Module 7 · 7.3

English

Nederlands English Deutsch Français Español

Users, roles and two-factor authentication

Module 7: Collaborating, apps and security · Reading time: 11 minutes

Learning objective: After this lesson, you can set up users and admins in your new service safely, choose the right form of two-factor authentication, and set up a fixed routine for new and departing colleagues.

Key concepts: account per person, admin, owner, role, least privilege, two-factor authentication (2FA), TOTP, passkey, security key, WebAuthn, backup codes, app password, revoke session, single sign-on (SSO), onboarding and offboarding, transferring ownership

A switch is a chance to tidy up

During the stock-take (lesson 3.1), it turned out that Bakkerij De Korrel has 15 Google accounts for 12 people. Two belong to people who left long ago, and one account, winkel@example.com, is used by four people with the same password, which hangs on a note by the till. This is very common. When you switch, you don't carry over habits like this, you fix them straight away.

One account per person

The basic rule: every person gets their own account, with their own password and their own second step. Why?

You can see who did what (activity, versions, who shared something).
If someone leaves, you disable one account and nobody else needs to learn a new password.
Two-factor authentication only works properly if the second step belongs to one person.

Shared addresses such as winkel@example.com or info@example.com can still exist, but as a shared mailbox, alias or group: several people read along using their own account. The exact name and workings depend on the provider (lesson 4.4).

Roles: who's allowed to do what?

Every cloud service has at least three levels:

Role	What	At De Korrel
Provider	The server, security, updates, backups of the system	The cloud service
Admin or owner	Creating and disabling users, resetting passwords, licences, storage	Owner Fatima and office manager Ruud
User	Own files, sharing, calendar, password and second step	Everyone

Two rules of thumb:

Least privilege. Give someone only the rights they need. A baker doesn't need to be able to create users.
At least two admins. If there's only one, and that person is ill, on holiday or has left, nobody can reset a password or cancel the service. Have two admins, each with their own account and their own second step, and make sure the admin account details with the provider (the contract) are in the organisation's name, not one person's.

Be aware of the difference between managing the package and access to files. A good service lets an admin manage accounts without being able to look into other people's files. But whoever can reset a password can then log in as that person, if the second step goes to an address they can read. So choose each user's own email address as the recovery and code address.

Two-factor authentication: why and which

A password alone isn't enough. Passwords leak in data breaches on other sites, get guessed, or are obtained through phishing. The National Cyber Security Centre (NCSC), the Dutch national body, advises using two-factor authentication wherever possible. With two-factor authentication (2FA), you need something you have, besides your password: your phone, a key or your mailbox.

Second step	How it works	Strong and weak points
Code by email	The service emails a code	Easy; only as safe as your mailbox. So secure that well
Code by text message	The service texts a code	Better than nothing; vulnerable if someone takes over your number (SIM swap fraud)
Authenticator app (TOTP)	An app on your phone generates a new six-digit code every 30 seconds	Works offline, widely used. A fake site can still intercept a code if you enter it there
Notification on another device	You approve the login on a device where you're already logged in	Easy; be careful not to tap "approve" without thinking
Passkey or security key (WebAuthn)	Your phone, computer or a key (such as a YubiKey) confirms with a fingerprint, face or PIN	The strongest against phishing: only works on the real site

TOTP stands for time-based one-time password, described in RFC 6238. The service and your app share one secret key (which you copy over using a QR code) and both calculate the same code from the key and the time. That's why your phone's clock needs to be accurate.

Passkeys are based on the WebAuthn standard from W3C and FIDO. Your device creates a key pair for each site. Because the key is tied to the real address of the site, a fake site can't do anything with it. More and more services support passkeys as a second step, or even instead of a password.

Backup codes and the day you lose your phone

Any second step can fail: a lost phone, a broken one, or a new phone without transferring the app. That's why:

Generate backup codes (usually ten codes, each usable once) and keep them not on the same phone. Print them with your important papers, or store them in a password manager (lesson 7.4).
Turn on at least two methods, for example an authenticator app plus an email code, or a passkey plus backup codes.
Got a new phone? Transfer the authenticator accounts first, before wiping or handing in the old one.

If someone still ends up locked out, the admin can help (for example by changing the email address to one the user can actually read), or the provider can help, after checking who's making the request. That check deliberately takes a moment: a provider that disables the second step without checking also helps a scammer.

App passwords and sessions

Apps that can't enter the second step get their own app password (lesson 7.2). One per app per device, with a recognisable name. In the overview of devices and sessions, you can see where someone is logged in. That's where you revoke a stolen phone or an old laptop. Check it occasionally, and definitely whenever someone leaves.

Single sign-on (SSO)

Larger organisations let people log in to multiple services with one account: single sign-on or SSO, often through standards such as SAML or OpenID Connect. Be careful: if you currently use "Sign in with Google" or "Sign in with Microsoft" for other services (accounting, planning, webshop), you'll lose that access once you cancel your Google or Microsoft account. This was listed as a hidden link in your stock-take (lesson 3.1). Switch those services over to logging in with email and password, or to your new SSO, before you cancel.

Onboarding and offboarding: a fixed routine

Most problems don't happen during the switch itself, but a year later, when someone leaves and nobody knows what to do. So set a fixed routine now (exercise E7.3):

New colleague: create an account with their own email address, assign groups and licences, pass on the details securely (password through a different channel), do the first login together, set up the second step and backup codes, install apps.

Departing colleague: first transfer ownership of files and folders (in many services, a deleted account means all its files are gone for good), move over shared calendars and folders, free up the licence, disable the account (don't delete it straight away), revoke app passwords and sessions, forward mail or keep it as a shared mailbox, and only delete it after an agreed period.

In practice: what it looks like with a provider

With a WebOké Nextcloud, nobody is an admin within Nextcloud itself. The package owner manages users in My WebOké, under Gebruikersbeheer (user management) on the package page: add a user, change a password, disable or delete one, and switch the Office licence on or off. Each user manages their own security in Nextcloud under Settings, Security: the code by email is always on, and this is where you turn on an authenticator app (TOTP), backup codes, a passkey and app passwords, and where you see Apparaten & sessies (Devices & sessions).

With other providers, it works in a similar way: there's a management area for accounts and a security page per user. The names of the buttons differ.

Summary

One account per person; shared addresses become shared mailboxes or groups.
Least privilege and at least two admins; the contract in the organisation's name.
Turn on two-factor authentication for everyone. Passkeys and security keys are the strongest against phishing; TOTP is a good, widely used choice.
Keep backup codes off the same phone, and use at least two methods.
Set a fixed onboarding and offboarding routine: transfer first, then disable, delete only later.

Quiz

Exercise

Exercise E7.3: Roles and onboarding/offboarding routine. Create a roles overview for your organisation (who's an admin, who isn't, who's the second admin) and fill in the onboarding and offboarding checklist for your own service. Turn on two-factor authentication on your own account and confirm that your backup codes are kept somewhere other than your phone.

Exercise E7.3: Roles and onboarding/offboarding routine

Fill in the roles overview and both routines for your own organisation, and turn on 2FA on your own account.

Onboarding: account with their own email address, groups and licences (only what's needed), password sent via another channel, logging in together the first time, second factor plus backup, backup codes kept off the phone, apps set up, correct vaults.
Offboarding: files and folders handed over, shared calendars and teams handed over, mail arranged, licence freed up, account disabled (not deleted), app passwords and sessions revoked, removed from vaults and shared passwords changed, removed from "Sign in with" links, deletion date noted.
I have two-factor authentication enabled on my own account, with at least two methods, and my backup codes are not stored on my phone.

Who are the administrators (at least two)? Who is the backup person?

Whose name is the contract with the provider under?

Which shared addresses are there, and will they become a shared mailbox, alias or group?

Which services currently use "Sign in with Google/Microsoft", and how will you log in to them after the switch?

Which second step do you choose as the default for everyone, and which as the backup?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing