Multifactor authentication (MFA) at Ulm University
Starting on November 1, 2024, Ulm University will introduce mandatory multi-factor authentication (MFA) for access to the campus network via VPN and access to the university's IDM (identity management system).
For the MFA, a two-step process is used to check the username and password and, in a second step, a time-based one-time password (TOTP). The six-digit TOTP is regenerated every 30 seconds and therefore changes constantly. A security token is required to generate the TOTP. This can be a smartphone (with an installed app such as Google Authenticator or OTP Auth) or a standalone device for this purpose. Both options are supported by the university's MFA solution.
Who is affected?
According to a decision of the Presidential Board of Ulm University, the use of MFA is mandatory for all members of Ulm University from 01.11.2024.
How can I set up MFA for the first time?
Depending on the category of person, the following procedures can be used to generate a second factor:
Category of persons
The usage of an authenticator app on a business or private smartphone or tablet is generally recommended. If you do not have such a device, hardware tokens can be purchased at the service point "Ausleihe" in the library (Bibliotheks-Zentrale).
The usage of an authenticator app on a business or private smartphone or tablet is generally recommended. If you do not have such a device, hardware tokens can be purchased at the service point "Ausleihe" in the library (Bibliotheks-Zentrale).
For employees of the Zentralen Universitätsverwaltung, the use of a hardware token is mandatory for the generation of TOTPs.
The use of an authenticator app on a smartphone or tablet is generally recommended. If you do not have such a device, hardware tokens can be purchased from the service point "Ausleihe" in the library (Bibliotheks-Zentrale).
If access to the administrative network or the university's GLT network is required, a hardware token must be requested via the responsible supervisor:
FAQ
To reset a lost software / hardware token, you must reset your IDM password. You can do this by yourself with your chip card and the chip card PIN at the known self-service terminals (University East: Entrance South and Entrance North, University West: Foyer Library (Bibliotheks-Zentrale)). If you are unable to reset the password by yourself for important reasons, you can also contact the kiz helpdesk. They will send you a new initial password for logging in to the IDM once your identity has been verified.
Important: After resetting the IDM password, you can log in to IDM once with the initial password assigned without a second factor. In addition to changing the IDM password, you must also assign and activate a new second factor (software/hardware token) in the same session. Without this, you will no longer be able to log in to IDM and will have to perform the password reset again. If you no longer have the hardware token, you must first obtain a replacement.
No, for security reasons, only one active software or hardware token can be used at a time. Activating another token via the IDM automatically deactivates the existing token.
To move software tokens, you can either use the options provided in the Authenticator APP or you can log in to IDM again and generate and activate a new software token on your new device. This new token replaces your existing token, which then loses its validity.
Only tokens generated or managed by kiz can be used for authentication on the MFA platform operated by kiz. It is not possible to import decentrally acquired tokens or tokens from third parties.
Private devices should generally not be used for business purposes. This is also taught in the online awareness courses, for example. However, there are exceptions to this general rule for reasons of practicability. For example, soft tokens may also be set up and used on private devices (usually smartphones). This does not result in a significantly higher risk, if at all. If you do not wish to use a private device for other reasons, you must obtain a hardware token from kiz, which is free of charge for employees. In terms of the pure security aspect, however, this is not necessary.
The modules on awareness have been purchased by us and therefore cannot reflect the regulations at Ulm University in every detail.
No, a TOTP (time-based one-time password) is generated twice per minute and is valid for 30 seconds each time. During the validity of the TOTP, it can only be used once. If you need several TOTPs within a short period of time, you will unfortunately have to wait a few seconds after successfully using a TOTP until a new TOTP has been generated (maximum 30 seconds) due to technical restrictions.
TOTPs are generated twice per minute based on time and can only be used once during their validity. When a token is successfully assigned, the current TOTP is used up and cannot be used again. This means that you must wait until a new TOTP is generated (maximum 30 seconds) before you can test the token again or use it for the next login.
Communication and Information Centre (kiz)
Please contact us if you have questions or problems related to the kiz services:
Office hours
Monday - Thursday
09:00 h - 12:00 h and 13:00 h - 15:30 h
Friday 09:00 h - 12:00 h
Phone
+49 (0) 731 / 50 - 30000
Telefax
+49 (0) 731 / 50 - 1230000
Order a Callback
helpdesk(at)uni-ulm.de
Support Portal (Uni internal)
[more]
Service Points are locations where you can visit us personally.
Using self-service functions of the Identity Management System (IDM): Administer permissions, subscribe to services, change passwords.
Research in the library stock: monographs, textbooks, magazines, university publications, e-books, e-journals, national licenses, and the contents of the institutional repository OPARU.
With about 400 keywords you will get direct access to our services. If something isn't listed, please contact our Internet Editorial Office.
Who can I contact if I have problems?
If you have any problems or questions, please contact: helpdesk(at)uni-ulm.de