Registering for Multi-factor Authentication

This article explains how you can set up multi-factor authentication for your Backstage user account

What is multi-factor authentication?

Multi-factor authentication (MFA) means you need more than one piece of secret information to access your account. The point of having multiple factors is to reduce the risk of an unauthorized person getting access to your user account and personal data.

The first factor is your password, which you can provide by typing it in (or using a password manager). The additional factors are secrets which can only be provided by different means, thus reducing the risk of accidentally losing or disclosing them. The most commonly used additional factor is a mobile device which stores the secret information and allows you to prove that you possess it (e.g. by generating a short one-time password which you can type in). By having this additional factor, the risk of your account being compromised is significantly reduced as an attacker would need to know your password as well as have access to your unlocked mobile device.

In some cases, the additional factors may be pieces of information that are intrinsic to your network connection or internet client (e.g. IP address, device profile).

It is a good and widely used practice to secure your user account with a second authentication factor, and is far superior to just having a strong password. Multi-factor authentication is required for all Backstage accounts.

MFA only affects systems that sign you in via sso.pingidentity.com (e.g. Backstage).

MFA in Backstage

If you haven’t already registered for MFA, upon entering your username and password, you will be asked to set up a one-time password authenticator app.

mfa registration

Backstage uses a one-time password (OTP) generated by an authenticator app on your mobile device:

  • One-time Password: a single-use, 6-digit, limited lifetime password generated by a mobile device. You can register using the PingID app or another compatible TOTP authenticator app, such as Google Authenticator, available in the App Store and the Google Play Store.

Select “Continue” to begin setup. If you select “Exit”, the sign-in process will end and you will be returned to the login page without access to your account.

After the initial setup of an MFA device, Backstage will save it to your user profile. The next time you log in, you will be automatically asked to provide the previously registered MFA credentials.

Registration generates single-use recovery codes which can be used to access your account in case you are unable to authenticate with your authenticator app. It’s extremely important that you write these codes down and store them in a safe place, otherwise you may lose access to your account.
Passkeys (e.g. a hardware token or biometrics) and push authentication remain available for registered devices and can be added later from your Backstage account settings. When you first set up MFA, you will be asked to register a one-time password authenticator app.

Registering a one-time password (OATH) device

After you have installed the PingID app or another compatible TOTP authenticator app, such as the Google Authenticator, follow these steps:

  1. Select “Continue” on the setup page. The enrolment screen will display a QR code.

a67030771 4

  1. Open your chosen app and add a new device by scanning the QR code displayed in your browser.

  2. After scanning the QR code, your device will be registered and will appear in the app under “Accounts”.

a67030771 5

  1. A screen will be displayed with a list of 10 codes. It’s important that you keep these codes in a safe place as they will allow you to recover your account if you lose your device.

  2. On the next page you will be prompted to enter the one time password code from the app to confirm that registration was successful. In the PingID app, this can be done by selecting the relevant item in the list under “Accounts” and entering the code displayed into the input field in your browser.

  3. If the one time password was entered correctly, then registration will complete and your account will be protected.