Picture of Multi-Factor Authentication for Infigo Storefronts

Multi-Factor Authentication for Infigo Storefronts

Infigo storefronts now support multi-factor authentication (MFA), giving administrators the ability to enforce a second verification step at login for any customer role. Three verification methods are supported: email one-time links, time-based authenticator app codes (TOTP), and FIDO2/WebAuthn hardware or platform security keys. MFA can be set as required for some roles and optional for others, with administrators able to configure each method independently.

Click Here to View the Step by Step Guide

Tutorial Video Transcript

0:00 Multi-factor authentication is now available in all Infigo storefronts. In this video we'll show you how to enable MFA, configure the supported methods, and assign requirements to relevant customer roles.
0:21 The first thing to do is head over to Configuration and Settings, and then into General Settings. Once you're in here you'll notice there is a Security Settings tab — scroll down to the multi-factor authentication options.
0:37 Tick MFA Enabled. It is worth knowing that MFA is switched off by default on every storefront, new or existing, so nothing changes for your users until you enable it here.
0:50 Under the Require MFA section you choose the method you want to enforce. By default that's the authenticator app and security key.
1:02 Email is deliberately left out unless absolutely required, because authenticator apps and hardware keys are the stronger options. You can add email as well if you'd like to.
1:14 Scroll down a little further and you have Roles Requiring MFA. Pick the roles that must complete MFA on every login.
1:24 Storefront Administrator is selected by default. Below that are the roles offered MFA without it being forced — Registered is the default there.
1:40 Once one of those users enrolls a method, they'll be challenged on following logins.
1:50 Scrolling down further, first we have Trusted Devices. Trust Device Days starts at zero, which keeps the feature off. Set it to a number of days and your users get a trust this device option during their MFA challenge.
2:02 Under the email-based login you can adjust the link expiry, which defaults to 15 minutes, and the throttle, which defaults to 30 seconds.
2:12 For authenticator apps, set your TOTP issuer name so users see your brand in their app. Leave it blank and your storefront name is used automatically.
2:25 For security keys, the FIDO2 server domain, server name and origin can all be left blank too — Infigo derives them from your storefront URL.
2:37 All you need to do at that point is click Save at the top of the page. Users in required roles will be prompted to verify with their chosen method on their next login.
2:50 That could be via email one-time link, authenticator app code, or security key, based on what you specified.

Incomplete

Setting Up Multi-Factor Authentication (MFA) on Your Infigo Storefront

Summary

Multi-factor authentication (MFA) adds a second verification step to the Infigo login flow, protecting storefront accounts beyond a password alone. This guide explains how to enable MFA, configure the supported methods, and assign requirements per customer role.

Problem

Storefront accounts were protected by password login only, with no built-in way to enforce additional identity verification. Administrators had no control over which customer roles required stronger security, and users had no option to self-enrol in additional verification methods.

Environment

Infigo storefront administration: Configuration > Settings > General Settings, then the Security settings tab, where you will find the Multi-Factor Authentication (MFA) section.

Configuration

Step 1: Open the MFA settings panel

In the admin area, go to Configuration > Settings > General Settings and open the Security settings tab, then scroll to the Multi-Factor Authentication (MFA) section. It sits directly below Brute Force Configuration. HTTPS is required on the storefront domain if you plan to use FIDO2/WebAuthn security keys.

step1_page.jpg

Step 2: Enable MFA globally

Tick MFA Enabled (Global). This is the master switch for the feature. MFA is disabled by default on every storefront, new and existing. No MFA challenge appears for any user until this is enabled, regardless of the per-role settings below.

step2_before.jpg step2_after.jpg

Step 3: Configure required MFA methods and roles

Under Required MFA, select the methods to offer: Email, Authenticator App (TOTP), and/or Security Key (FIDO2). By default the required methods are Authenticator App (TOTP) and Security Key (FIDO2); Email is not a required method by default. Then, under Roles Requiring MFA, tick the roles whose users must complete MFA on every login. The default is Storefront Administrators.

step3_required_methods.jpg step3_required_roles.jpg

Step 4: Configure optional MFA (if needed)

Under Optional MFA, select the methods and roles for users who may configure MFA voluntarily but are not required to. The available optional methods are Authenticator App (TOTP) and Security Key (FIDO2). The default role under Roles with Optional MFA is Registered. Users in optional roles can enrol themselves from their account area, and once a user has enrolled, MFA applies to their subsequent logins.

