specifically utilizing the second factor provided by the [[ums]].
*   **Not required for**: 
    *   External email clients (IMAP/SMTP).

## Implementation at Universität Greifswald

The university utilizes the [[totp]] (Time-based One-Time Password) standard to balance security with user-friendliness.

### TOTP Mechanism
Users configure 2FA once per account; the resulting TOTP secret is linked to the account and used across all supported web services. This involves an authenticator application installed on a separate device (e.g., a smartphone or a secure laptop) that generates a rotating code.

### Configuration
Users can set up 2FA via the UMS using either a QR code scan or manual entry of the TOTP secret. For manual setup, specific [[totp-configuration-parameters]] must be followed.

### Software Support
The [[universitatsrechenzentrum-urz]] allows users to select their preferred TOTP-capable software. The following are specifically recommended:
*   [[keepassxc]] for desktop and laptop systems.
*   [[freeotp]] for mobile devices (smartphones and tablets).

**Deployment Note:** For managed devices deployed via [[opsi]], the recommended desktop client (**KeePassXC**) is pre-installed by default.

## Troubleshooting and Prerequisites

### Critical Prerequisites
For 2FA via TOTP to function, the device generating the code must have its **system time correctly synchronized**. Time drift is a common cause of 2FA failure. Users can verify their synchronization status using the URZ tool: `https://rz.uni-greifswald.de/wobinich/`.

### "Invalid TOTP Code" Errors
If the system rejects a TOTP code, it is typically due to one of the following:
1.  **System Time Mismatch**: The device generating the code has an incorrect system time.
2.  **Expiration**: The code was entered after its validity window expired.
3.  **Secret Mismatch**: The secret stored in the app does not match the server's current secret. This often happens if the setup process was restarted, as the server generates a new secret upon each restart.
4.  **Incorrect Parameters**: Manual configuration did not use 6 digits, SHA1, and a 30-second interval.