Configuring Two-Step Verification

Two-Step Verification (also known as Multi-Factor Authentication or MFA) provides an extra layer of security by requiring users to verify their identity through a second verification step beyond entering their email address and password. OneTrust has enabled Two-Step Verification by default for all OneTrust Platform users to enhance account protection and to reduce the likelihood of unauthorized access, even if a user's password has been compromised. While OneTrust strongly recommends keeping Two-Step Verification turned on to protect your organization’s sensitive information, Site Admin users within the root organization can modify this configuration, if needed.

Note:

If Two-Step Verification and Single Sign-On (SSO) are both enabled in the account, Two-Step Verification will only apply for email domains that are not configured for SSO. Two-Step Verification will not apply for users that are authenticated by SSO. For more information about SSO, see Managing Single Sign-On (SSO).

About Two-Step Verification

When Two-Step Verification is enabled for the OneTrust Platform, a verification code will be sent to the designated email address on users' accounts when a login attempt is made. Users will then be prompted to enter the verification code that they received via email in order to access the OneTrust Platform.

If the verification code that the user enters is valid, the user will be authenticated and redirected to the OneTrust Homepage screen. If the verification code that the user enters is invalid, the user will not be authenticated and will need to re-enter the verification code. Users are given four attempts to enter the correct verification code. If the verification code is entered incorrectly four consecutive times, the user's account will be temporarily locked.

Two-Step Verification Flow

OneTrust’s Platform utilizes password grant type of the OAuth 2.0 authorization framework. The password grant is used when the platform exchanges the user’s username and password for an access token. When the user logs in to the system successfully, the user will be presented with access token and refresh token.

When MFA is enabled for local accounts, prior to the access token being issued, the system further validates the Time-Based One Time Password (TOTP) token first. The token generated complies to RFC 4226 using an underlying Java library.

The following diagram illustrates a high-level overview of the Two-Step Verification flow:



To Enable Two-Step Verification

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Access management > Two-step verification. The Two-step verification screen appears.


  3. Enable the Turn on MFA two-step verification setting.
  4. Click the Save button.
    Note:

    When enabled, Two-Step Verification will be turned on for users who are part of the account where the setting is enabled. If users are actively logged in when this setting is enabled, those users will be required to complete the verification process the next time they log in.

To Disable Two-Step Verification

  1. Click the gear icon in the upper right-hand corner to access Global Settings.
  2. On the Global Settings menu, select Access management > Two-step verification. The Two-step verification screen appears.


  3. Disable the Turn on MFA two-step verification setting. The Turn off MFA authentication modal appears.


  4. Click the Turn off MFA button.
  5. Click the Save button.
    Note:

    When enabled, Two-Step Verification will be turned on for users who are part of the account where the setting is enabled. If users are actively logged in when this setting is enabled, those users will be required to complete the verification process the next time they log in.

To Verify Identity using Two-Step Verification

  1. Access the OneTrust Login screen.
  2. Enter the email address and password for your user account.
  3. Click the Login button. The Two-Step Verification prompt appears.


  4. In the Verification Code field, enter the code that was sent to your email address.
    Note:

    The Resend Code link can be used to send another verification code to your email address, if needed. If an incorrect verification code is entered three times, the user account will be locked for 10 minutes before an additional login attempt can be made.

  5. Optional: Select the Remember this device for 30 days check box to save your device details. Selecting this check box will allow you to access the platform without having to enter a verification code during subsequent logins.
    Note:

    OneTrust's security measures are leveraged to protect and store your collected information with unique identifiers tied to the browser, application, or device you’re using.

  6. Click the Validate button.

Two-Step Verification FAQ

The following responses are supported solutions to frequently asked questions (FAQ) about the two-step verification process. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.

Where is OneTrust's Two-Step Verification solution hosted?

OneTrust's Two-Step Verification solution is hosted as part of the OneTrust Platform and is designed in-house. Platform services live in the stateless service layer of OneTrust's Platform Architecture.

Is OneTrust's Two-Step Verification solution tested and secure?

Yes - OneTrust conducts penetration testing on the OneTrust Platform through an external third-party on at least an annual basis. All source code is static application security testing (SAST) and dynamic security testing (DAST) scanned before moving to Production, including the Two-Step Verification solution.

The following tests were performed against our authentication service, including Two-Step Verification enabled and disabled as well as Single Sign-On (SSO) enabled and disabled. As specified in the tests, no vulnerabilities of the service were found.

  • Attempts to modify parameters (e.g. scope, client ID, etc.) when authenticating to the OneTrust Main’s OAuth API token endpoint

  • Attempts to use expired access tokens

  • Attempts to use access tokens after logout

  • Attempts to use other access tokens from other accounts

  • Attempts to perform administrative actions with a low-privileged user

Is OneTrust's Two-Step Verification solution included in OneTrust's audits?

All platform functionalities are covered under OneTrust's Vulnerability Management Program. Additional details are available in OneTrust's SOC 2 Type 2 Report, which is available upon request. For more information, please contact OneTrust Support.

What account takeover protection does OneTrust have in place?

OneTrust has the following protections in place:

  • User Interactions

    • SSO Flows: Authentications are delegated to IdP of the customer for SSO users. The legitimacy of communication between the IdP and Service Provider is verified by certificates.

    • Password Flows: Plain text passwords are never stored, they are protected by standard bcrypt (irreversible). An additional verification step for password based authentication is available through Two-Step Verification.

  • System Interactions

    • Client Credentials: Client secrets associated to client IDs are protected by standard bcrypt. Client credentials can be whitelisted for allowed IPs or IP ranges (IPv4, IPv6, and netmasks) with additional protection of Mutual Transport Layer Security (mTLS) communication.

    • API Keys: API Keys are protected by bcrypt and can be whitelisted for IPs or IP ranges (IPv4, IPv6, and netmasks).

  • Service principals are internal to cloud infrastructure.

  • All network communications require using Transport Layer Security (TLS) between services.