Configure authentication policies

Authentication#

In the app: Policies > Authentication (Superuser only, Alpacon Cloud/Auth0 workspaces).

Configure workspace authentication policies. Saving a change asks for MFA only when the workspace’s recent verification window has expired.

MFA enforcement:

• When enabled, all workspace members must complete MFA during login.
• Members without any MFA method configured will be prompted to set one up on their next login.

Allowed MFA methods:

Select which MFA methods members can use (multiple selection):

• Hardware security key: an external WebAuthn key, such as a YubiKey, that the member plugs in or taps.
• Biometric authentication (FaceID, Fingerprint): the fingerprint, face, or screen-lock check built into the member’s device.
• One-time password: a rotating code from an authenticator app such as Google Authenticator.
• Email: a code sent to the member’s email.
• Recovery code: a one-time backup code.

Hardware security key and biometric authentication are WebAuthn methods. If you select either, the console also requires at least one of email, one-time password, or recovery code as a fallback. With MFA enforced on, at least one method must be selected.

Passkeys and allowed MFA methods#

A passkey lets a member sign in with their device’s fingerprint, face, or screen lock instead of a password. Members add passkeys from the Passkeys tab in their account settings. A passkey is a sign-in method, not one of the allowed MFA methods, but it uses the same WebAuthn check as biometric authentication and hardware security keys. Whether a passkey sign-in also counts as MFA therefore follows the allowed MFA methods:

• Counts as MFA when no method is selected, or when the list includes biometric authentication or a hardware security key.
• Doesn’t count when the list includes neither, for example one-time password only. With MFA enforced, the member signs in with the passkey and is then asked to verify with an allowed method. Without it, the member is asked when an action requires MFA.

There is no separate passkey switch. To stop passkey sign-ins from counting as MFA, allow only methods other than biometric authentication and hardware security key.

How this interacts with the other settings:

• MFA enforced: decides whether login asks for MFA at all. With it off, a passkey sign-in matters only for step-up.
• Step-up: for the actions under Require MFA for, and for sensitive actions such as sudo, a passkey sign-in counts as a fresh verification under the same rule while it is within the MFA timeout (the Sensitive action MFA timeout for sensitive actions). After that window, or when the passkey doesn’t count, the member verifies again with an allowed method.

MFA timeout:

• Maximum duration that MFA authentication remains valid after completion
• Set for the whole workspace. Members cannot shorten it for themselves.
• Shorter timeouts provide stronger security but require more frequent re-authentication.
• Privilege elevation (sudo) uses a shorter window of its own, so it may ask again while other actions still count as verified.

Sensitive action MFA timeout#

Sensitive action MFA timeout sets how long a completed MFA check remains valid for sensitive actions, including security setting changes and enrolling an MFA method. The default is 15 minutes. After it expires, the next sensitive action asks for verification again. Other actions use MFA timeout. Set the sensitive window long enough for members to finish enrolling a new MFA method.

MFA required actions:

On Enterprise, select which actions require members to re-verify MFA beyond the login check that MFA enforced covers. None are selected by default:

• Server actions: upgrading or restarting the agent, and installing alpamon-pam
• Web terminal: connecting as a system account other than your own
• Code editor: opening the editor as a system account other than your own
• File transfer: transferring files as a system account other than your own
• Command: running a command as a system account other than your own
• Approval decisions: approving or rejecting a request as a reviewer