Sign-in and two-factor authentication
Most people only think about signing in when it stops working. This page covers the two-factor prompt, what to do when an authenticator code is refused, and what an admin can and can't fix for someone else.
It's about Oho's own sign-in. If your organisation uses single sign-on, your identity provider owns all of this — passwords, two-factor, lockouts — and nothing here applies.
Is two-factor on?
Two-factor is an organisation-wide switch, off unless someone turned it on. An admin finds it under Settings → Manage → Security, as Two-Factor Authentication (2FA).
Turning it on applies to everyone who signs in with an Oho password. Nobody is locked out immediately: each person is asked to set up an authenticator app the next time they sign in.
Setting it up
At the next sign-in, Oho shows a QR code. Scan it with any authenticator app that does standard 6-digit time-based codes — Google Authenticator, Microsoft Authenticator, Authy, 1Password, your phone's built-in password manager. There's nothing Oho-specific to install.
Enter one code to confirm the pairing, and Oho then shows you eight backup codes.
They are shown once and never again. Each one works a single time, in place of a code from the app — they are the only way back in if you lose the phone, and without them the account has to be deleted and recreated. Put them where you keep passwords, not on the phone running the authenticator.
From then on, signing in is password, then a 6-digit code.
"My code isn't accepted"
Work through these in order. The first three are by far the most common.
- Check the phone's clock. Codes are tied to the time, and Oho accepts a code for about 90 seconds around now. A phone whose clock has drifted a minute or two generates codes Oho has already moved past. Turn automatic date and time on, then try again.
- Check which entry you're reading. An authenticator holding more than one Oho entry — a leftover from a previous enrolment, or from the old Oho — will happily show a valid-looking code from the wrong one. Delete the stale entries.
- Type it before it rolls over. If the digits change while you're typing, wait for a fresh code and enter it straight away.
- Use a backup code. Any of the eight works once, in the same box.
- Ask an admin. See below for what they can actually do.
Changing or losing the phone
Be plain about this one, because it shapes everything else: once an account is enrolled, Oho has no screen for re-pairing it and no admin action to reset it. Enrolment happens once, during a sign-in, and only for an account that isn't enrolled yet.
So the Oho entry in the authenticator app is the thing to protect:
- Getting a new phone? Move the Oho entry across before you wipe the old one — most authenticator apps have a transfer or export for exactly this. Don't rely on being able to re-scan a code later, because there won't be one.
- Lost the phone, still have backup codes? Each code signs you in once. Eight codes buys time, not a fix — the account still can't be re-paired, so use one to get in and then sort out the account properly.
- Lost both? The account has to be rebuilt. See below.
What an admin can do
| They want | What an admin does |
|---|---|
| A forgotten password | ⋮ → Reset Password on their row sends a fresh link. Their two-factor enrolment is untouched. |
| Out of the organisation entirely | ⋮ → Delete User. |
| Back in, with no phone and no backup codes | ⋮ → Reset MFA on their row clears the pairing. They set up a new authenticator at their next sign-in. |
Reset MFA is for the person who has run out of ways in: no phone, and the eight backup codes spent. It clears the pairing and nothing else — the password, the role and the organisations all stay as they are, and the next sign-in walks them through a new QR code and a fresh set of backup codes. It is limited to Admins and Super Admins, and who reset whose enrolment is recorded.
A password reset is the other half and keeps the enrolment, so reach for it when the password is the problem. Re-sending an invitation to an address that already has an account is still rejected outright — an invitation creates an account, it can't repair one.
A reset does not end a session the person already has open. If the concern is that somebody else holds their phone, deactivate the account rather than resetting it.
Keep more than one Super Admin, and keep the backup codes somewhere other than the phone. Both turn a lost phone from a lockout into an inconvenience.
Re-sending an invitation
Someone who was invited but never activated their account is on the Pending tab under Settings → Access → Users & Groups, and can be sent a fresh link from there. A fresh link invalidates the earlier one, so make sure they use the newest email.
Once someone has activated their account they're no longer pending, and an invitation is the wrong tool — use Reset Password for a forgotten password, and the table above for anything to do with two-factor.
Related
- Invite your team & assign roles — bringing people in
- Manage your users — roles, organisations, password resets, deletion
- Set up SSO — when your identity provider signs people in instead
- Moving from the old Oho — signing in for the first time after a move