You can use two-factor authentication for logging into Sansan to strengthen the account security. Even if the password to the account has been leaked or stolen, unauthorized entrance by third parties can be prevented with two-factor authentication.
If you enable two-factor authentication, when you log in to the following services, in addition to your ID and password, you will be asked for your authentication code.
- Sansan Web App (when using from web browser)
- Sansan Smartphone App (iOS/Android)
Enabling two-factor authentication
Two-factor authentication can be enabled from the User settings screen of each user.
How to do the settings:
1. Install an authentication app onto your smartphone.
Please install an authentication app onto your smartphone so that you can get a passcode for when you do the two-factor authentication. The Sansan two-factor authentication function works with a time-based one-time password (TOTP) app. Please use apps like those listed below:
- iPhone ... Google Authenticator, Authy
- Android ... Google Authenticator, Authy
- Windows Phone ... Microsoft Authenticator
2. Generate the authentication code
Open up the app you installed, and then take a picture of the QR code that is displayed on the Two-factor authentication screen of Sansan.
* In this sample, Google Authenticator is being used to show how to do the settings.
Open Google Authenticator, and then tap the Plus icon in the upper right of the screen. In the lower half of the screen, a menu will come up. There, tap on "Scan barcode".
The camera will open up, so please hold the camera up to the QR code displayed on the Two-factor authentication screen. The QR code will be automatically read in, and the Sansan settings will be added.
If you cannot use the camera function of your smartphone
If you cannot use the camera function of your smartphone or if for some other reason the reading of the QR code does not go well, you can also add the settings manually.
After tapping the Plus icon on Google Authenticator, select "Manual Entry" from the menu that comes up.
On the manual input screen, in "Account" put in the email address used to log in to Sansan, and in "Key", put in the string that is displayed when you click on "Display key instead" on the Settings screen for Sansan Two-factor authentication.
The key is displayed when you click on "Display key insteaad" on the Settings screen for Two-factor authentication.
The QR code and the manually input string are important information used to identify the user. Please handle them so that they are not seen by others.
3. Confirming the authentication code
When you open up the authentication app, a six-digit number will be displayed.
Please input this number into the Two-factor authentication screen on the PC.
The number displayed on the authentication app will automatically change after a certain amount of time has passed. Please finish inputting it while it is being displayed on the authentication app.
The settings for two-factor authentication are complete.
Logging in using two-factor authentication
When two-factor authentication is enabled, after authenticating your ID and password on Sansan, you will be asked for the authentication code for two-factor authentication.
Open up the authentication app you set up on your smartphone, and then input the displayed authentication code into Sansan.
With the PC version , you can save the information used in the environment, and you can skip the two-factor authentication from the second time.
* With the smartphone app, this is automatically skipped.
For system administrators: Force disable of two-factor authentication.
If a user, after installing the authentication app, loses his or her smartphone, or for some other reason the user is not able to input the authentication code, the Sansan system administrator can forcibly disable two-factor authentication for the user.
Force disabling of two-factor authentication can be done from first going to "Security settings" and then to "Two-factor authentication" from the administrator settings.
Please be aware that if an administrator forcibly disables the two-factor authentication of a user, the two-factor authentication for this user will be disabled until the user redoes the authentication settings.