Because SURF Research Access Management (SRAM) provides access to research data that may be confidential, all users must sign in using two factors.

In most cases, SRAM will simply use the second factor from the user's home institution identity provider.

If the home institution is not setup to provide multi-factor authentication, SRAM provides a fallback mechanism via a Time-Based One-Time Password (TOTP) code.



SURFconext

In almost all cases, users authenticating via identity providers in the SURFconext identity federation will simply perform the MFA step via their home institution, no additional steps needed.



eduGAIN

For international identity providers connected via eduGAIN, the second factor is not detected by SURF Research Access Management. All users coming from such institutions will be asked to register a Time-Based One-Time Password token and provide the resulting code.

eduID.nl

For users authenticating via eduID.nl, the second factor of eduID.nl is used. This means setting up the second factor in the eduID.nl app is mandatory.

TOTP Fallback

 If an IdP is unable to provide two-factor authentication, or SRAM is unable to detect it, then you will be prompted to enter a TOTP code.

What is TOTP?

TOTP stands for Time-Based One-Time Password. It's a type of two-factor authentication which uses an application (FreeOTP, Google Authenticator, Microsoft Authenticator, etc) to register a token and generate a temporary code based on the current time and a shared secret key.

This prompt is part of an unvetted challenge, which means you’ll be asked for your TOTP code even if you've already used another second factor earlier in the login process.

Registration

When logging in to SRAM for the first time, you'll need to set up and verify a TOTP token. You will do this using an app like FreeOTP, Google Authenticator, or Microsoft Authenticator.

Setting up your TOTP token only requires logging in through your institution (federated login). In many cases, this means just entering your username and password. After logging in, scan the provided QR code with the TOTP app of your choice to register the token and enter the code.




Login

On every subsequent login, enter the TOTP code when prompted.  



Reset your TOTP token

If you've lost access to your TOTP token, for example if you've switched to a new phone, you can reset it. To do this, you’ll need approval from one of the following:

  • An organisation admin or manager (if applicable)

  • A collaboration admin from any collaboration you're a member of

  • The SURF Research Access Management support team

Request a reset code:

  1. Go to SRAM and log in using your institutional account.

  2. When the verification screen appears, click "Reset your verification code."


Use a reset code:

The selected administrator will be notified via email that you have requested a reset of your TOTP code. After checking the request, the administrator will contact you and provide you with a reset code.

Use the reset code to register a new token.