You need to install a program on your personal computer which will

• store the secret key that the IL authentication system will share with you
• calculate TOTP passcodes using the secret key as a seed

We advise Free Softwares such as KeePassXC (multiplatform with GUI) or the OATH Toolkit (GNU/Linux terminal), but you are free to choose any programs that implement the open OTP standards.

Navigate to any of the Lorentz Institute SSO web applications, for instance our Remote Workspace.

You will be redirected automatically to the Lorentz Institute Identity Provider login page as in Figure 1.

Figure 1: Identity Provider login page

Enter your IL credentials to sign in. Upon successful login, you will be redirected to a page containing a QR code. Click on “Unable to Scan?” to display your shared secret key and the other parameters to input in your OTP program to set it up (Figure 2).

Note the secret key, the algorithm, the number of digits, and the time interval. You will need them in Step 3.

Figure 2: TOTP Setup Page (QR code and other sensitive information deliberately blurred)

Open KeePassXC (installed on all IL workstations), create a new passwords database if you do not want to use an existing one and click on Entries → TOTP → Set Up TOTP. Insert your private key, algorithm, time interval and number of digits from Step 2 and confirm by clicking on `OK'.

Figure 3: TOTP Setup with KeePassXC. Use the TOTP settings described in Step 2.

Generate a OTP by clicking on Entries → TOTP → Show TOTP. Insert this TOTP in the One-time code form input and, if you wish, a label in the form input called Device Name. This label is meant to help you keep track with which device the secret key has been shared. Click on Submit.

Figure 4: TOTP generation KeePassXC and final 2FA setup on the Lorentz Institute Identity Provider

If Step 3 succeeds (errors might occur if there is too much lag time, i.e. the OTP expired), the system will send you an email to your private (not @lorentz) e-mail address with precise instructions on how to verify your identity. If your identity cannot be validated, you will not be granted access to the system.

Figure 5: Verify your private email address

Verify your identity by visiting your private email inbox. You should have received an email from the Lorentz Institute Identity Provider ¹⁾. Open that email and copy (for instance using on most platforms Control-C or right-mouse click copy) the secret code in the body of the message. Visit https://www.lorentz.leidenuniv.nl/idp/ and paste (on most platforms Control-P or right-mouse click paste) the secret code in the white text area. Click on `Submit'. Your identity is now verified.

Figure 6: Screenshot of e-mail verification process.

Click on Back to application to redirect your browser to the Lorentz Institute SSO web application from which you started the whole process or close the browser. Your setup is complete.