The two-factor authentication is a security process in which the user provides two means of identification, one of which is typically a normal user credential and the other of which is typically something memorized, such as a security code. You can enable Two-factor authentication for users by adding Two-Factor Authentication for User Interface Logins” permission through a Profile or a Permission Sets.
Business Use Case
Warren Mason is working as System administrator at Universal Containers(UC). He has received a requirement from higher management, they want to implement Two-factor authentication for Partner Community users.
Solution for the above business requirement
To solve this requirement we will use Flow and Login Flow. Before proceeding ahead you have to create a custom object to generate Security Token. Create a custom object Custom Auth and set Name as Auto Number, as shown in the following screenshot
Custom Object Setup
Now create one Formula Data Type Number to Generate Random Number.
Random Number Generator
Note: – Grant Custom Auth object Create, Read, Edit and Delete Permission to partner community profile and Hide the Tab from Tab setting. Now we will create a flow, to Create a record in Custom Auth object, send the security code to user and verification purpose. To develop this application follow the below instructions
1) Click on Name | Setup | App Setup | Create | Workflows & Approvals | Flows
2) Click on New Flow, it will open flow canvas for you. Create One Formula LoggedInUserID(To get Logged-In User ID) as shown in the below screenshot
Logged-In User ID
3) To create a new record, drag-and-drop a Record Create ( Give the name Record Create) onto the window and map the fields according to below details
-
- Select Object Custom_Auth__c
- Enter Assignment OwnerId= {!LoggedInUserID} Formula and Save the Record ID in a Text variable {!RecordID}, as shown in the below screenshot
Record Create Element
4) Next Task is to find Logged-In User email address. Drag-and-drop a Record Lookup ( Give the name Logged In User Email Address) on the window
- Select Object User
- Enter criteria Id = {!LoggedInUserID}
- Save the Email into a Text variable {!EmailAddress}, as shown in the following screenshot
Logged-In User email address
5) Next task is to get Random number from the record that we have created on step. Drag-and-drop a Record Lookup ( Give the name Get Security Token) on the window
- Select Object Custom_Auth__c
- Enter criteria Id = {!RecordID}
- Save the Random_Number__c into a Number variable {!SecurityCode}, as shown in the following screenshot
Security Code for Logged-In user
6) The next step is to send the Security Code to the user. Drag-and-drop a Send Email static action onto the canvas ( Give the name Email Security Token) on the window
- For Body enter the text Here Is your security Token {!SecurityCode}
- Enter Subject Security Token
- For Email Address (Comma-separated) Select {!EmailAddress}, as shown in the following screenshot
Email Alert
7) Next step is allowing users to enter Security Code. To do that drag-and-drop a Screen Element ( Give the name Enter Your Security Token) onto the window and add one field with below detail
| Name | Data Type | Required |
| Token | Number | Yes |
It will look like the below screenshot
Screen Element – To enter Security Code
8) The next step is to verify Security Code (i.e. Generated by Salesforce) and Security Token entered by the user. To do that Now drag-and-Drop Decision element (Give the name Verify Security Code) on the window to check whether variable {!SecurityCode} is equal to Screen Input element {!Token}. If both the values are not same, then it means don’t allow user to login into Salesforce you can take help from the following screenshot
Decision Element
9) Once verification is done, delete the record that is created by flow in current execution. To Delete a new record, drag-and-drop a Record Delete( Give the name Record Delete) onto the window and map the fields according to below details
-
- Select Object Custom_Auth__c
- Enter Assignment Id= {!RecordID}, as shown in the below screenshot
Record Delete Element
10) Next step is to add a screen element to display error message. To do that drag-and-drop a Screen Element ( Give the name Error Message) onto the window and add one field with below detail
| Name | Data Type |
| Message | Display Text |
It will look like the below screenshot
Error Message
11) Finally our Flow will look like the following screenshot
12 ) Save the flow with name Two Factor Authentication then Activate it and close the canvas.
Create Login Flow
Our next task is to create Login Flow so that our flow will fire/invoke when user login into the system. To create a Login Flow follow the below instructions
1) Click on Name | Setup | Administer | Security Controls | Login Flows
2) Click on the New button
3) Enter the Login Flow Name, Select the flow, User license and Profile, It will look like the below screenshot
Create a Login Flow
4) Once done click on the Save button
It’s time to test this feature
To test this application follow the below steps
1) Login into community through User who have same profile that you have used in Login Flow, In my case it’s Partner Community User Clone. After Successful login you will receive an email, it will look like the below screenshot
Security Code
2) Enter your Security Code onto the screen input field (i.e. Token) and click on the Button Button, as shown in the following screenshot
Enter Your Security Code
3) If Security Code is matched then you will redirect to Salesforce (i.e. Partner Community) else it will display an error message
Error Message
To add restriction on number of unsuccessful attempt, We can add one subflow (It will Freeze user’s account after three unsuccessful attempt).
Note: – I will suggest you to Implement this first on your developer org test it and then move it to Production.
