# Two Factor Authentication
Smile CDR supports Two Factor Authentication using the [Time-based One-time Password algorithm](https://en.wikipedia.org/wiki/Time-based_One-time_Password_algorithm) defined in [RFC 6238](https://tools.ietf.org/html/rfc6238).
This algorithm is generally known as TOTP. TOTP works by using a mobile device as a soft token, where the user is required to register a service with an app on their device, and the app then generates codes that can be used as a second factor for login.
Many free implementations of TOTP exist for mobile devices, making TOTP an excellent low-cost mechanism for enhancing security. Popular implementations include:
- Google Authenticator: [Android](https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2) / [iOS](https://apps.apple.com/us/app/google-authenticator/id388497605)
- Authy: [Multiplatform](https://authy.com/)
# User Activating TOTP
Any user account in Smile CDR can be configured with a TOTP key. An overview of the enable flow is shown below:
There are different ways that users can go through this flow:
## User Activating TOTP via APIs
The JSON Admin API [User Management Endpoint](/content/docs/json_admin_endpoints/user_management_endpoint.html) provides APIs that can be used to generate keys, confirm keys, and validate codes at runtime.
## User Activating TOTP via Web Admin Console
In the Web Admin Console, a logged-in user can click on the _Profile_ link from the menu in the top-right corner of the console. In the profile section there is an option to enable TOTP based Two Factor Authentication.
# Enforcing Two Factor Authentication
It is important to note that not all authenticated endpoints presently enforce Two Factor Authentication.
For brand-new users not yet configured, Two-Factor Authentication is enforced via the new config key: [2fa.required](/content/docs/configuration_categories/http_security.html#property-two-factor-authentication-2fa-required/index.html). Any user attempting to login, irrespective of whether 2FA is set up for that user, on providing correct credentials will be redirected to the 2FA prompt.
In the event that a user is not yet set up for Two-Factor Authentication, upon login they will be redirect to a Enable Two-Factor Authentication page where they will be prompted to enable Two-Factor Authentication, scan a QR code, and enter that code for the first time, similar to the functionality in the User Profile page.
Once Two-Factor Authentication has been enabled, the user will be able to click on a "Start" button to begin using the WAC.
| Module | Enforced |
| --- | --- |
| Web Admin Console | If a user has 2FA enabled for their account, they will
be required to enter a code upon each login. |
| SMART Outbound Security | If a user has 2FA enabled for their account, they will
be required to enter a code upon each login for a code
exchange. |
| [FHIRWeb Console](/content/docs/fhir_repository/fhirweb_console.html) | FHIRWeb Console does not currently enforce 2FA, so it should
not be enabled for platforms that require 2FA. |
| [FHIR Endpoint](/content/docs/fhir_repository/fhir_endpoint_module.html) | FHIR Endpoint modules do not enforce 2FA directly. This means that
if the endpoint supports HTTP Basic Auth, correct user
credentials will be accepted without requiring a 2FA code even
if the user has 2FA enabled. For enforcement of 2FA on FHIR
endpoints, OpenID Connect should be used so that the 2FA code can
be verified at the time that the token is issued. |
[Security Recipes](/content/docs/security/security_recipes.html)
Two Factor Authentication
Security
[Authentication Protocols](/content/docs/security/authentication_protocols.html)
[Authorization and Consent](/content/docs/security/authorization_and_consent.html)
[Inbound Security Module](/content/docs/security/inbound_security_module.html)
[Local Inbound Security Module](/content/docs/security/local_inbound_security_module.html)
[LDAP Inbound Security Module](/content/docs/security/ldap_inbound_security_module.html)
[Scripted Inbound Security Module](/content/docs/security/script_inbound_security_module.html)
[SAML Inbound Security Module](/content/docs/security/saml_inbound_security_module.html)
[Trusted Client Mode](/content/docs/security/trusted_client_mode.html)
[Roles and Permissions](/content/docs/security/roles_and_permissions.html)
[Callback Scripts](/content/docs/security/callback_scripts.html)
[Anonymous Access](/content/docs/security/anonymous_access.html)
[Consent Service](/content/docs/security/consent_service.html)
[Consent Service: JavaScript API](/content/docs/security/consent_service_javascript.html)
[Consent Service: Java API](/content/docs/security/consent_service_java.html)
[Security Recipes](/content/docs/security/security_recipes.html)
[Two Factor Authentication](/content/docs/security/two_factor_auth.html)
[Password Hashing Algorithms](/content/docs/security/password_hashing_algorithms.html)
[JWT Signature Algorithms](/content/docs/security/jwt_signature_algorithms.html)
[Troubleshooting Security](/content/docs/security/troubleshooting_security.html)
[Password Hashing Algorithms](/content/docs/security/password_hashing_algorithms.html)