2-faktor authentication (2FA)

IMPORTANT: Please ensure that you either already have a TOTP-enabled app installed and handy, or have a USB security stick connected before performing the following steps.

1. If you have a student or employee ID card, you can perform a self-activation on 2FA-Activation using the control/card number. If you do not have a corresponding ID card, please contact 2fa(at)hochschule-trier.de with a request to participate in the procedure.
2. You will then receive an e-mail (sender: noreply+2FA@hochschule-trier.de) in which you will find unique access data for registration.
3.  Log in to the 2FA registration platform with the access data from this mail. Attention: this works exactly once. So carry out the registration process (roll out at least one token) to the end!
4. Select the Token ausrollen function and register the second factors (tokens) of your choice. Instructions on how to do this can be found in the following points 2.a), 2.b) and 2.c).

The Timebased-OneTimePassword (TOTP) is a time-based token (a 6-digit number that changes every 30 seconds). To use this method, you need an app or program on your device that can generate such TOTPs. If you do not have a trusted authenticator app installed yet, we recommend using the privacyIDEAAuthenticator app. The app is available for both Android and iOS. Of course, if you are already using another authentication app (for example Microsoft Authenticator), they will work just as well.

1. Select the function Token ausrollen and there TOTP: Zeitbasiertes Einmalpasswort from the drop-down menu.
2. Under Beschreibung please choose a meaningful name, so that you still know later which token generator this is (examples: smartphone, authenticator, notebook, ...).
3. Click the Token ausrollen button at the bottom.
4. A QR code will appear. You can scan this with the Authenticator app on your end device. Alternatively, you can click on Der OTP-Schlüssel on the right and copy and paste the appropriate value into your program.
5. You must then enter the code generated by the app once for verification in the input field on the homepage with the QR code and select Verify token.
6. Your Authenticator app will now constantly generate new tokens. If you are asked for a token when logging in to supported university services, simply enter the current value your app displays there.

With WebAuthn, your USB security stick takes over the token function. When logging in to supported university services, the system checks whether the stick is connected to your terminal device and you must also confirm this by "pressing a button" (touching the round symbol) on the stick. To use the procedure you need a USB security stick that supports the FIDO procedure. To activate this as a token, proceed as follows:

1. Connect your USB security stick to your end device.
2. Select the function Token ausrollen and there WebAuthn: Enroll a Web Authentication token from the dropdown menu.
3. Under Beschreibung please choose a meaningful name, so that you know later which token generator this is (examples: Yubikey, Feitan, ...).
4. Click the Token ausrollen button at the bottom.
5. Follow the instructions of your browser and run the registration process once completely. In the meantime you will be asked to press the button on the USB security stick once (it will start blinking). This means to touch the round symbol on the stick
6.  If you are asked for a token when logging in to supported university services, follow the instructions of your browser, connect the stick (if not already connected) and confirm the login manually by touching the symbol on the USB security stick.

With WebAuthn, a security chip (hardware) takes over the token function. When logging on to supported services, the presence of the chip is checked and, depending on the device, confirmation is required using a biometric function (fingerprint or face scan). In order to be able to use the procedure, the following points must be fulfilled:

1. You need a browser that supports WebAuthn (these are almost all common, modern browsers).
2. You need a supported hardware - a device secured by biometric functions (examples: notebook with Windows Hello, macOS with FaceID or TouchID, ...).

To activate this token, proceed as follows:

1. Connect your USB security stick to your end device.
2. Select the function Token ausrollen and there WebAuthn: Enroll a Web Authentication token from the dropdown menu.
3. Under Beschreibung please choose a meaningful name, so that you know later which token generator this is (examples: Yubikey, Feitan, ...).
4. Click the Token ausrollen button at the bottom.
5. Follow the instructions of your browser. Complete the registration process once.
6. If you are asked for a token when logging in to supported services, follow your browser's instructions to unlock your hardware to allow logging in.

You can reach the portal for managing your 2FA tokens at 2fa.hochschule-trier.de.

Area - Alle Token

After logging in, you will automatically land on an overview page with all your tokens. You can see at a glance which tokens you have activated. By clicking on the serial number of a token you will get to its detail page. On this page you can delete the token, deactivate it temporarily, change the description or even test the token.

Area - Token ausrollen

In this area you can activate new tokens. Basically you are free to create as many tokens as you want. However, we recommend to activate at least two. This way, logging in is still possible even if you lose a token. For example, you can use a USB token and an Authenticator app on your smartphone. If you lose the USB token, you can still log in using TOTP from the app and deactivate the lost USB token in the portal.