Authenticator apps and sign-in messages

This page specifies the authenticator apps and code settings that work with multi-factor authentication (MFA) in Storyteq CMP, and the messages users can meet when they sign in.

Authenticator apps

These apps have been tested with Storyteq CMP:

App	Platforms
Google Authenticator	iOS, Android
Microsoft Authenticator	iOS, Android
Authy	iOS, Android
FreeOTP	iOS, Android

App

Platforms

Google Authenticator

iOS, Android

Microsoft Authenticator

iOS, Android

Authy

iOS, Android

FreeOTP

iOS, Android

Other apps that follow the time-based one-time password standard (RFC 6238), and support the settings in Code settings, also work, but haven’t been tested.

Any phone that runs one of these apps can be used. Setting up the app needs the phone’s camera to scan a QR code, or the user can type a text key instead.

Code settings

Setting	Value
Type	Time-based
Algorithm	SHA1
Code length	6 digits
Interval	A new code every 30 seconds
Clock tolerance	The codes for the previous and the next 30-second intervals are also accepted, to allow for small differences between clocks and for typing time.
Reuse	Each code is accepted once. Entering the same code again is refused.
Failed attempts	No lockout. A user can retry after any number of wrong codes. Each failed attempt is recorded.
Setup	QR code or text key, on the first sign-in after MFA is turned on, and after an administrator resets the user’s one-time password.

Setting

Value

Type

Time-based

Algorithm

SHA1

Code length

6 digits

Interval

A new code every 30 seconds

Clock tolerance

The codes for the previous and the next 30-second intervals are also accepted, to allow for small differences between clocks and for typing time.

Reuse

Each code is accepted once. Entering the same code again is refused.

Failed attempts

No lockout. A user can retry after any number of wrong codes. Each failed attempt is recorded.

Setup

QR code or text key, on the first sign-in after MFA is turned on, and after an administrator resets the user’s one-time password.

Methods not available

MFA in Storyteq CMP uses authenticator apps only. These methods aren’t available:

SMS codes
Email codes
Push approvals
Hardware security keys
Backup codes

A user who loses access to their authenticator app recovers through their administrator, as described in Get back in after losing your phone.

Each row describes something a user can meet while signing in with MFA, its cause, and what to do.

What the user sees	Cause	What to do
Invalid authenticator code.	The code was mistyped, or is more than about a minute old.	Wait for the next code and enter it carefully.
Every code is rejected, even when typed correctly.	The phone’s clock is out of sync.	Turn on automatic date and time on the phone.
Asked for a code a few minutes after MFA was turned on, while already signed in.	MFA was turned on for the organisation after the user signed in. Signed-in users are sent to the MFA step within about 5 minutes, when their sign-in refreshes.	Expected behaviour. Complete the MFA step, or set up the authenticator if asked, then carry on.
Asked for a code shortly after MFA was turned off.	The change can take up to 5 minutes to apply.	Enter a code as usual, or wait a few minutes and sign in again.
Asked for a password and code again.	The session reached its 30-day limit, or the user signed out, switched browser or device, used a private window, or cleared their cookies.	Expected behaviour. Sign in again with a code.
No authenticator app any more.	The phone was lost or replaced, or the app was deleted.	Select I can’t find my code, then Request OTP reset, and wait for an administrator to reset the user’s one-time password.
OTP reset isn’t set up for your account yet. Please contact your admin directly.	The organisation has no reset mailbox yet, so no reset request was sent.	Users: contact your administrator directly. Administrators: send the reset mailbox address to your Storyteq contact.
The QR code doesn’t scan.	The camera can’t read the screen, for example because of glare.	Select Unable to scan? and type the text key into the app.
No code is asked for.	The user signs in through single sign-on, or MFA isn’t turned on for the organisation.	Expected for single sign-on users. Otherwise, ask your administrator whether MFA is turned on.

What the user sees

Cause

What to do

Invalid authenticator code.

The code was mistyped, or is more than about a minute old.

Wait for the next code and enter it carefully.

Every code is rejected, even when typed correctly.

The phone’s clock is out of sync.

Turn on automatic date and time on the phone.

Asked for a code a few minutes after MFA was turned on, while already signed in.

MFA was turned on for the organisation after the user signed in. Signed-in users are sent to the MFA step within about 5 minutes, when their sign-in refreshes.

Expected behaviour. Complete the MFA step, or set up the authenticator if asked, then carry on.

Asked for a code shortly after MFA was turned off.

The change can take up to 5 minutes to apply.

Enter a code as usual, or wait a few minutes and sign in again.

Asked for a password and code again.

The session reached its 30-day limit, or the user signed out, switched browser or device, used a private window, or cleared their cookies.

Expected behaviour. Sign in again with a code.

No authenticator app any more.

The phone was lost or replaced, or the app was deleted.

Select I can’t find my code, then Request OTP reset, and wait for an administrator to reset the user’s one-time password.

OTP reset isn’t set up for your account yet. Please contact your admin directly.

The organisation has no reset mailbox yet, so no reset request was sent.

Users: contact your administrator directly. Administrators: send the reset mailbox address to your Storyteq contact.

The QR code doesn’t scan.

The camera can’t read the screen, for example because of glare.

Select Unable to scan? and type the text key into the app.

No code is asked for.

The user signs in through single sign-on, or MFA isn’t turned on for the organisation.

Expected for single sign-on users. Otherwise, ask your administrator whether MFA is turned on.

When you report a sign-in problem to your administrator or your Storyteq contact, include:

The email address used to sign in.
The organisation.
The date and time of the attempt, with the time zone.
The browser.
A screenshot of the message.

Never send one-time codes, the QR code, or the setup text key.

Authenticator apps and sign-in messages