Services connected via single sign-on (SSO) will be primarily affected.
The following is a list of some examples of these services:
Yes, all employees, students and external users must activate MFA for their account sooner or later. This is the only way to ensure effective protection for all members of the university. The targeted times can be found further up on this page in the blue box. Starting from January 1, 2027, MFA will also become technically mandatory for employees outside the central administration as well as for students, meaning that logging in without two-factor authentication will no longer be possible.
With the introduction of multi-factor authentication (MFA), the login process for various systems and services (see above) at the university will change. Instead of just entering a password, you will also have to provide a second authentication factor.
The introduction of MFA at the University of Siegen is based on the legal regulations from the agreement on cyber security of the Ministry of Culture and Science (MKW). This agreement requires universities in NRW to implement appropriate security measures to protect the integrity and confidentiality of data.
A token is a type of digital key. It is used to log in securely to a system or an app. A token can be a small device, a smartphone app or a special code, for example. One common type of token is a one-time numeric code that is only valid for a short period of time. In addition to the password, these codes are used to confirm that you are really authorized to log in.
You can think of it like the door of a safe. The safe has a combination lock and a key. For the combination lock, you need to know the corresponding combination, such as a password. The token, i.e. the second factor, is a physical key in this case, i.e. something you must have. You can only open the safe door if you have both.
This is also how it works digitally: you log in as usual with your username and password and confirm the login with a YubiKey or a TOTP authenticator app installed on your mobile device. This makes your access much more secure.
Multi-factor authentication (MFA) is a security procedure that makes access to an account or system more secure.
In addition to the password, at least one other factor, known as a token, is required. This factor can be, for example, a unique code from an app or text message, a fingerprint or a special USB stick.
The combination of several factors prevents unauthorized persons from gaining access to an account or system with the password alone.
Various services, such as the EU procurement portal, have also introduced mandatory MFA. If supported and available, you can use your YubiKey or your Authenticator app for this as well.
You can find more information here:
The following authenticator apps were tested for their supported parameters.
Please note: The apps are backwards compatible - an app that supports 60-second time steps also offers 30-second steps; an app with SHA512 support also allows SHA256 and SHA1.
| App | Maximum time step | Maximum algorithm |
|---|---|---|
| 2FA Authenticator | 60s | SHA512 |
| Aegis Authenticator | 60s | SHA512 |
| Bitwarden Authenticator | 60s | SHA512 |
| Duo Mobile | 30s | SHA1 |
| Duck Auth | 60s | SHA512 |
| FreeOTP | 60s | SHA512 |
| Google Authenticator | 30s | SHA1 |
| LastPass Authenticator | 60s | SHA512 |
| Microsoft Authenticator | 30s | SHA1 |
| Proton Authenticator | 60s | SHA512 |
| Yubico Authenticator | 60s | SHA512 |
Supported are:
Note: Two (TAN, PUSH) or five (TOTP, YubiKey, HOTP) tokens per token type can be active .
Note: If possible, we recommend setting up a TOTP and/or PUSH token on a smartphone or using a YubiKey.
Here you will find examples for alternative hardware and software if you cannot or do not want to use any of the above options.
However, we do not offer support for these!
Hardware:
Software:
The following (cheaper) alternative hardware tokens have been tested for their functionality in conjunction with eduMFA and their supported parameters.
You will usually receive the secret OTP key from the manufacturer or dealer of the hardware token, e.g. by e-mail.
| Hardware token | Token type | OTP length | Time step | Hash algorithm |
|---|---|---|---|---|
| ReinerSCT | TOTP | 6 | 30, 60 | SHA1, SHA256, SHA512 |
| Feitian C200 | TOTP | 6 | 30 | depending on the version purchased SHA1 OR SHA256 |
| Feitian A4B | HOTP | 6 | / | SHA1 |
| SWISSBIT iShield Pro | HOTP | 6 | / | SHA1 |
If you have any further questions, please contact the ZIMT SupportDesk, either
It may happen that the push notification does not reach your smartphone on time. To counteract this, you can take the following steps:
If the problem persists even after you have tried all the suggested solutions, please contact the ZIMT SupportDesk.
Sometimes it can happen that you receive an error message when logging into Webmail, for example:
"Try again after a while or contact the helpdesk"
The problem occurs due to outdated data in your browser's memory. Closing and restarting the browser often helps, in some cases so-called "cookies" must be deleted in the browser.
Alternatively, you can try logging in a "private" browser window.
If the problem persists in a private browser window, please contact the ZIMT SupportDesk.
If you have just enrolled a token for your account, it may take up to 10 minutes for the second factor to be requested (e.g. webmail login). You can check directly whether your account is secured by MFA by logging out of the MFA portal and logging in again. After entering your username and password, you should also be asked for the second factor in the MFA portal.
Please keep in mind that when submitting a support request regarding two-factor authentication, in some cases (e.g., if you have lost all your tokens), you may be required to present a valid form of identification and/or schedule an in-person appointment. Therefore, please have your identification document ready so that you can verify your identity.
