The Password Depot Enterprise Server can secure your users' logins with a second factor in addition to the password. Current versions of the iOS app support this login – the previously described limitation of app version 15.2, where a connection with 2FA enabled was not possible, is obsolete. This article shows what the administrator configures on the server side and how the login from the iOS app works.
Server-side setup (administrator)
Enable 2FA in the Server Manager under Manage → Server settings → 2FA Settings. The following operation modes are available: TOTP (one-time codes from an authenticator app), Email (the server sends the code to the user's default address; expiration time configurable from 1 to 60 minutes), and FIDO2/WebAuthn security keys (since version 18).
Adjust the operation mode per user if required: Users → (username) → Properties → Account, section Two-Factor Authentication (Default, Deactivated, TOTP, Email, FIDO2). There you can also reset a user's 2FA – for example, after a smartphone change, when the authenticator app is no longer available.
Optional: Define a trust period for user devices (0–2,400 hours; applies to the TOTP and Email operation modes). If the user selects Trust this computer when logging in, the code is not requested again on this device until the period has expired.
Make sure the server can be reached from the mobile device: the default port of version 19 is 25019 (TCP and UDP); outside the local network, typically via VPN or port forwarding.
Logging in from the iOS app
In the app, connect to the Enterprise Server (server address and port) and log in with your username and password.
If 2FA is active for your account, the server additionally requests a code at login: for TOTP, the current six-digit code from your authenticator app; for Email, the code sent to you (enter it within the expiration time).
After entering the code successfully, you see the server databases shared with you.
You perform the initial TOTP setup in the Windows client via the Activate 2-Factor Authentication (2FA) dialog: scan the QR code with your authenticator app, or enter the displayed secret key manually, and confirm with the six-digit code. Keep the secret key in a safe place – you will need it if you lose access to your authenticator app.
Note: If valid TOTP codes are rejected, check the time on the device and the server: TOTP codes are time-based and expire after a short period; a deviating system time leads to rejections.
Note (offline mode): You open local backup copies of server databases (format .bckd) in the iOS app without a server connection, using only your user password – a second factor is not requested. 2FA protects the login to the server, not the local backup file.
Related topics: