How to Set Up Two-Factor Authentication in a Niagara Station (Google Authenticator)

Niagara 4 supports two-factor authentication with Google Authenticator: add the Google authentication scheme, assign it to users, and have each user enrol a TOTP app.

Passwords alone are no longer enough for systems that control buildings. Phishing, password reuse and shared accounts are among the most common ways attackers get into building systems. Two-factor authentication (2FA) adds a second check, a six-digit code from an app on the user's phone, so a stolen password is not enough to log in. This guide explains how 2FA works in Niagara 4, how to set it up with Google Authenticator, and how to avoid locking people out.

How two-factor authentication works in Niagara 4

Niagara 4 handles logins through the Authentication Service (Config > Services > AuthenticationService). It contains authentication schemes, each defining a way users can prove who they are. Each user is assigned one scheme through their Authentication Scheme Name property.

For two-factor authentication, Niagara provides a Google Authenticator scheme (from the Google authentication module, often referred to as "gauth"). It uses the standard TOTP (time-based one-time password) method, so it works not only with Google Authenticator but also with Microsoft Authenticator, Authy and other TOTP apps.

When a user assigned the Google scheme logs in:

1. they enter their username and password
2. Niagara asks for the current six-digit code
3. the user opens their authenticator app and enters the code, which changes every 30 seconds
4. Niagara checks the code against the user's secret key and the current time

Before you start

• Niagara version: use a current Niagara 4 release; Google authentication has been available for many releases. Keep the station on the latest maintenance update.
• Accurate time: TOTP depends on time. The station host must have the correct time, ideally from NTP. A clock even a minute or two out causes valid codes to be rejected.
• HTTPS: use HTTPS for web logins and FoxS for Workbench, so passwords and codes are encrypted in transit.
• A recovery path: keep at least one administrator account that you can always access, and know how you will recover a user who loses their phone (see below).
• A backup of the station before changing authentication settings.

Step-by-step setup

Step 1: Add the Google authentication scheme

1. Open the station in Workbench and expand Config > Services > AuthenticationService > Authentication Schemes.
2. Open the palette for the Google authentication module.
3. Drag the Google authentication scheme into Authentication Schemes.
4. Review its properties, such as the allowed time window (how many 30-second steps either side of the current time are accepted). Keep the window small; widen it only if users have phone clock issues.
5. Save the station.

Step 2: Assign the scheme to users

1. Open Config > Services > UserService.
2. Open a user's property sheet and set Authentication Scheme Name to the Google scheme.
3. For many users, use the user prototypes or the batch editor to apply the setting consistently.

Start with one test user, not everyone at once.

Step 3: Enrol the user's authenticator app

Each user needs a secret key shared between Niagara and their app:

1. The user's Google authenticator settings generate a secret key, shown as a QR code and text.
2. The user scans the QR code with their authenticator app (or types the key).
3. The app starts showing six-digit codes for the station.
4. The user logs in with password and code to confirm it works.

Depending on configuration, enrolment is done by an administrator in Workbench or by the user at their first login. Niagara 4.14 improved the Google Authenticator enrolment workflow, so on current releases enrolling users is noticeably simpler; another reason to keep stations up to date. Never send QR codes or secret keys by email or chat; treat them like passwords.

Step 4: Test before rolling out

• Log in through the web browser with the test user.
• Log in through Workbench (station connection) with the same user.
• Test from a phone with a slightly wrong clock to see how tolerant the time window is.
• Check the security audit log records the logins.

Step 5: Roll out by role

Apply 2FA first to administrator and engineer accounts, which have the most power, then to operators. Communicate the change in advance, with simple instructions and a contact for help.

Which accounts should use 2FA?

Recovering a user who has lost their phone

Plan this before rollout:

1. An administrator resets the user's Google authenticator secret (or temporarily assigns a password-only scheme) from the UserService.
2. The user re-enrols with their new phone.
3. The administrator restores the Google scheme on the account.

Keep at least two administrator accounts with 2FA held by different people, plus a documented break-glass procedure, so one lost phone never locks the organisation out.

2FA with LDAP and single sign-on

Many organisations prefer to manage identities centrally. Niagara can authenticate users against LDAP / Active Directory (see LDAP integration), and corporate identity providers can enforce their own multi-factor policies. Choose one approach per user: Google authenticator for local station accounts, or centrally managed identities for corporate users.

Troubleshooting

Valid codes are rejected. The station's clock or the phone's clock is wrong. Configure NTP on the controller and make sure the phone sets its time automatically.

User never asked for a code. The user's Authentication Scheme Name is not the Google scheme, or the login used a different path. Check the user's properties.

QR code will not scan. Enter the secret key manually in the app.

Workbench connection fails after enabling 2FA. Make sure your Workbench version matches the station and supports the scheme; update to the matching maintenance release.

Locked out completely. Use another administrator account. If none exists, the station must be recovered offline (see resetting a passphrase and admin account).

