Posted at 10:00 AM by Rakesh Gupta, on October 17, 2017
A few years back I wrote an articleTwo-factor authentication using Login Flow. It was a huge success. I received several emails from people requesting me to write more use cases around the concept. So, here it is!
Two-factor authentication is a security process in which users provide two means of identification – (1) regular user credential; and (2), typically something memorized, such as a security code.
Login flows gives you the flexibility to build a custom post-authentication process that meets your business requirements. For example, you want two-factor authentication only when a user is trying to log-in from a particular City, Subdivision, Zip code, County or Browser. Let us start with a business use case.
Business Use Case
Martin Jones is working as a System Administrator at Gurukul on Cloud (GoC). He has received a requirement from stakeholders to enable two-factor authentication only when a user (with profile – Sales Rep APAC) is trying to log-in to Salesforce from the cities outside of the following list:
Mumbai
London
Edison
San Francisco
Alpharetta
Chicago
Solution for the above business requirement
To solve this requirement we will use many ingredients – including,Login Flow, Two Flows, Process Builder, Custom Object and Custom Metadata Type. Before trying to understand the technical aspect of the solution,let us spend some time to understand the general flow of our solution at a very high level. Please spend few minutes to go through the following flow diagram and understand it.
Before we proceed further, let us understand LoginGeo – a geographic location of the user’s IP address for a login event – such as, country, city, postal code objects – in Salesforce. Read the rest of this entry!
Posted at 9:26 PM by Rakesh Gupta, on January 29, 2015
The two-factor authentication is a security process in which the user provides two means of identification, one of which is typically a normal user credential and the other of which is typically something memorized, such as a security code. You can enable Two-factor authentication for users by addingTwo-Factor Authentication for User Interface Logins” permission through a Profile or a Permission Sets.
Business Use Case
Warren Mason is working as System administrator at Universal Containers(UC). He has received a requirement from higher management, they want to implement Two-factor authentication for Partner Community users.
Solution for the above business requirement
To solve this requirement we will use Flow and Login Flow. Before proceeding ahead you have to create a custom object to generate Security Token. Create a custom object Custom Auth and set Name as Auto Number, as shown in the following screenshot
Custom Object Setup
Now create one Formula Data Type Number to Generate Random Number.
Random Number Generator
Note: – Grant Custom Auth object Create, Read, Edit and Delete Permission to partner community profile and Hide the Tab from Tab setting. Now we will create a flow, to Create a record in Custom Auth object, send the security code to user and verification purpose. To develop this application follow the below instructions
1) Click on Name | Setup | App Setup | Create | Workflows & Approvals | Flows
2) Click on New Flow, it will open flow canvas for you. Create One Formula LoggedInUserID(To get Logged-In User ID) as shown in the below screenshot
Logged-In User ID
3) To create a new record, drag-and-drop a Record Create ( Give the name Record Create) onto the window and map the fields according to below details
Select Object Custom_Auth__c
Enter Assignment OwnerId= {!LoggedInUserID} Formula and Save the Record ID in a Text variable {!RecordID}, as shown in the below screenshot
Record Create Element
4) Next Task is to find Logged-In User email address. Drag-and-drop a Record Lookup ( Give the name Logged In User Email Address) on the window
Select Object User
Enter criteria Id = {!LoggedInUserID}
Save the Email into a Text variable {!EmailAddress}, as shown in the following screenshot
Logged-In User email address
5) Next task is to get Random number from the record that we have created on step. Drag-and-drop a Record Lookup ( Give the name Get Security Token) on the window
Select Object Custom_Auth__c
Enter criteria Id = {!RecordID}
Save the Random_Number__c into a Number variable {!SecurityCode}, as shown in the following screenshot
Security Code for Logged-In user
6) The next step is to send the Security Code to the user. Drag-and-drop a Send Email static action onto the canvas ( Give the name Email Security Token) on the window
For Body enter the text Here Is your security Token {!SecurityCode}
Enter Subject Security Token
For Email Address (Comma-separated) Select {!EmailAddress}, as shown in the following screenshot
Email Alert
7) Next step is allowing users to enter Security Code. To do that drag-and-drop a Screen Element ( Give the name Enter Your Security Token) onto the window and add one field with below detail
Name
Data Type
Required
Token
Number
Yes
It will look like the below screenshot
Screen Element – To enter Security Code
8) The next step is to verify Security Code (i.e. Generated by Salesforce) and Security Token entered by the user. To do that Now drag-and-Drop Decision element (Give the name Verify Security Code) on the window to check whether variable {!SecurityCode} is equal to Screen Input element {!Token}. If both the values are not same, then it means don’t allow user to login into Salesforce you can take help from the following screenshot
Decision Element
9) Once verification is done, delete the record that is created by flow in current execution. To Delete a new record, drag-and-drop a Record Delete( Give the name Record Delete) onto the window and map the fields according to below details
Select Object Custom_Auth__c
Enter Assignment Id= {!RecordID}, as shown in the below screenshot
Record Delete Element
10) Next step is to add a screen element to display error message. To do that drag-and-drop a Screen Element ( Give the name Error Message) onto the window and add one field with below detail
Name
Data Type
Message
Display Text
It will look like the below screenshot
Error Message
11) Finally our Flow will look like the following screenshot
12 ) Save the flow with name Two Factor Authentication then Activate it and close the canvas.
Create Login Flow
Our next task is to create Login Flow so that our flow will fire/invoke when user login into the system. To create a Login Flow follow the below instructions
1) Click on Name | Setup | Administer | Security Controls | Login Flows
2) Click on the New button
3) Enter the Login Flow Name, Select the flow, User license and Profile, It will look like the below screenshot
Create a Login Flow
4) Once done click on the Save button
It’s time to test this feature
To test this application follow the below steps
1) Login into community through User who have same profile that you have used in Login Flow, In my case it’s Partner Community User Clone. After Successful login you will receive an email, it will look like the below screenshot
Security Code
2) Enter your Security Code onto the screen input field (i.e. Token) and click on the Button Button, as shown in the following screenshot
Enter Your Security Code
3) If Security Code is matched then you will redirect to Salesforce (i.e. Partner Community) else it will display an error message
Error Message
To add restriction on number of unsuccessful attempt, We can add one subflow (It will Freeze user’s account after three unsuccessful attempt).
Note: – I will suggest you to Implement this first on your developer org test it and then move it to Production.
