Docs / Security

Two-Factor Authentication

Two-factor authentication adds an additional verification step when a Lanview user signs in.

Lanview supports two-factor authentication for operator accounts managed by Lanview Server. It is used to reduce the risk of an account being accessed with only a password.

Two-factor authentication modes

Two-factor authentication is controlled by a Server-level setting.

Mode	Behaviour
`off`	Two-factor authentication is not required.
`optional`	Users may set up two-factor authentication, but it is not required for all users.
`required`	Users must complete two-factor authentication when required by the login flow.

The mode should be chosen to match the organisation’s access policy.

Where users set it up

Users set up two-factor authentication through the Lanview Studio account or sign-in process when prompted.

During setup, Lanview guides the user through enrolment and verification. Recovery codes may be provided depending on the configured flow.

Recovery codes should be stored securely by the user. They must not be pasted into tickets, audit reasons, documentation, chat messages or unsecured notes.

Trusted Studio devices

Lanview can track trusted Studio devices for two-factor authentication processes.

A trusted Studio device is associated with the operator’s Lanview sign-in experience. It should only be used on workstations that are under the organisation’s control and suitable for administrative access.

Trusted-device material must not be copied, shared or documented.

Admin reset

Administrators with the required permission can reset a user’s two-factor authentication state when the user loses access to their authenticator or recovery method.

A two-factor reset is separate from a password reset. Use the correct reset action for the problem being handled.

Required permissions

Permission	Allows
`security.manage_users`	Reset a user’s two-factor authentication state where supported.
`Settings.Server.Manage`	Change the Server two-factor authentication mode.
`security.manage_roles`	Use certain emergency local console two-factor commands where permitted.

Audit behaviour

Lanview audits two-factor authentication activity on the Server.

Audit records may include:

Two-factor setup completed.
Recovery codes regenerated.
Trusted Studio device created.
Trusted Studio devices revoked.
Two-factor reset by an administrator.
Local emergency reset.
Local emergency mode disable.
Failed two-factor console login.
Login requiring two-factor setup.

Audit records must not expose authenticator secrets, recovery codes, trusted-device tokens or verification values.

Emergency console commands

Lanview includes local emergency commands for recovery scenarios. These should be treated as break-glass operations, not routine administration.

Examples include:

auth 2fa status
auth 2fa reset <username>
auth 2fa mode off

Use emergency commands only when normal Studio administration is not available and the organisation’s recovery process allows it.

Configuration command

The Server two-factor authentication mode can be queried or changed through the configuration command where permitted:

config.auth.twoFactor.mode
config.auth.twoFactor.mode=off|optional|required

Use the command reference for the exact syntax supported by the installed version.

Good practice

Require two-factor authentication for privileged administrators where possible.
Keep recovery codes secure.
Review trusted devices periodically.
Use admin reset only when needed.
Treat emergency console recovery as a controlled support procedure.

Two-Factor Authentication