Two-Factor Authentication (2FA)
OpenMES supports Time-based One-Time Password (TOTP) two-factor authentication. When enabled, users must enter a 6-digit code from their authenticator app along with their password at every login.
Supported Apps
OpenMES works with any TOTP-compatible authenticator application, including:
- Google Authenticator
- Authy
- Microsoft Authenticator
- Any other app that supports the TOTP standard (RFC 6238)
Setup Process
To enable two-factor authentication on your account:
- Navigate to Settings > Two-Factor Authentication.
- Scan the QR code with your authenticator app. If you cannot scan the code, click "Show manual key" and enter it into your app by hand.
- Enter the 6-digit verification code displayed in your authenticator app to confirm the setup is working.
- Save the backup codes securely (see below).
- From now on, every login requires your email, password, and a fresh TOTP code from the app.
Backup Codes
During setup, the system generates a set of one-time backup codes. Each code can be used exactly once in place of a TOTP code. Store these codes safely – print them and keep them in a secure location, or save them in a password manager. They are your lifeline if your authenticator app becomes unavailable (lost phone, broken device, app deleted).
Why 2FA Matters for Manufacturing
MES systems hold sensitive data – recipes, process settings, customer orders, quality records, and employee information. If an account is compromised, an attacker could:
- Change production orders (sabotage)
- View private customer data (data breach)
- Alter quality records (compliance violation)
Two-factor authentication greatly reduces this risk. Even if a password is stolen, the attacker still needs the user's physical authenticator device. For manufacturers following FDA 21 CFR Part 11, ISO 27001, or customer cybersecurity policies, 2FA is often a hard requirement.
Recovery
If you lose access to your authenticator app:
- Use one of your backup codes to log in.
- Go to Settings > Two-Factor Authentication and disable 2FA.
- Re-enable 2FA by scanning a new QR code on your replacement device.
Administrators can also reset 2FA for any user from the user management screen, which is useful when an employee has no backup codes available.
A medical device manufacturer's biggest customer requires 2FA for all systems that touch their product data. The IT administrator turns on "Mandatory 2FA" in OpenMES Settings. On the next login, every user is walked through the QR code setup – most finish in under 2 minutes. The administrator checks the user list, which now shows a "2FA Active" badge next to each user. The customer audit passes with no findings on MES access control.
Operator Jakub drops his phone and the screen cracks. He cannot open the authenticator app. He uses one of the backup codes stored in his locker to log in. Then he goes to his profile, turns off 2FA, and turns it back on by scanning a new QR code on his replacement phone. The whole recovery takes 5 minutes with no help from IT – though an administrator can also reset 2FA for any user from the user management screen.