University of Bremen - Two-Factor Authentication

60 University of Bremen - Two-Factor Authentication https://www.uni-bremen.de/en/dezernat8/basisdienste/other-it-services/security-and-pki/two-factor-authentication [Translate to English:] Dokumentation der Zwei-Faktor-Authentifizierung an der Universität en University of Bremen Sat, 05 Sep 2026 01:38:06 +0200 Sat, 05 Sep 2026 01:38:06 +0200 University of Bremen content-639639 Thu, 27 Aug 2026 10:46:34 +0200 Registering an App/Token https://www.uni-bremen.de/en/dezernat8/basisdienste/other-it-services/security-and-pki/two-factor-authentication#c639639 If you want to use two-factor authentication, you need to e.g. install a corresponding app on a smartphone and then register it in the university system via self-service - a very simple procedure. After registration, if you log in to a service that has already been converted, you must enter a numerical code generated by the app in addition to your username and password, which changes every 30 seconds. <h3>Step 1: Installing a TOTP-enabled App</h3> The first step is to install a TOTP-enabled app on a smartphone. As the process is very simple, there are many such apps that you can simply download from your preferred app store. Aegis or FreeOTP are widely used. You don't need to worry about data protection. These apps do not store any information in the cloud - they do not require network access. Alternatively, some desktop applications, such as the password manager KeepassXC, can also manage TOTP access. It is generally possible to use hardware TOTP generators - however, as these devices have problems with the precise time required, we recommend using a smartphone. <h3>Step 2: Registering your Smartphones</h3> Once you have installed the application, go to <a class="externalLink" href="https://onlinetools.uni-bremen.de" title="Opens external link in new window" target="_blank">the onlinetools</a> and select the 'Two-factor authentication' page. Select the item 'Add TOTP token'.&nbsp; On the following page, you will see a QR code that you scan with the app you installed earlier. This completes the registration process. Content content-639640 Thu, 27 Aug 2026 10:47:18 +0200 Token lost? https://www.uni-bremen.de/en/dezernat8/basisdienste/other-it-services/security-and-pki/two-factor-authentication#c639640 If you no longer have access to the access codes, for example because your smartphone has been stolen or broken, you will no longer be able to log in to services that are secured with a second factor and will have to start a comparatively cumbersome process to reset your access. <blockquote>⭐ It is therefore advisable to register two devices as explained above if possible. If one of the devices is lost, you can log in with the second device, block access via the lost device and continue working without interruption.</blockquote> If there is no second device, you must reset your access by resetting your password. Resetting the password also allows you to log in with a temporary access code. You can then access your settings and add new tokens accordingly. Content content-639641 Thu, 27 Aug 2026 10:49:28 +0200 Supported Services https://www.uni-bremen.de/en/dezernat8/basisdienste/other-it-services/security-and-pki/two-factor-authentication#c639641 The services offered by the university will be gradually supplemented by authentication with a second factor where possible. The following have already been converted (not exhaustive): <ul> <li>All services secured via the central single sign-on (Shibboleth). This includes, for example, Nextcloud and the central self-service portal (onlinetools), but also all external services within the DFN-AAI (e.g. publisher access).</li> </ul> In the near future, the following services will also be secured with the second factor: <ul> <li>Stud.IP (Converted to Shibboleth)</li> <li>VPN</li> <li>Webmail</li> </ul> Services where the login is automated by an accessing program (e.g. e-mail) are more difficult to provide with a second factor due to the principle. We will add these at a later date. Of course, you can continue to use services that do not yet support 2FA even after registering for the second factor - the second factor will be ignored for these services and you will continue to log in with just your user name and password. Are you the administrator of your own service at the university and would like to use the central authentication services (and therefore also 2FA)? The best way to do this depends heavily on your application. Ideally, your service supports either OpenId Connect (OIDC) or SAML and can therefore be connected via OpenId or Shibboleth. Contact us at <a class="mail" href="mailto:campusserver@uni-bremen.de" title="Öffnet ein Fenster zum Versenden der E-Mail">campusserver@uni-bremen.de</a>, to find the optimal solution and discuss the next steps. Content content-639642 Mon, 13 Jul 2026 11:44:05 +0200 Data protection https://www.uni-bremen.de/en/dezernat8/basisdienste/other-it-services/security-and-pki/two-factor-authentication#c639642 No additional personal data is stored for the procedure. As part of the registration process, a random character string (so-called shared secret) is generated and stored both in your smartphone app and in the central user database. By linking this shared secret and the current time, a mathematical procedure generates the numerical code that you enter when you log in. There are no additional monitoring opportunities resulting from the use of this system. Content