Last Updated on June 1, 2022 by Rakesh Gupta

Two-factor authentication is a security process in which the user provides two means of identification, one of which is typically a normal user credential and the other of which is typically something memorized, such as a security code. You can enable Two-factor authentication for users by adding Two-Factor Authentication for User Interface Logins permission through a Profile or a Permission Set.

Objectives:

After reading this blog, you’ll be able to: 

• Understand what is two-factor authentication 
• How to build custom two-factor authentication using Flow
• How to use Flow to send an email 
• Set up Login Flow 

Business Use Case

Warren Mason is a System Administrator at Gurukul on Cloud (GoC). He received a requirement to implement Two-factor authentication for Partner Community users who are having profile Partner Community User Clone. 

What is Two-factor Authentication?

Two Factor Authentication, or 2FA, is an extra layer of protection used to ensure the security of online accounts beyond just a username and password. This process is done to better protect both the user’s credentials and the resources the user can access.

Automation Champion Approach (I-do):

Usually, with Salesforce, multiple approaches are available to solve a business requirement. Choose the ones that are simple, straightforward, and consume fewer resources. 

Let us solve this scenario using Flow and Login Flow – as this business case involves adding a second factor of authentication after the username and password verification. Before diving further, let me show you a diagram of a Process Flow at a high level. Please spend a few minutes to go through the following Flow diagram and understand it.

Let’s begin building this automation process.

Guided Practice (We-do):

There are 7 steps to solve Warren’s business requirement using Salesforce Flow. We must:

1. Create a formula in the Flow to generate Security Code (We are using Current DateTime to do so) 
2. Store Security Code in a Variable
3. Send Security Code to User via Email
4. Allow user to enter Security Code
5. Validate the Security Code
6. Add a Screen to display a failure message 
7. Set up a Login Flow

Step 1: Create a Formula

1. Click Setup.
2. In the Quick Find box, type Flows.
3. Select Flows then click on the New Flows.
4. Select the Screen Flow option and click on Create.
5. Navigate to the Manager tab and click on the New Resource.
6. Enter API Name and Description. 
7. Select Number as Data type and enter the Description. 
8. Use the following formula 
   1. Value(SUBSTITUTE(LEFT(RIGHT(text( {!$Flow.CurrentDateTime} ),9),8), “:”, “” ))
9. Click Done.

Step 2: Store Code (Formula value) in a Variable

1. Create a Number Variable to store the security code generated by Flow formula.
2. Navigate to the Elements tab and drag-and-drop Assignment element onto the Flow designer. 
3. Enter Label the API Name will auto-populate.
4. Set Variable Values:
   1. Row 1:
      1. Variable: {!VarNSecurityCode}
      2. Operator: Equals
      3. Value: {!VarNCode}
5. Click Done.

Step 3: Email Security Code

1. Create a Text Formula to store the logged-In user email address.
2. Navigate to the Elements tab and drag-and-drop Action element onto the Flow designer. 
3. Select Send Email core action. 
4. Enter Label the API Name will auto-populate.
5. Set Input Values:
   1. Row 1:
      1. Body: Here is your security code {!VarNSecurityCode}
      2. Subject: Security Code – Salesforce
      3. Email Addresses (comma-separated): {!ForTLoggedInUserEmail}
6. Click Done.

Step 4: Screen to enter the Security Code

1. Drag-and-drop Screen element onto the Flow designer. 
2. Enter Label the API Name will auto-populate.
3. On the Screen element, navigate to the Input section and double-click on the Number field, to add it on to the Screen element
4. Enter Label the API Name will auto-populate.
5. Make sure to select the Require checkbox.
6. Click Done.

Step 5: Validate Security Code

1. Drag-and-drop Decision element onto the Flow designer. 
2. Enter Label the API Name will auto-populate.
3. On the First Outcome enter the Label the API Name will auto-populate.
4. When to Execute Outcome: All Conditions Are Met
   1. Row 1:
      1. Resource: {!VarNSecurityCode}
      2. Operator: Equals 
      3. Value: {!Security_Code}
5. Click Done.

Step 6: Screen to display code Mismatched Error

1. Drag-and-drop Screen element onto the Flow designer. 
2. Enter Label the API Name will auto-populate.
3. On the Screen element, navigate to the Display section and double-click on the Display Text field, to add it to the Screen element
4. Enter API Name. 
5. You can now use a Rich-text editor to add content like Text, Image, URL, etc.
6. Click Done.

Step 7: Set up a Login Flow

1. Click Setup.
2. In the Quick Find box, type Login Flows.
3. Select Login Flows then click on the New.
4. Select the Type from the drop-down Flow.
5. Enter Two-Factor Authentication as a Name.
6. The next step is to select Flow, User license, and Profile. Follow the steps as shown in the following screenshot:
7. Click Done.

It’s time to test the Login Flow

Now, if a User with profile Partner Community User Clone successfully logged using a username and password, they will see to our Flow to complete the two-factor authentication process

Enter your Security Code onto the screen input field and click on the Next button, as shown in the following screenshot: 

 If the Security Code is matched then you will redirect to Salesforce (i.e. Partner Community) else it will display an error message. 

–> To add a restriction on the number of unsuccessful attempts, you can add one subflow (It will Freeze the user’s account after three or more unsuccessful attempts). Check out the more advanced Login Flow use case here. 

Great! You are done! Feel free to modify it based on your business requirement. 

Formative Assessment:

I want to hear from you!  

What is one thing you learned from this post? How do you envision applying this new knowledge in the real world? 

Let me know by Tweeting me at @automationchamp, or find me on LinkedIn.