Multi-factor Authentication¶
Feature Overview¶
Implements multi-factor authentication through Auth0 to enhance account security by requiring users to verify their identity through multiple methods before gaining access to the platform.
User Stories¶
US-UM-21: Enable Auth0 Multi-factor Authentication¶
As a staffing company user, I want to enable Auth0-powered multi-factor authentication for my account, So that my account is protected by an additional layer of security beyond just a password.
Acceptance Criteria: - Given I am logged into the platform - When I navigate to my security settings - Then I should see an option to enable multi-factor authentication - When I select this option - Then I should be redirected to the Auth0 MFA setup flow - And the Auth0 interface should guide me through the process step by step - And I should be able to choose from multiple authentication methods: - SMS verification - Email verification - Authenticator app - WebAuthn (for passkey support) - When I complete the Auth0 setup process - Then: - Multi-factor authentication should be enabled for my account in Auth0 - My local user profile should be updated to reflect MFA status - The systems should be synchronized to ensure consistent security settings - And I should receive a confirmation notification - And I should be provided with recovery codes for emergency access
US-UM-22: Log In with Auth0 Multi-factor Authentication¶
As a staffing company user with MFA enabled, I want to complete the Auth0 multi-factor authentication process during login, So that I can securely access my account.
Acceptance Criteria: - Given I have MFA enabled on my account through Auth0 - When I enter my username and password correctly - Then I should be redirected to the Auth0 MFA challenge - When I provide the correct verification code or complete the authentication challenge - Then: - Auth0 should validate my second factor - I should be redirected back to the application with proper authentication tokens - I should be granted access to my account - When I provide an incorrect verification code - Then Auth0 should prompt me to try again - And after a specified number of failed attempts - Then my account should be temporarily locked for security purposes - And the local application should respect the Auth0 authentication decision
US-UM-23: Manage Auth0 MFA Recovery Options¶
As a staffing company user with MFA enabled, I want to manage my Auth0 recovery options, So that I can regain access to my account if I lose my authentication device.
Acceptance Criteria: - Given I am logged into the platform with MFA enabled through Auth0 - When I navigate to my security settings - Then I should see options to manage my recovery methods - When I select to manage recovery options - Then I should be redirected to the Auth0 recovery management interface - And through the Auth0 interface, I should be able to: - View my existing recovery codes - Generate new recovery codes - Add a backup phone number - Add a backup email address - Configure additional MFA methods as backups - When I generate new recovery codes through Auth0 - Then my old recovery codes should be invalidated - And I should be encouraged to store the new codes securely - And I should receive a notification confirming the change - And my local user profile should be updated to reflect any changes to recovery methods
US-UM-24: Disable Auth0 Multi-factor Authentication¶
As a staffing company user, I want to disable Auth0 multi-factor authentication if needed, So that I can adjust my security settings according to my preferences.
Acceptance Criteria: - Given I am logged into the platform with MFA enabled through Auth0 - When I navigate to my security settings - Then I should see an option to disable multi-factor authentication - When I select this option - Then I should be warned about the security implications - And I should be required to confirm with my password - And if I'm an administrator, I should be informed that MFA is mandatory for admin accounts - When I confirm the action (if allowed) - Then: - I should be redirected to Auth0 to complete the MFA removal process - Auth0 should disable MFA for my account - My local user profile should be updated to reflect the disabled MFA status - The systems should be synchronized to ensure consistent security settings - And I should receive a confirmation notification - And the change should be logged for security audit purposes in both systems
US-UM-25: Enforce Auth0 MFA for Administrator Accounts¶
As a platform administrator, I want to enforce Auth0 multi-factor authentication for all administrator accounts, So that accounts with elevated privileges have enhanced security protection.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I create a new administrator account or modify a user to have admin privileges - Then: - The system should automatically configure Auth0 to require MFA for that account - Auth0 Rules should be triggered to enforce MFA for admin roles - The local system should be updated to reflect the MFA requirement - And the user should not be able to access administrative functions until MFA is configured in Auth0 - When an administrator attempts to disable MFA - Then: - The Auth0 Rules should prevent this action - The local system should respect the Auth0 enforcement - A message should be displayed explaining that MFA is mandatory for administrator accounts - And the attempt should be logged for security audit purposes in both systems
US-UM-26: Configure Organization-wide Auth0 MFA Policies¶
As a platform administrator, I want to configure Auth0 MFA policies for my organization, So that I can enforce appropriate security measures across all user accounts.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I navigate to the security policy settings - Then I should see options to configure Auth0 MFA policies - And I should be able to: - Make MFA mandatory for all users or specific user groups - Specify which Auth0 MFA methods are allowed - Set the frequency of MFA challenges (every login, once per device, etc.) - Configure session timeout policies - Set conditions for step-up authentication - When I update these policies - Then: - The changes should be applied to Auth0 tenant settings - Auth0 Rules should be updated to enforce the new policies - The local system should be updated to reflect the new policies - And users should be notified of the policy changes - And existing sessions should be updated according to the new policies - And the changes should be logged for audit purposes in both systems
US-UM-27: Monitor Auth0 MFA Usage and Security Events¶
As a platform administrator, I want to monitor Auth0 MFA usage and security events, So that I can identify potential security issues and ensure compliance with security policies.
Acceptance Criteria: - Given I am logged in as a platform administrator - When I navigate to the security monitoring dashboard - Then I should see analytics on Auth0 MFA usage including: - MFA enrollment rates by method - MFA success/failure rates - MFA-related security events - Users without MFA enabled (if required by policy) - And I should see Auth0 security events such as: - Failed authentication attempts - Suspicious login patterns - MFA bypass attempts - Changes to MFA settings - And I should be able to filter events by date range, user, and event type - And I should be able to set up alerts for critical security events - And I should be able to export reports for compliance purposes
Dependencies¶
- Auth0 tenant setup and configuration
- Auth0 Rules for enforcing MFA policies
- Integration between local database and Auth0
- Auth0 Logs API integration for monitoring