4G & 5G Onyx Portal MFA

Introduction

Multi-factor Authentication (MFA), also known as Two-Factor Authentication (2FA), is a layered approach to securing your Onyx Portal user account. Your Onyx Portal user ID/password is the first factor of authentication. A Time-based One-time Password (TOTP) generated by an authenticator app installed on your mobile phone is the second factor of authentication.

NOTE: MFA is enabled system-wide for all Onyx Portal users and cannot be disabled.

NOTE: If you log on to the Onyx Portal using your customer organization’s SSO credentials, you must follow your organization’s MFA requirements.

MFA workflow:

1. Install an authenticator app on your mobile phone. See Install Authenticator App.
2. Log on to the Onyx Portal and activate your MFA. See Activate Your MFA.
3. Whenever you log on to the Onyx Portal, use the current MFA OTP displayed in your authenticator app as your second factor of authentication. See Log On to the Onyx Portal.
4. If your mobile phone is compromised or lost, or your MFA backup codes are unavailable or exhausted, reset your MFA secrets. See Reset Your MFA Secrets or As Administrator Reset Onyx Portal User’s MFA Secrets.

Set Up MFA

To set up your MFA, you must have an authenticator app such as Google Authenticator, Microsoft Authenticator, or Duo Mobile installed on your mobile phone. If you don't already have one installed, proceed to the Install Authenticator App section. If you already have one installed, proceed to the Activate Your MFA section.

Install Authenticator App

To activate and use MFA, you must install an authenticator app on your mobile phone. Any authenticator app that generates TOTPs using the standard “HMAC-based One-time Password” (HOTP) algorithm—such as Google Authenticator, Microsoft Authenticator, or DUO Mobile—can be used. The authenticator app generates the TOTPs used as the second factor of authentication. This document describes how to use the Google Authenticator app, which is available for Android on the Google Play Store and for iPhone on the App Store.

Activate Your MFA

NOTE: Activating your MFA is a one-time procedure.

To activate your MFA:

1

Using a supported web browser visit https://portal.gxc.io.

The Onyx Portal Login page is displayed.

2

Enter the following details, then click Login:

• Email – (Required) Your Onyx Portal logon ID (email address).

The GXC IdP Login page is displayed.

3

Enter the following details, then click Login:

• Username – (Required) Your Onyx Portal username (email address).
• Password – (Required) Your Onyx Portal password.
• I’m not a robot – (Displayed only if you fail a login attempt. Required.) Select to validate reCAPTCHA—a seamless fraud detection service that stops bots and other automated attacks by rate-limiting log on attempts while allowing valid users.

  NOTE: The I’m not a robot checkbox for reCAPTCHA validation is displayed only if you fail an Onyx Portal login attempt. For example, when you enter an incorrect username or password. The Activate Multi-Factor Authentication dialog box is displayed.

  The Activate Multi-Factor Authentication dialog box is displayed.

4

On your mobile phone, open the authenticator app and scan the QR code displayed in the Onyx Portal > Activate Multi-Factor Authentication dialog box > QR Code section.

For example, if you are using the Google Authenticator app:

• If it is your first time setting up MFA in the app, click Scan a QR code.
• If you have previously set up other MFA in the app, click > Scan a QR code.
• If you are unable to scan the QR code, click Enter a setup key, then manually enter the alphanumeric key displayed in the Onyx Portal > Activate Multi-Factor Authentication dialog box > Setup Key section.

  To copy the setup key to your clipboard, click (copy).

  

  

  The authenticator app displays a six-digit OTP.

  This indicates you have successfully activated your MFA.

  Hereon, every time you log in to the Onyx Portal, you must use the current OTP displayed in your authenticator app as your second factor of authentication.

5

Save your MFA backup codes to a safe location.

After activating your MFA, whenever you log on to the Onyx Portal, if you are unable to obtain an OTP from the authenticator app, instead of an OTP, you can use one of the backup codes as your second factor of authentication. For more information, see MFA Backup Codes.

To save your MFA backup codes as a text file, in the Onyx Portal > Activate Multi-Factor Authentication dialog box > Backup Codes section > click (download).

NOTE: If you do not download your backup codes before you confirm your MFA activation (Step 6), a text file containing your MFA backup code is automatically downloaded to your computer. In your Downloads folder look for the most recent text file with the name format “OnyxPortal_BackupCodes__<date_timestamp>.txt”.

6

Confirm your MFA is activated (Step 4).

You can log on to the Onyx Portal up to five times without activating your MFA (Step 4). To skip activating your MFA (Step 4), click Skip. After you exhaust your five grace logins, to access the Onyx Portal you must activate your MFA.

To confirm your MFA is activated (Step 4), click Confirm MFA OTP. The Confirm MFA OTP dialog box is displayed.

Enter the MFA OTP displayed in the authenticator app on your mobile phone and click Submit.

The Onyx Portal Dashboard page is displayed.

Log On to the Onyx Portal

You can log on to Onyx Portal only if you have an Onyx Portal user account, or if SSO authentication is supported for your customer organization (i.e., your organization’s IdP is integrated with the Onyx Portal/Onyx IdP).

For information on how to log on with your Onyx Portal credentials, see Log On Using Your Onyx Portal Credentials.

For information to log on with your customer organization’s SSO credentials, see Log On Using Your Organization’s SSO Credentials.

Log On Using Your Onyx Portal Credentials

NOTE: Before you can log on to the Onyx Portal for the first time, you must activate your Onyx Portal user account. For more information, refer to Onyx Portal Operations Guide > Getting Started > Activate Your Onyx Portal User Account.

To log on to the Onyx Portal using your Onyx Portal credentials:

1

Using a supported web browser visit https://portal.gxc.io.

The Onyx Portal Login page is displayed.

2

Enter the following details, then click Login:

• Email – (Required) Your Onyx Portal logon ID (email address).

The IdP Login page is displayed.

3

Enter the following details, then click Login:

• Email – (Required) Your Onyx Portal username (email address).
• Password – (Required) Your Onyx Portal password.
• I’m not a robot – (Displayed only if you fail a login attempt. Required.) Select to validate reCAPTCHA—a seamless fraud detection service that stops bots and other automated attacks by rate-limiting log on attempts while allowing valid users.

  NOTE: The I’m not a robot checkbox for reCAPTCHA validation is displayed only if you fail an Onyx Portal login attempt. For example, when you enter an incorrect username or password.

  The 2FA page is displayed.

4

Enter the six-digit MFA OTP displayed in the authenticator app on your mobile phone, then click Login.

You are logged on to the Onyx Portal, and the Dashboard page is displayed.

NOTE: The six-digit OTP refreshes every 30 seconds and is valid only for one minute.

NOTE: If your mobile phone is not accessible or you are unable to obtain an MFA OTP, instead of an MFA OTP you can pro tem use an MFA backup code to authenticate your Onyx Portal logon. For more information, see MFA Backup Codes.

NOTE: If you are unable to obtain MFA OTPs to log in to the Onyx Portal and you have exhausted your MFA backup codes, you will have to create a support ticket to contact GXC Technical Support for assistance. When the message “You have exhausted your MFA backup codes. Please contact GXC Technical Support for assistance.” is displayed, click the “Technical Support” link to enter the “Onyx Support Portal” and create the support ticket. You are logged on to the Onyx Portal, and the Dashboard page is displayed.

Log On Using Your Organization’s SSO Credentials

NOTE: If you log on to the Onyx Portal using your customer organization’s SSO credentials, you must follow your organization’s MFA requirements.

NOTE: To use SSO authentication, your organization’s IdP must be integrated with the Onyx IdP. In this case, the user accounts exist in the customer IdP and are authenticated by the customer IdP.

To log on to Onyx Portal using your organizational SSO credentials:

1

Using a supported web browser visit https://portal.gxc.io.

The Onyx Portal Login page is displayed.

2

Click the Sign in to an Organization link.

3

Enter the following details, then click Login:

• Organization Name – (Required) Your organization’s name.

Contact your Onyx Portal administrator for the organization name to use.

NOTE: The Organization Name field is case-sensitive. Your organization’s IdP login page is displayed.

Your organization’s IdP login page is displayed.

4

Enter the authentication information required by your organization’s IdP and continue as instructed.

You are logged on to the Onyx Portal, and the Dashboard page is displayed.

MFA Backup Codes

After activating your MFA, if your mobile phone is unavailable or you are unable to obtain an OTP from the authenticator app, instead of an OTP, you can pro tem use a backup code as your second factor of authentication.

NOTE: You must make sure to save your backup codes that are displayed when you activate your MFA or whenever you reset your MFA secrets. For more information, see Activate Your MFA and Reset Your MFA Secrets respectively.

NOTE: Only if you have saved the backup codes that were generated when you activated your MFA or last reset your MFA secrets, whichever is recent, can you use the backup codes.

NOTE: The MFA backup codes are single use only and cannot be reused.

NOTE: If you have not saved your backup codes, or if you have exhausted all your backup codes, you can reset your MFA secrets to generate a new set of backup codes. For more information, see Reset Your MFA Secrets.

NOTE: When you reset your MFA secrets, any previous backup codes will become invalid.

NOTE: If you are unable to obtain MFA OTPs to log in to the Onyx Portal and have exhausted your MFA backup codes, you will have to create a support ticket to contact GXC Technical Support for assistance. When the message “You have exhausted your MFA backup codes. Please contact GXC Technical Support for assistance.” is displayed, click the “Technical Support” link to enter the “Onyx Support Portal” and create the support ticket.

Reset Your MFA Secrets

If your mobile phone is compromised or lost, or your MFA backup codes are unavailable or exhausted, you must reset your MFA secrets. Resetting your MFA secrets is equivalent to deleting your MFA registration, allowing you to set up your MFA again as if you are a new user.

To reset your MFA secrets:

1

In the upper-right corner of the Onyx Portal GUI, click the current Onyx Portal account’s name, then click Reset MFA Secrets.

NOTE: The Reset MFA Secrets option is enabled only if you have already activated your MFA. For more information, see Activate Your MFA.

The Reset MFA Secrets confirmation box is displayed.

2

To confirm you want to reset your MFA secrets, click Yes.

The Reset MFA Secrets dialog box is displayed.

3

On your mobile phone, open the authenticator app and scan the QR code displayed in the Onyx Portal > Reset MFA Secrets dialog box > QR Code section.

For example, if you are using the Google Authenticator app:

• If it is your first time setting up MFA in the app, click Scan a QR code.
• If you have previously set up other MFA in the app, click > Scan a QR code.
• If you are unable to scan the QR code, click Enter a setup key, then enter the alphanumeric key displayed in the Onyx Portal > Reset MFA Secrets dialog box > Setup Key section.

  To copy the setup key to your clipboard, click (copy).

The authenticator app displays a six-digit OTP.

This indicates you have successfully reset your MFA secrets.

Hereon, every time you log in to the Onyx Portal, you must use the current OTP displayed in your authenticator app as your second factor of authentication.

4

Save your MFA backup codes to a safe location.

Whenever you log on to the Onyx Portal, if you are unable to obtain an OTP from the authenticator app, instead of an OTP, you can use one of these backup codes as your second factor of authentication. For more information, see MFA Backup Codes.

To save your MFA backup codes as a text file, in the Onyx Portal > Reset MFA Secrets dialog box > Backup Codes section > click (download).

NOTE: When you reset your MFA secrets, any previous backup codes will become invalid.

NOTE: If you do not download your backup codes before you close the Reset MFA Secrets dialog box, a text file containing your MFA backup codes is automatically downloaded to your computer. In your Downloads folder, look for the most recent text file with the name format “OnyxPortal_BackupCodes__<date_timestamp>.txt”.

5

To confirm your MFA secrets are reset (Step 3), click Confirm MFA OTP.

The Confirm MFA OTP dialog box is displayed.

6

Enter the MFA OTP displayed in the authenticator app on your mobile phone and click Submit.

7

The next time you log on to the Onyx Portal, after your user ID/password is authenticated, the 2-Factor Authentication OTP dialog box is displayed. Enter the current OTP displayed in your authenticator app, then click Login.

After the OTP is authenticated, you are logged in to the Onyx Portal, and the Dashboard page is displayed.

As Administrator Reset Onyx Portal User’s MFA Secrets

If a user’s mobile phone is compromised or lost, and the user’s MFA backup codes are unavailable or exhausted, you can reset the user’s MFA secrets. Resetting a user’s MFA secrets is equivalent to deleting the user’s MFA registration, allowing the user to set up MFA again as if for a new user.

NOTE: You can reset another Onyx Portal user’s MFA secrets only if you are a GXC Administrator, GXC Partner Administrator, or a Super Administrator.

NOTE: If a user does not have access to his/her phone temporarily, the user can use their backup codes to log in. For more information, see Reset Your MFA Secrets.

To reset a user’s MFA secrets:

1

Switch to the required customer account.

To switch between Onyx Portal accounts, in the upper-right corner of the page, click the current Onyx Portal account’s name, then select the required account.

2

In the navigation pane, click Administration > Users tab.

The Administration page > Users tab displays the list of active user accounts.

3

For the user account that you want to reset MFA secrets, in the Actions column, click the corresponding ⋮ (options) icon, then click Reset MFA Secrets.

The Reset MFA Secrets confirmation dialog box is displayed.

4

To confirm resetting the user’s MFA secrets, click Yes.

Related Documentation

• 4G & 5G Onyx Portal Integration with Customer IdP Application Note
• GXC Glossary

Contact GXC

To get in touch with GXC, please visit https://gxc.io/contact-us/.