step4_optional_methods.jpg step4_optional_roles.jpg

Step 5: Set email and device trust settings

Under Trusted Devices, set Trust Device (days) - leave it at 0 to keep trusted devices switched off, or enter a number of days to let a verified device skip later MFA challenges. Under Email based login, set Email Link Expiry (minutes, default 15), Email Throttle (seconds, default 30), and Mask Email Domain, which hides the domain on the challenge screen and is off by default.

step5_trust_device.jpg step5_email_settings.jpg

Step 6: Configure authenticator app and security key settings, then save

Under Authenticator App Support, set TOTP Issuer Name, TOTP Tolerance Steps, TOTP Hash Algorithm, and optionally a TOTP Branding Image. For security keys, set FIDO2 Server Domain (RP ID), Server Name, Origin, and User Verification. When you are finished, click Save at the top of the General Settings page. MFA becomes active for qualifying users on their next login.

step6_before.jpg step6_save_before.jpg

Settings Added or Changed

  • MFA Enabled (Global): master switch to enable or disable MFA. When disabled, no MFA challenge is triggered regardless of the per-role settings. Default: off on all storefronts, new and existing, until an administrator turns it on.

  • Required MFA (Email, Authenticator App (TOTP), Security Key (FIDO2)): the methods available for roles that must complete MFA. Default: Authenticator App and Security Key only - Email is excluded by default. Storefronts that already had their own method selection saved keep it unchanged.

  • Roles Requiring MFA: which customer roles must complete MFA on every login. Default: Storefront Administrators.

  • Optional MFA (Authenticator App (TOTP), Security Key (FIDO2)): the methods available for roles with optional MFA.

  • Roles with Optional MFA: which customer roles may configure MFA voluntarily. Default: Registered. Once a user in one of these roles enrols in a method, they are challenged for MFA on subsequent logins.

  • Email Link Expiry (minutes): validity window for email authentication links. Default: 15 minutes.

  • Email Throttle (seconds): minimum wait between email authentication link sends to the same customer, to prevent inbox flooding. Default: 30 seconds.

  • Mask Email Domain: hide the domain portion of the email on the MFA challenge screen, showing "j***@e***.com" instead of "j***@example.com". Default: off.

  • Trust Device (days): how long a verified device is trusted before MFA is prompted again. Default: 0, which disables trusted devices. Above 0, users see a "Trust this device" option during the challenge.

  • TOTP Issuer Name, TOTP Branding Image, TOTP Tolerance Steps, TOTP Hash Algorithm: authenticator app configuration. Leave Issuer Name blank to show your storefront name in the authenticator app instead. Tolerance Steps allows for clock drift and defaults to 1 (adjustable from 0 to 2). Hash Algorithm defaults to SHA1; changing it will invalidate existing authenticator app enrolments, so only change it if you can confirm your users' apps support the alternative.

  • FIDO2 Server Domain (RP ID), FIDO2 Server Name, and FIDO2 Origin: configuration for security key (FIDO2/WebAuthn) support. Leave these blank to have Infigo derive them automatically from your storefront URL and name; override them only for complex hosting setups such as load balancers or custom domains. FIDO2 User Verification controls whether the security key must confirm the user's identity (biometric or PIN) and defaults to Required, the strongest option; Preferred and Discouraged trade some assurance for a faster login.

  • At least one MFA method must remain active once a user has enrolled. Attempting to remove the last one is blocked with the message "You cannot remove your last authentication method. At least one authentication method must remain."

Verification

  1. Enable MFA globally, assign a required role and method, then log in as a user in that role and confirm the MFA challenge appears.

  2. Test each method you enabled: email link, authenticator app code, and security key registration and authentication.

  3. Set Trust Device (days) above 0, trust a device during a challenge, and confirm subsequent logins skip MFA for the configured number of days.

  4. Log in as a user whose roles are in neither the required nor the optional list and confirm they are not prompted.

Alternate Search Terms

multi-factor authentication Infigo, MFA storefront setup, enable MFA security settings, TOTP authenticator app configuration, FIDO2 WebAuthn security key login, email one-time login link, trusted device days skip MFA, roles requiring MFA, optional MFA customer roles, MFA disabled existing storefront upgrade