Rolling out 2FA without disruption

A smooth rollout matters as much as the configuration:

1. Pilot with the controls team for a week. Fix any issues with time sync, phone apps or Workbench versions.
2. Write a one-page guide for users: which app to install, how to scan the code, what to do if they change phones, and who to call.
3. Schedule enrolment sessions so users enrol with someone on hand to help.
4. Enable for administrators and engineers first, then remote users, then operators.
5. Review after a month: check the security audit log for failed logins and lockouts, and adjust.

For estates with many stations, standardise the scheme settings, user prototypes and procedures across all stations, so users have the same experience everywhere.

2FA and supervisors with many controllers

On a Web Supervisor that operators use as the single front end, enabling 2FA on the supervisor protects most day-to-day access. Engineers who connect directly to controllers should also be protected. Apply 2FA to engineer accounts on controllers that are reachable from wider networks, and make sure machine-to-machine accounts used by the supervisor's Niagara network connections are not assigned the Google scheme, since they cannot enter codes.

Settings to review after setup

Once 2FA is running, review these settings across the station:

• Password policy: minimum length and complexity still matter; 2FA is a second factor, not a replacement.
• Account lockout: lock accounts after repeated failed attempts, with a lockout period that slows attackers without stranding legitimate users for long.
• Session timeouts: idle web sessions should expire, especially on shared PCs.
• Plain-text services: disable HTTP and plain Fox so credentials and codes are always encrypted.
• Unused accounts: remove or disable accounts that are no longer needed, including old contractor accounts.
• Time synchronisation: confirm NTP is configured and working on every station that uses 2FA.

Auditing logins after enabling 2FA

Niagara records security events such as successful and failed logins in its security audit log. After enabling 2FA:

• review failed logins weekly for the first month to catch users having trouble, and to spot attempted logins with stolen passwords
• look for repeated failures from unexpected locations or at unusual times
• confirm that accounts which should use 2FA actually show code-verified logins

If your organisation has a security operations team, ask whether Niagara's logs can be forwarded to their monitoring system.

How TOTP codes work

Each user's app and the station share a secret key created at enrolment. Every 30 seconds both calculate a six-digit code from the secret and the current time. If the user's code matches the station's (within the allowed time window), the login succeeds. Nothing is sent over the internet to generate codes, so it works on isolated BMS networks as long as the station's clock is right. It also means anyone who sees the secret or QR code can generate valid codes, which is why enrolment details must be protected like passwords.

Wider security checklist

Two-factor authentication works best alongside:

• unique accounts for every person, with no shared logins
• least-privilege roles and categories
• HTTPS and FoxS only, with plain-text ports disabled
• strong password policies and account lockout
• current Niagara versions and signed modules
• network segmentation and secure remote access, never ports open to the internet
• regular review of users and the security audit log

Frequently asked questions

Does Niagara 4 support two-factor authentication?

Yes. Niagara 4 includes a Google Authenticator authentication scheme that adds a time-based six-digit code to the password login.

Can I use Microsoft Authenticator with Niagara 4?

Yes. Niagara's Google authentication uses the standard TOTP method, which Microsoft Authenticator, Authy and other TOTP apps support.

Why are my Niagara 2FA codes not accepted?

Usually the station's or the phone's clock is wrong. Configure NTP on the station host and set the phone's time automatically.

Does 2FA apply to Workbench logins as well as web logins?

It applies to station logins by users assigned the Google scheme, through the web and through Workbench station connections, when using matching, current Workbench versions.

What happens if a user loses their phone?

An administrator resets the user's authenticator enrolment and the user enrols a new device. Keep at least two administrators so this is always possible.

Does Niagara 2FA need internet access?

No. TOTP codes are generated from a shared secret and the time, so 2FA works on isolated networks provided the station's clock is accurate.

Can I use SMS codes instead of an app?

Niagara's built-in two-factor scheme uses authenticator apps. For other methods, use SAML with an identity provider that offers them.

Should kiosk displays use 2FA?

Usually not. Use a dedicated read-only account with minimal permissions on a locked-down device instead.

Is two-factor authentication required by cyber security standards?

Many security frameworks and insurers now expect multi-factor authentication for administrative and remote access to operational technology, including building systems. Enabling it for Niagara engineers and remote users helps meet those expectations.

Can I enable 2FA for only some users?

Yes. Two-factor authentication applies per user through their authentication scheme, so you can require it for administrators and engineers first and extend it later.

What time window should the Google scheme accept?

Keep it small, typically allowing one 30-second step either side of the current time. Widen it only to cope with genuine clock drift, and fix the clocks instead where possible.

Need help from a Niagara engineer?

If this guide has not solved the problem, contact the Tyrrell Products technical team on 01942 732819 or [email protected]. Tell us the controller or host type, its Niagara version and what you have already tried, and we will help you get the system running.

Related guides

• LDAP integration in Niagara 4
• JACE default credentials and security
• Code signing certificates
• What is Tridium Niagara 4?