Skip to main content
Feedback

Two-factor authentication

Updated 

Two-factor authentication (2FA) is a verification process that requires you to confirm your identity at sign in by providing a time-based one-time password (TOTP). The Boomi Enterprise Platform requires 2FA for all accounts. Follow the procedure in Setting up 2FA when you set up 2FA for the first time.

How it works

2FA is a required security feature for the Boomi Enterprise Platform. Enabling 2FA makes your account much less susceptible to security threats by placing higher requirements at the sign-in stage.

Typically, you sign in to the Boomi Enterprise Platform by providing your user name and password. 2FA takes this a step further, requiring you to also enter a temporary six-digit authentication code sent either directly to your account email or to an authenticator application on a device of your choice, such as a desktop computer or smartphone.

Boomi recommends the Google Authenticator application for Android and iOS mobile devices. For accounts with high-security requirements, Boomi recommends using the Okta Verify application. Before you begin, download an authenticators application to a device you can access easily and consistently. Refer to the authentication application's help guide for specific user instructions.

Setting up 2FA

2FA is required on all accounts. Administrators can also enable 2FA on accounts they manage. If your administrator enables account-level 2FA, you must set up 2FA on your user ID before you can sign in to or switch to that account.

Once your administrator enables 2FA on your account, follow the setup instructions starting from Step 2 below to complete configuration.

  1. Select Settings > and click the Authentication under the My User Settings section.

  2. Choose an authentication method: Email Verification or Authenticator App.

    • Email verification:

      • Select Continue to send an authentication code to email associated with your account.
      • Click Enter Code. You will receive an email from Okta with a six digit TOTP.
      • Enter the six digit code from your email, then select Use this method.

    • Authenticator App:

      • Open an authenticator application of your choice and add a new account.
      • Scan the QR code or enter the Setup Key to complete account setup.
      • Select Continue. Enter the six digit code from your authenticator application app, then select Use this method.

  3. The chosen authentication method shows as active in the Two-factor Authentication toggle box.

Changing 2FA methods

You can change your 2FA authentication method at any time. To switch authentication methods, select Change Method in the Two-factor Authentication toggle box and follow the instructions in Setting Up 2FA from Step 2.

Resetting 2FA

You might need to reset 2FA if you have been locked out of your account. Currently, you must contact Boomi Support to reset 2FA for your account. You can access Boomi Support through the Resources menu in Platform.

Changing 2FA devices

You may need to change the device you use for 2FA. Follow the instructions below to set up Authenticator App 2FA on a new device.

  1. Select Change Method from the Two-factor Authentication toggle box and follow the instructions in Setting Up 2FA to enroll in Email Verification.
  2. Once enrolled, select Change Method.
  3. Follow the steps in Setting Up 2FA to set up Authenticator App 2FA on your new device.

Backup codes

info

Backup codes are generally only available for legacy FedRAMP users and their sub-accounts.

Technology is not always reliable. If you can't access your Time-based one-time password (TOTP) authenticator application, for example if your phone is broken or lost, Boomi provides backup codes as an alternative way to fulfill 2FA requirements and sign in to the Boomi Enterprise Platform.

Unlike codes from a TOTP authentication application, you can generate backup codes in sets of 10 from the interface and should download them immediately to a secure location, like a password manager. Each code works only once, so track which codes you have already used. Boomi recommends that you treat your backup codes with the same level of security as you would a password.

If you can access neither the authenticator application nor your backup codes to sign in, contact your Boomi account administrator. After verifying your identity, they will contact Boomi Support on your behalf. Allow Support up to two business days to resolve access to your account.

You generate backup codes during 2FA setup for use in emergency situations, and each acts as a supplementary, one-time-use code.

Regenerating backup codes for 2FA

After initial 2FA setup, you can regenerate backup codes by navigating to Settings > My User Settings > Authentication > Regenerate Backup Codes. Generating new codes will invalidate the previous set you have generated.

2FA with single sign-on

2FA is required even when you sign in to the Boomi Enterprise Platform using single sign-on (SSO). Administrators who have both SSO and 2FA enabled have the flexibility to sign in manually, using their Platform credentials. 2FA remains a requirement either way, and when they sign in manually, they complete it by entering an authentication code generated by their TOTP authenticator application.

Authenticating API calls with 2FA

When accounts are enabled with 2FA, Boomi provides two ways for you to authenticate your API calls: API tokens or using an authentication code generated from your TOTP application.

API tokens are generally used when you regularly make calls to an API from your 2FA account. API tokens allow you to automate your calls using a single token that is generated straight from the Boomi Enterprise Platform. You can add API tokens from the Settings menu > My User Settings > Platform API Tokens page. For more information about API tokens, refer to the topic Platform API Tokens settings. For more information about how to authenticate API calls using an API token, refer to the Platform API and Partner API authentication topic.

Without an API token, you are required to enter a new TOTP authentication code in your API call tool. However, authentication codes expire every 60 seconds and therefore require you to frequently reenter new codes to make new or additional calls. This method is ideal for when you make infrequent calls or in ad-hoc scenarios. In this case, enter X-Boomi-OTP as an HTTP header in your API call tool of choice, and enter a TOTP authentication code as its value. For more information about how to authenticate API calls, refer to the Platform API and Partner API authentication topic.

On this Page