Posted at 10:00 AM by Rakesh Gupta, on October 17, 2017
A few years back I wrote an articleTwo-factor authentication using Login Flow. It was a huge success. I received several emails from people requesting me to write more use cases around the concept. So, here it is!
Two-factor authentication is a security process in which users provide two means of identification – (1) regular user credential; and (2), typically something memorized, such as a security code.
Login flows gives you the flexibility to build a custom post-authentication process that meets your business requirements. For example, you want two-factor authentication only when a user is trying to log-in from a particular City, Subdivision, Zip code, County or Browser. Let us start with a business use case.
Business Use Case
Martin Jones is working as a System Administrator at Gurukul on Cloud (GoC). He has received a requirement from stakeholders to enable two-factor authentication only when a user (with profile – Sales Rep APAC) is trying to log-in to Salesforce from the cities outside of the following list:
Mumbai
London
Edison
San Francisco
Alpharetta
Chicago
Solution for the above business requirement
To solve this requirement we will use many ingredients – including,Login Flow, Two Flows, Process Builder, Custom Object and Custom Metadata Type. Before trying to understand the technical aspect of the solution,let us spend some time to understand the general flow of our solution at a very high level. Please spend few minutes to go through the following flow diagram and understand it.
Before we proceed further, let us understand LoginGeo – a geographic location of the user’s IP address for a login event – such as, country, city, postal code objects – in Salesforce. Read the rest of this entry!
Posted at 9:26 PM by Rakesh Gupta, on January 29, 2015
Two-factor authentication is a security process in which the user provides two means of identification, one of which is typically a normal user credential and the other of which is typically something memorized, such as a security code. You can enable Two-factor authentication for users by addingTwo-Factor Authentication for User Interface Logins permission through a Profile or a Permission Set.
Objectives:
After reading this blog, you’ll be able to:
Understand what is two-factor authentication
How to build custom two-factor authentication using Flow
How to use Flow to send an email
Set up Login Flow
Business Use Case
Warren Masonis a System Administrator at Gurukul on Cloud (GoC). He received a requirement to implement Two-factor authentication for Partner Community users who are having profile Partner Community User Clone.
What is Two-factor Authentication?
Two Factor Authentication, or 2FA, is an extra layer of protection used to ensure the security of online accounts beyond just a username and password. This process is done to better protect both the user’s credentials and the resources the user can access.
Automation Champion Approach (I-do):
Usually, with Salesforce, multiple approaches are available to solve a business requirement. Choose the ones that are simple, straightforward, and consume fewer resources.
Let us solve this scenario using Flow and Login Flow – as this business case involves adding a second factor of authentication after the username and password verification. Before diving further, let me show you a diagram of a Process Flow at a high level. Please spend a few minutes to go through the following Flow diagram and understand it.
Let’s begin building this automation process.
Guided Practice (We-do):
There are 7 steps to solve Warren’s business requirement using Salesforce Flow. We must:
Create a formula in the Flow to generate Security Code (We are using Current DateTime to do so)
Store Security Code in a Variable
Send Security Code to User via Email
Allow user to enter Security Code
Validate the Security Code
Add a Screen to display a failure message
Set up a Login Flow
Step 1: Create a Formula
Click Setup.
In the Quick Find box, type Flows.
Select Flows then click on the New Flows.
Select the Screen Flowoption and click on Create.
Navigate to the Manager tab and click on the New Resource.
Enter API Name and Description.
Select Number as Data type and enter the Description.
Drag-and-drop Screen element onto the Flow designer.
Enter Label theAPI Name will auto-populate.
On the Screen element, navigate to the Input section and double-click on the Number field, to add it on to the Screen element
Enter Label theAPI Name will auto-populate.
Make sure to select the Require checkbox.
Click Done.
Step 5: Validate Security Code
Drag-and-drop Decision element onto the Flow designer.
Enter Label theAPI Name will auto-populate.
On the FirstOutcome enter the Label theAPI Name will auto-populate.
When to Execute Outcome: All Conditions Are Met
Row 1:
Resource: {!VarNSecurityCode}
Operator: Equals
Value: {!Security_Code}
Click Done.
Step 6: Screen to display code Mismatched Error
Drag-and-drop Screen element onto the Flow designer.
Enter Label theAPI Name will auto-populate.
On the Screen element, navigate to the Display section and double-click on the Display Text field, to add it to the Screen element
Enter API Name.
You can now use a Rich-text editor to add content like Text, Image, URL, etc.
Click Done.
In the end, Edward’s Flow will look like the following screenshot:
Once you’re done, Save the flow and name it Two Factor Authentication. Do not forget to activate the Flow by clicking on the Activate button.
Step 7: Set up a Login Flow
Click Setup.
In the Quick Find box, type Login Flows.
Select LoginFlows then click on the New.
Select the Typefrom the drop-down Flow.
Enter Two-Factor Authentication as a Name.
The next step is to select Flow, User license,and Profile. Follow the steps as shown in the following screenshot:
Click Done.
It’s time to test the Login Flow
Now, if a User with profile Partner Community User Clonesuccessfully logged using a username and password, they will see to our Flow to complete the two-factor authentication process
Enter yourSecurity Code onto the screen input field and click on the Nextbutton, as shown in the following screenshot:
If the Security Code is matched then you will redirect to Salesforce (i.e. Partner Community) else it will display an error message.
–> To add a restriction on the number of unsuccessful attempts, you can add one subflow (It will Freeze the user’s account after three or more unsuccessful attempts). Check out the more advanced Login Flow use case here.
Great! You are done! Feel free to modify it based on your business requirement.
Formative Assessment:
I want to hear from you!
What is one thing you learned from this post? How do you envision applying this new knowledge in the real world?
Let me know by Tweeting me at @automationchamp, or find me on LinkedIn.
