使用 Duo 作为多重身份验证 (MFA) 方法¶

This topic provides general information about using Duo in conjunction with multi-factor authentication (MFA), including administrative tasks that must be completed before users can use Duo as an MFA method. If you are a user who wants to set up Duo as your second factor of authentication, see Configuring a second factor of authentication.

Users don’t need to separately sign up with Duo or perform any tasks, other than installing the Duo Mobile application, which is supported on multiple smartphone platforms. For more information about supported platforms/devices and how Duo multi-factor authentication works, see the Duo User Guide (http://guide.duosecurity.com/) .

先决条件

The Duo application service communicates through TCP port 443.

To ensure consistent behavior, update your firewall settings to include the Duo application service on TCP port 443.

Copy codeExpand code block

*.duosecurity.com:443

Show lessSee more

Scroll to top

For more information, see the Duo documentation (https://duo.com/docs/duoweb#first-steps).

MFA 登录流程¶

下图说明了注册 MFA 的用户的整体登录流程，无论使用何种接口进行连接：

切换用于 MFA 的手机¶

即时还原是 Duo 的一项功能，允许用户在切换到新手机之前备份 Duo 应用程序。只要 Snowflake 用户先备份旧手机，就可以使用即时还原功能在新手机上启用身份验证，而不会中断 Snowflake 的 MFA。

If a user does not back up the old phone or loses the old phone, the Snowflake account administrator must help set up a new MFA method. For information, see Recovering a user who is locked out.

与 Duo 相关的 MFA 错误代码¶

以下是与 MFA 相关的错误代码，当用户使用 Duo 作为第二重身份验证因素时，在身份验证流程中可能会返回这些错误代码。

The errors are displayed with each failed login attempt. Historical data is also available in Snowflake Information Schema and Account Usage:

• Information Schema provides data from within the past seven days and can be queried using the LOGIN_HISTORY , LOGIN_HISTORY_BY_USER table functions.
• The Account Usage LOGIN_HISTORY view provides data from within the past year.