Skip to main content

Setup steps

To set up two-factor authentication with Twilio, you will follow the below setup steps:
  1. Enable network connection to Applaud Cloud
  2. Setup your Twilio account
  3. Set the Twilio API key
  4. Define who is required to use two-factor authentication
  5. Limit registration phone types
  6. Review the Oracle session timeout settings
  7. Schedule the 'De-register end-dated 2FA users' program

1. Enable network connection to Applaud Cloud

To communicate with Twilio, the app will require a network connection to Applaud Cloud. See Enable network connectivity to Applaud Cloud.

2. Setup your Twilio account

Create your Twilio account at https://www.twilio.com. When creating this account, consider that it will:
  • Require billing details configured to cover SMS charges
  • Provide access to end-user details who have registered for two-factor authentication
Follow these steps to create and configure your Twilio account:
  1. Sign up at the above location, and skip the introduction so you're taken straight to the dashboard.
  2. In the search box, type authy and select the Build with Authy option under the Authy category.
  3. In the Build with Authy setup steps, verify a phone number.
  4. In the second step, enter a friendly name for the application. For example, you could use Applaud.
  5. Select Create Application, and at this point, you no longer need to continue using the setup wizard. Instead, select Applications under the Authy menu on the left.
  6. Select the application you have just created, for example, Applaud and select the Settings option under the application sub-menu.
  7. Here you'll see the Production API Key. View this key and copy it (you'll need it for step 3). Be sure to keep this secure!
  8. Scroll down to TOTP Settings and change the OTP Length from 7 digits to 6 digits.
  9. Disable the Installation Message option, Disable the Authentication via Phone Call option, and then Enable the Force SMS option, and select Save at the bottom.

3. Set the Twilio API key

Using the API keynoted from step 2, copy and paste this into the XXAS: Twilio API Key (XXAS_TWILIO_API_KEY) profile option at Site level.
 

4. Define who is required to use two-factor authentication 

A  Permission Set called Applaud Two-Factor Required defines who is, and who is not, required to sign in using two-factor authentication.  When a user has been granted this permission, they will be forced to sign in using two-factor authentication.  When a user has not been granted this permission, they will not need to sign in using two-factor authentication.
This permission uses the Applaud FND User object.  This means you can create an Instance Set that uses a WHERE clause to further refine who has access.  For example, if you wanted to restrict to just a certain server you could create a custom profile option and set it at the server level:
WHERE fnd_profile.value('XXX_IS_DMZ') = 'Y'
This would then mean that only granted users access on the external tier would be required to sign in using two-factor authentication.
To grant access to this permission:
  1. Log in and navigate to the Functional Administrator responsibility.
  2. On Security: Grants, select Create Grant and enter the name.  For example, "Applaud 2FA Grant to All Users - Applaud Two-Factor required".
  3. Enter the Effective Start date and leave the Effective End Date blank.
  4. In the Grantee type, specify All Users if you want all users to use two-factor authentication, or specify Group of Users if you want 2FA only for certain roles or responsibilities.  You could also use it for a Specific User if you wanted to name super users to be 2FA secured.
  5. In the Grantee, specify the name of the role or responsibility (if Group of Users) or the name of a specific user (if Specific User).  If you've selected All Users, you do not need to complete this.
  6. Under Data Security, set the Object to Applaud FND User and select Next.
  7. If you wish to specify an Instance Set, set that here, and select Next to the last step.
  8. In the Permission Set, select Applaud Two-Factor Required and Finish.
  9. Clear the cache: Functional Administrator: Core Services: Caching Framework: Global Configuration: Clear All Cache: Confirm

You can continue to create multiple grants if you wish to grant using multiple combinations.

5. Limit registration phone types

When a user registers for two-factor authentication, they can pick the Phone Type they wish to use for their registration number.  By default, the app will show all phone types that you've configured.  

If you wish to change these default phone types, you can use form personalization to adjust the available phone types.  To do this:

  1. Register an Edit personalization Fast Formula against the registration form
  2. In this Fast Formula, override the list provider for the Phone_Type field.  For example: Phone_Type_List_Provider = 'XXX_My_Custom_Value_Set'
  3. Be sure to return this at the end of your Fast Formula

6. Review the Oracle session timeout settings

In most configurations, Oracle session timeouts tend to be fairly short: a user may be required to re-authenticate every 30 seconds or so.
In a two-factor authenticated environment, session timeouts tend to be a lot longer. For example, some are as long as 30 days.
You'll want to strike a balance between security and user convenience.
 

Poor experience alert: we strongly recommend against asking users to re-authenticate using two-factor authentication at very frequent intervals. This will be a frustrating and annoying experience and will likely reduce usage.

7. Schedule the 'De-register end-dated 2FA users' program

When you end-date a user (eg, when an employee leaves), you are left with an active user account in Twilio. To avoid this, you can schedule a concurrent program called De-register end-dated 2FA users. This will connect with Twilio and deactivate any Twilio users when the Oracle user is end-dated.
The recommended schedule for this program is Daily.
 

This process deactivates the Twilio user.  It does not remove the Twilio user completely.  Twilio does not have any way to remove users except for logging into the console and removing them by hand.  This means that if an ex-employee rejoins and re-registers for two-factor authentication using the same phone number as before, their existing deactivated Twilio account is reactivated.

Sections in this article